Defamation and small business, the duties that keep you out of court

Defamation law in Australia places a straightforward duty on every business: when you communicate about another person or business, you must not publish material that harms their reputation. It applies to a one-line reply to a Google review just as much as to an advertising campaign, because "publication" in the legal sense simply means communicating the material to at least one person other than the person it is about.

For a small business the obligation cuts both ways. You can be the publisher who gets sued, or you can be the business whose reputation is damaged by someone else's post, review, or video. This guide sets out who the law applies to, what triggers a claim, the practical duties that keep you out of trouble, and what happens if things go wrong.

Who the law applies to and what triggers a claim

The duty applies to anyone who publishes, and the definition is wider than most business owners assume:

Individuals and companies: A founder, a company, or an employee responding to a customer can all be publishers. Publication does not need to be public. An email to a single supplier, a message in a Slack channel, or a comment in a shared group chat can all count if the material is communicated to at least one person other than the person it is about.
Online content is published where it is read: In Dow Jones & Co Inc v Gutnick (2002) 210 CLR 575, the High Court held that an article posted on the internet was published in the place where it was downloaded and read. A post aimed at your local suburb can therefore be treated as published across Australia.
Three elements must be met: The material must be defamatory, meaning it lowers the person's reputation in the eyes of ordinary reasonable members of the community. It must identify them, whether by name, image, or context. And since 1 July 2021 it must have caused, or be likely to cause, serious harm to their reputation, under s 10A of the Defamation Act 2005 (NSW).
The serious harm test filters out trivia: A judge, not a jury, decides whether serious harm is established, and a claim that cannot clear the bar can be dismissed before trial. The intent of the reform was to stop defamation being used for minor slights, which matters for small businesses that publish a lot of everyday commentary.
Companies can sue only in limited circumstances: Under s 9 of the Defamation Act 2005 (NSW), a corporation has no cause of action unless it is an excluded corporation: it has fewer than 10 employees (part-time staff counted pro rata) and is not associated with a larger corporation, or it is not formed for financial gain. A two-person startup can therefore sue for defamation, while a 50-person business generally cannot, although an individual director or employee can still sue in their own right.

Duty 1: Keep your own public statements factual

The most common flashpoint for a small business is a reply to a negative review. It is tempting to accuse a reviewer of lying, fraud, or non-payment, or to "set the record straight" with details about their conduct. Statements like these carry a defamatory meaning, and if they cannot be proved, they leave you exposed.

Truth is a defence, but it must be proved: s 25 of the Defamation Act 2005 (NSW) requires the defamatory imputations to be substantially true, and the burden is on you. The defence of honest opinion under s 31 is narrower than people think. It only protects an expression of opinion that is based on proper material and relates to a matter of public interest, which rarely covers a business's commentary about an individual customer's behaviour.

The safe pattern is to address the issue, not the person. State what your records show and invite the customer to contact you privately, without alleging anything about their character or conduct. "We are unable to locate the booking on our system, please contact our support team" costs nothing and cannot defame anyone.

The same rule applies to competitor comparisons in marketing. Commenting on your own pricing, features, and terms is low risk. Allegations about a competitor's honesty, safety standards, licensing, or legality are high risk unless you can prove them, because each one carries a defamatory meaning about a business that may be able to sue.

Duty 2: Control what others publish on your channels

The High Court confirmed in Fairfax Media Publications Pty Ltd v Voller [2021] HCA 27 that the operators of a public Facebook page are publishers of the defamatory comments that third parties leave on it. The media companies argued they had no intention to publish the comments, but the Court held that liability turns on participation in the process of communication. They had chosen to run a public page, invite comment, and moderate it, and that was enough.

The practical translation for your business is direct:

A public page with comments enabled is a publication channel you control: Whether it is Facebook, Instagram, LinkedIn, or the comment section of your own website, what third parties post there can be your legal responsibility.
Deleting a comment does not undo publication: The material has already been communicated, and in defamation law the damage is done at the moment of communication.
Prevention beats cure: Where a page invites comment on sensitive topics, consider approving comments before they go live, hiding or disabling comments on high-risk posts, and having a nominated person check the page regularly.

This duty is easy to overlook because the comments are not yours, but after Voller the law treats them as published by you.

