Workplace policies for small business and which ones the law actually requires

If you run a small business in Australia, workplace policies can feel like something the big end of town worries about. But the legal duties sitting underneath employment are yours whether you employ five people or five hundred. No single law says every employer must keep a policy manual. Instead, a set of separate obligations across work health and safety, fair work, anti-discrimination, privacy and whistleblowing each put real pressure on you to set expectations in writing, and a few of them only bite once your business crosses a size or turnover threshold. This article walks through which obligations apply to your business, what each one actually requires, and what happens when you try to meet them with nothing but good intentions.

First, work out which thresholds apply to your business

The most common mistake is treating "workplace policies" as one generic task. In law, they are a collection of separate duties, and which ones bind you depends on your headcount, your turnover and how your business is structured.

Headcount under 15: under s 23 of the Fair Work Act 2009 (Cth), you are a small business employer if you employ fewer than 15 employees. Regular casuals count toward the number, and associated companies are counted as one employer. This classification matters most for unfair dismissal: under s 388 of the Act, a dismissal that follows the Small Business Fair Dismissal Code cannot be found unfair.
Turnover of $3 million or less: under s 6D of the Privacy Act 1988 (Cth), your business is a small business if its annual turnover for the previous financial year was $3 million or less, and small businesses are generally exempt from the Australian Privacy Principles, with exceptions for particular activities and industries.
A company that has become "large": under s 45A(3) of the Corporations Act 2001 (Cth), a proprietary company is large in a financial year if it meets at least two of three tests: consolidated revenue of $25 million or more, gross assets of $12.5 million or more, or 50 or more employees. Large proprietary companies and public companies must have a whistleblower policy under s 1317AI.
Everyone, regardless of size: work health and safety duties and anti-discrimination laws have no headcount or turnover threshold. If you employ anyone at all, they apply to you.

Your work health and safety duty: the one with criminal penalties

If you conduct a business or undertaking, the WHS laws call you a person conducting a business or undertaking, or PCBU. Under s 19 of the Work Health and Safety Act 2011 (Cth), you must ensure, so far as is reasonably practicable, the health and safety of your workers and of anyone else affected by the work. Your state or territory imposes the same primary duty in near-identical terms, and it applies from your first hire with no size threshold.

This duty is not about paperwork, but written policies are how you prove the "so far as is reasonably practicable" part. A short WHS policy that sets out:

Hazard and incident reporting: who to tell, how, and what happens next.
Consultation: how you consult workers on safety matters that affect them.
Responsibilities: what managers and workers each must do.

That turns a general legal duty into something a worker can actually follow, and it is the first thing a regulator will look at after an incident.

Officers of the business, including directors, carry their own separate duty to exercise due diligence in making sure the business understands and complies with its WHS obligations. WHS is not something you can delegate entirely to a manager or a safety officer.

The penalties are the real reason this policy matters. Under Schedule 4 of the Work Health and Safety Act 2011 (Cth), a category 1 offence, reckless or negligent conduct that exposes someone to a risk of death or serious injury, carries a maximum fine of $3 million for an individual who is a PCBU or officer, or 15 years imprisonment, and up to $15 million for a company. Category 2 offences carry up to $418,000 for an individual PCBU or officer and $2.09 million for a company, and category 3 up to $140,000 and $700,000. Your state's indexed amounts are similar.

Fair work obligations: the baseline your policies sit on

The Fair Work Act 2009 (Cth) sets out National Employment Standards that apply to every employee, and most employees are also covered by a modern award or an enterprise agreement. Policies do not replace any of those entitlements. What they do is show that you communicated standards, trained people and responded to issues fairly. Two mechanisms make that demonstration important:

Stop-bullying orders: a worker who reasonably believes they have been bullied at work can apply to the Fair Work Commission for an order to stop the bullying (s 789FC of the Act). The Commission will assess whether there is a risk the bullying continues, and what steps you have taken is central to that assessment. A conduct and anti-bullying policy with a named contact, practical examples and a fair complaints process is your evidence.
Unfair dismissal: if you are a small business employer with fewer than 15 employees, a dismissal that follows the Small Business Fair Dismissal Code under s 388 of the Act cannot be found unfair. The Code is short, but showing you followed it usually comes down to documented warnings and a consistent process, which is where your conduct policy and disciplinary procedure do their work.

Anti-discrimination: the positive duty every employer now carries

The Sex Discrimination Act 1984 (Cth) now imposes a positive duty on employers and PCBUs. Under s 47C, you must take reasonable and proportionate measures to eliminate, as far as possible, unlawful sex discrimination, sexual harassment, hostile workplace environments and victimisation. The Australian Human Rights Commission can inquire into compliance with the duty, issue compliance notices and accept enforceable undertakings.

"Reasonable and proportionate" is assessed against the size, resources and nature of your workplace, so the test is not the same for a two-person studio and a hundred-person firm. What a small business can realistically do is a written policy, practical training at onboarding, and a complaints process that people know about. Those are the measures a regulator will weigh first. State and territory anti-discrimination laws add overlapping obligations on top of the federal duty.

