GDPR compliance for Australian businesses, when it applies and what you must do

Many Australian businesses that deal with customers in Europe do not realise that the European Union's privacy law can reach across the world and apply to them. The General Data Protection Regulation (Regulation (EU) 2016/679, the GDPR) is not limited to businesses based in the EU. If you offer goods or services to people in the EU or the UK, or you track their behaviour online, the GDPR can impose obligations on your business on top of your existing duties under the Privacy Act 1988 (Cth).

The good news is that GDPR compliance does not require a big privacy team or expensive software. It comes down to a set of concrete duties: mapping the personal data you hold, choosing a lawful basis for each use, giving clear privacy information, honouring individual rights, contracting your vendors, securing the data, and reporting serious breaches quickly. This guide sets out each of those obligations, who they apply to, and what happens if you miss them.

The GDPR applies to processing of personal data about people who are in the EU, even where the business doing the processing has no office there. Article 3 of the Regulation catches a business that is not established in the EU where its processing is related to either:

Offering goods or services: supplying goods or services to people in the EU, even if no payment is taken. Shipping to EU addresses, selling digital products to EU customers, or accepting a booking from someone while they are travelling in the EU can all trigger it.
Monitoring behaviour: observing the behaviour of people in the EU, as long as the behaviour takes place within the EU. Cookies, analytics, app tracking and profiling of EU users all count.

Common triggers for a small Australian business include an eCommerce store that ships to the EU, ads targeted at EU users, an app used by people in those countries, or a mailing list with EU subscribers. A website that is merely accessible from the EU is less likely to be caught on its own, but passive availability is not a complete shield if you still track EU visitors with cookies or analytics.

Two further points matter. First, the UK runs a separate but very similar regime, the UK GDPR, enforced by the Information Commissioner's Office, and the same analysis applies to people in the UK. Second, your Australian obligations continue regardless. Most businesses with annual turnover above $3 million are covered by the Privacy Act 1988 (Cth) and its Australian Privacy Principles. Smaller businesses are generally exempt, but there are exceptions, so it is worth checking where you sit. The GDPR is an extra layer on top of the Privacy Act, not a replacement for it.

Map your data and record a lawful basis for each use

The GDPR's first practical demand is that you can show why you are allowed to process each piece of personal data. Article 6 sets out six lawful bases, and you need at least one for each distinct purpose. The ones Australian small businesses use most are:

Contract: to deliver something the customer asked for, such as fulfilling an order.
Consent: for genuinely optional activities such as sending marketing emails or loading non-essential cookies.
Legitimate interests: for activity a reasonable person would expect, such as fraud prevention, after balancing it against people's rights.
Legal obligation: where the law requires the processing, such as keeping tax records.

Start with a data map. List what you collect, where it comes from, who it is shared with, and how long you keep it. For each item, note the lawful basis you rely on and the reasoning. That short record becomes the backbone of your privacy policy, your vendor contracts and your retention schedule, and it is the document a regulator will ask for first.

Article 12 requires you to provide information about your processing in a concise, transparent and easily accessible form, using clear and plain language, at the point of collection. Your privacy notice should cover what you collect, why, the lawful basis, who you share it with and how long you keep it.

Where you rely on consent, Article 7 sets a high bar. Consent must be freely given, specific, informed and unambiguous, and you must be able to demonstrate it was given. Withdrawing consent must be as easy as giving it, and you cannot make a contract conditional on consent to processing that is not actually needed to perform that contract. For most optional marketing and tracking, that means an opt-in, not a pre-ticked box. Separate EU and UK rules on cookies and electronic marketing generally require consent before non-essential tracking loads, so check that your cookie banner and settings reflect what your site actually does.

Be ready to honour individual rights

The GDPR gives individuals a broader set of rights than the Privacy Act. The UK regulator's guide to individual rights sets them out: the right to be informed, access, rectification, erasure, restriction of processing, data portability, objection, and rights around automated decision-making and profiling. Where the Privacy Act gives access and correction, the GDPR adds erasure, portability, restriction and objection.

You generally have one month to respond to a request, extendable by two months where requests are complex or numerous. Responses must be free of charge unless a request is manifestly unfounded or excessive. For a small business, the practical fix is a simple workflow: a single inbox for requests, a template to acknowledge them, a deadline tracker, and a named person responsible for responding.

Contract your processors and manage overseas transfers

Any third party that handles personal data on your behalf is a processor: cloud software, email marketing platforms, payment providers, outsourced support teams. Article 28 requires a binding contract with each processor covering the subject matter and duration of the processing, the nature and purpose, the types of data and data subjects, and specific obligations such as following documented instructions, keeping data secure, and deleting or returning data when the engagement ends. You should also check whether the processor uses sub-processors and require its authorisation for any changes.