Duty 3: Set the ground rules for staff and founders

Employees who respond to customers under pressure, or who vent in group chats that later get shared, publish on the business's behalf. A one-page communications policy is the cheapest control you can put in place:

One nominated voice: Only designated people respond publicly to reviews and complaints.
No allegations: No one posts accusations about customers, competitors, suppliers, or former staff, in any channel.
Escalation triggers: Anything involving money, safety, alleged misconduct, or legal threats is escalated internally before anyone responds.
The screenshot rule: Train everyone, including founders, to write every message as if it will be screenshotted and shown to a customer, a competitor, or a judge.

Founders speaking publicly on podcasts, LinkedIn, or at events are the brand, and the same standards apply. If a statement names someone or makes them identifiable, slow down and consider how a reasonable reader would understand it, because the business may wear the liability for what its most visible people say.

Duty 4: If you are accused, follow the statutory path

Since the 2021 reforms, defamation proceedings cannot be started until the aggrieved person has given the publisher a concerns notice that sets out the imputations they rely on (s 12B of the Defamation Act 2005 (NSW)). That notice is not a formality: it is the beginning of a structured, time-limited resolution process designed to keep disputes out of court.

The 28-day window: Within 28 days of receiving a concerns notice, the publisher can make an offer to make amends under s 14, typically a correction, an apology, and compensation for the harm caused.
A reasonable offer protects you: If the publisher makes an offer that is reasonable in the circumstances and the claimant refuses it, the offer operates as a defence to the claim under s 18.
The process is confidential: Statements made in connection with the amends process are inadmissible in later proceedings (s 19), and an apology is not an admission of fault and cannot be used as evidence of liability (s 20). Apologising does not make you liable, and in this area it is one of the few safe things you can say.
Do not argue publicly: Every reply, retort, or re-post is a fresh publication. The accumulation of your own responses, rather than the original post, is often what tips a marginal claim over the serious harm line.

If a concerns notice arrives, the 28-day window is the moment to get advice, not to draft a defence in the comments section.

What you risk if the duty is breached

A breach can expose the business to several distinct consequences, and none of them is cheap:

Damages are capped, but the cap is high: Non-economic loss damages are limited by s 35 of the Defamation Act 2005 (NSW) to an amount indexed annually, currently $478,500 for the 2024-25 year. The maximum is reserved for the most serious cases, and aggravated damages are awarded separately.
Economic loss is not capped: Lost sales, cancelled contracts, and damage to goodwill can be claimed on top of the capped amount, and for a small business that is often the larger exposure.
Courts can order removal: Injunctions requiring material to be taken down can be obtained, which matters if defamatory content is causing ongoing harm.
Time limits are strict: A claim must generally be brought within one year of publication, with only limited scope for extension.
The fight itself is costly: Even a claim that ultimately fails costs time, legal fees, and reputational capital, and a public dispute with a customer rarely ends well for either side.

A compliance checklist for this week

Put these six items on your to-do list this week:

Nominate one person who can respond publicly to reviews and complaints, and make sure the team knows who it is.
Rewrite your review response templates so they state facts and next steps, never allegations.
Decide how comments on your social channels are moderated, and who checks them.
Brief staff and founders on the screenshot rule and the escalation triggers.
If a dispute arises, preserve screenshots, URLs, and dates before anything is edited or deleted.
If a concerns notice arrives, diary the 28-day window and seek advice before it closes.

When you need a lawyer

Most of this article is about habits you can build without a lawyer, but the statutory windows make advice essential once a dispute is real. A practitioner will assess whether the serious harm element is met, review whether the material is actually defamatory and who it identifies, and advise on whether any defence such as truth or honest opinion is available on the facts.

If you are the publisher, a lawyer will help you decide whether and what to offer by way of amends within the 28-day window, and draft a response that does not repeat or extend the publication. If you are the aggrieved party, a lawyer will draft a concerns notice that particularises the imputations correctly, because s 12B means a poorly drafted notice can block proceedings later. Where material is causing ongoing harm, urgent advice can also deal with takedown requests and injunctions. In either role, advice inside the statutory windows is usually the difference between a quick, confidential settlement and litigation.

The reply is the risk

If there is one thing to remember from this article, it is that the most dangerous moment for a small business is the emotional public reply. Each reply is a fresh publication, and the pattern of your responses, rather than the original post, is often what causes the serious harm the law now requires. The first action to take this week is to take the ad-hoc reply out of your business: one nominated voice, facts only, and legal advice inside the 28-day amends window when it matters.