Privacy: when the Australian Privacy Principles apply to you

If your turnover is above the $3 million threshold, the Australian Privacy Principles in the Privacy Act 1988 (Cth) govern how you collect, use, store and disclose personal information, including customer details, marketing lists and order records. Below the threshold the Act generally does not apply to you, but some activities bring smaller businesses inside it, and your state or territory may have its own rules. The Act also treats employee records differently from customer data, so it is worth checking where your staff files sit before assuming a customer-facing privacy policy covers them.

Whatever your size, a short privacy and confidentiality policy is worth having because privacy is also a trust and contract issue. It tells staff how to handle customer information, passwords, company devices and confidential business records, and it is the natural companion to your IT acceptable use rules.

Workplace surveillance: check your state before you monitor

Monitoring is the policy area where Australian law is genuinely state-specific. In NSW, for example, s 10 of the Workplace Surveillance Act 2005 (NSW) requires written notice at least 14 days before camera, computer or tracking surveillance of an employee begins. The notice must state the kind of surveillance, how it will be carried out, when it starts, whether it is continuous or intermittent, and whether it is ongoing or for a limited period.

Other states and territories take different approaches, and some laws restrict covert recording in private areas such as change rooms and bathrooms. The rules that apply to CCTV in your shop or tracking in your delivery vehicle depend on where your staff work. Whatever your state, a surveillance policy that says what you monitor, why, and how staff are told is the minimum, and it should be reviewed before you install anything new.

Whistleblower policies: a genuine must-have for companies

Under s 1317AI of the Corporations Act 2001 (Cth), a public company must have a whistleblower policy and make it available to its officers and employees. A proprietary company that has been a large proprietary company in a financial year must have one from at least six months after the end of that year, and so must corporate trustees of registrable superannuation entities. Failing to maintain the policy is an offence. The section sets out the matters the policy must address, including how disclosures can be made, the protections available and how they will be handled.

Even where the policy is not required, the whistleblower protections in Part 9.4AAA of the Act apply to companies of all sizes, including small proprietary companies. That means the legal framework around reporting misconduct applies to you whether or not you are obliged to have the document, and a simple policy makes that framework usable for staff who are worried about speaking up.

What happens if you get it wrong

The consequences track the duties:

WHS: prosecution by your state or territory regulator, with maximum fines up to $15 million for a company for a category 1 offence, and up to 15 years imprisonment for individuals, as set out in Schedule 4 of the Work Health and Safety Act 2011 (Cth).
Fair work: the Fair Work Commission can make stop-bullying orders that bind your business, and can order reinstatement or compensation in unfair dismissal cases.
Anti-discrimination: the Australian Human Rights Commission can issue compliance notices and accept enforceable undertakings under the positive duty.
Whistleblowing: an offence for a company that is required to have a policy and does not maintain one.
Privacy: a customer or staff member can complain to the Office of the Australian Information Commissioner, which investigates alleged breaches of the Australian Privacy Principles.
And in every dispute: a tribunal will read your policies to work out what you promised and whether you acted consistently. A policy you cannot or will not follow is worse than no policy at all.

A practical compliance checklist

Work through this list once a year, or whenever your business changes shape:

Know your triggers: count your staff, check last year's turnover, and check whether your company meets the large proprietary company test.
WHS: a short policy covering hazard and incident reporting, consultation and responsibilities, with training for everyone.
Conduct: a code of conduct and an anti-bullying, harassment and discrimination policy with a named contact and a fair process.
Privacy: confidentiality and data handling rules for customer information, passwords, devices and business records.
IT: acceptable use rules if staff use company devices, email or Wi-Fi.
Surveillance: if you monitor, comply with your state's notice requirements and document what you do and why.
Whistleblower: if you are a public company or a large proprietary company, a compliant policy is not optional.
Roll out: have staff acknowledge key policies in writing at onboarding, and review the suite annually or when you hire, move premises or introduce new tools.

When you need a lawyer's help

Much of this is common sense, but a lawyer earns their fee at three points:

Drafting: policies should match your award, your industry and how you actually operate, not a downloaded template, and a lawyer can check that they do not accidentally create contractual promises you cannot keep.
State-specific questions: surveillance and privacy are the examples, because the rules genuinely differ between jurisdictions.
When something has already gone wrong: if a regulator is inquiring, a complaint is lodged or a dismissal is challenged, a lawyer can advise on how to respond and whether your existing policies hold up.

Start with the two policies the law treats as non-negotiable

So, are workplace policies legally required in Australia? The honest answer is that no single law forces every small business to keep a policy manual, but two obligations come close. Your WHS duty applies from your first hire, carries criminal penalties and is enforced in every state and territory. And if your company crosses the large proprietary company test, a whistleblower policy is a statutory requirement, not a nice-to-have. Everything else in the suite earns its keep through the fair work and anti-discrimination duties it helps you prove. This week, count your staff, check last year's turnover, and put in writing how hazards and misconduct get reported. That is the first thing a regulator, the Fair Work Commission or a court will look for.