If personal data is transferred outside the EU or UK, the rules in Articles 44 to 49 require an appropriate safeguard. For an Australian business that usually means the European Commission's Standard Contractual Clauses, sometimes with additional checks about the destination country. A well-drafted Data Processing Agreement (DPA) with each vendor, reviewed against the countries your data flows through, is the standard way to satisfy both requirements.

Secure the data you hold

The GDPR requires appropriate technical and organisational measures to protect personal data, scaled to the risk. For most small businesses that means practical controls: access controls and multi-factor authentication on business systems, encryption where practical, keeping software patched, restricting who can export customer lists, and training staff on the basics. The Regulation does not prescribe particular technology. It asks you to show that you thought about the risk and put proportionate safeguards in place, and it expects the same of your processors.

Report serious breaches within 72 hours

Under Article 33, if you experience a personal data breach that is likely to result in a risk to people's rights and freedoms, you must notify the relevant EU or UK supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. If you notify late, you must explain why. Breaches unlikely to result in a risk do not need to be notified, but you should still document them.

In Australia, the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth) works alongside this. An eligible data breach is unauthorised access to, disclosure of, or loss of, personal information that is likely to result in serious harm. Where you have reasonable grounds to believe an eligible breach has happened, you must notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable. The two regimes have different tests and different timeframes, so your breach response plan should map both.

Keep records that demonstrate compliance

The GDPR is built around accountability. Article 5(2) makes you responsible for demonstrating compliance, and Article 30 requires controllers to keep records of their processing activities, with a lighter obligation for small organisations. Even where the formal record-keeping requirement is light, keeping evidence is how you show a regulator you took the duties seriously: your data map, lawful basis notes, privacy notices, signed DPAs, training logs and breach records. Review them when you launch a new product, sign a new vendor or start collecting a new type of data.

What happens if you get it wrong

GDPR fines are set at a level designed to hurt. Under Article 83, the higher tier reaches up to €20 million or 4 per cent of total worldwide annual turnover, whichever is greater, for breaches of the core principles and consent rules and for failures to honour individual rights, including unlawful international transfers. The lower tier reaches up to €10 million or 2 per cent of worldwide turnover for other obligations, such as processor contracts, security measures, breach notification and record keeping. Fines are only part of the picture. EU regulators can also order you to stop processing, and individuals can complain to a regulator or bring compensation claims.

Australian exposure runs in parallel. Under s 13G of the Privacy Act 1988 (Cth), a body corporate that seriously interferes with privacy can face a civil penalty of up to $50 million, or three times the value of any benefit obtained, or 30 per cent of adjusted turnover, whichever is greatest. Individuals face up to $2.5 million. The Office of the Australian Information Commissioner investigates complaints and can seek these penalties in court.

Work through the checklist in order, and you will have covered every obligation in this guide:

Run the scope check: do you offer goods or services to people in the EU or UK, or monitor their behaviour online?
Map your data: what you collect, from whom, where it goes, and how long you keep it.
Record a lawful basis: write a short note of your reasoning for each purpose.
Update your privacy notice and cookie banner: make them match your actual data flows and lawful bases.
Sign a DPA with each processor: check which countries your data flows through.
Set up a rights-request workflow: include a tracker for the one-month deadline.
Prepare a breach response plan: cover both the 72-hour GDPR route and the Australian Notifiable Data Breaches scheme.
Keep records: data map, lawful basis notes, DPAs, training logs and a breach log.
Review everything yearly: revisit the program whenever you launch a new product or take on a new vendor.

Where a privacy lawyer earns their keep

Most of this can be done in-house, but a privacy lawyer adds value at specific points: assessing whether the GDPR actually catches your business and whether you need to appoint an EU or UK representative, working through lawful basis decisions where legitimate interests and consent overlap, reviewing and negotiating DPAs and Standard Contractual Clauses, running a privacy impact assessment for a higher-risk project, and responding to a breach or a regulator inquiry where the deadlines and documents matter.

Most Australian SMEs will not need a formal Data Protection Officer. Under Article 37, one is only required where your core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of sensitive categories of data. Whether your processing counts as large scale is exactly the kind of judgment call a lawyer can help with. A practitioner can also reconcile your GDPR paperwork with the Privacy Act so you run one coherent privacy program rather than two.

Start with a data map, not a policy

The mistake most Australian businesses make is buying template policies first. A privacy policy that does not match your actual data flows is worse than none, because it is evidence you did not do the work. The duty that catches businesses by surprise is the lawful basis record: without a data map, you cannot say why you process anything, and every other document in your program rests on it.

So the first action this week is not drafting. Trace one customer from checkout to email marketing to analytics and write down what you collect, why, who sees it and how long you keep it. That single map tells you whether the GDPR applies, which lawful bases you need, which vendors need DPAs, and what your privacy policy should say. Everything else follows from it.