GDPR compliance for Australian businesses and what you need to do

Australian businesses often assume the General Data Protection Regulation (the GDPR, Regulation (EU) 2016/679) is an EU-only concern. It is not. The GDPR can apply to a business with no office, staff or bank account in Europe if it processes the personal data of individuals who are in the EU or the EEA.

This article sets out the obligation in plain terms: when the GDPR reaches your Australian business, what you must actually do, the deadlines that matter, and what is at stake if you get it wrong. We cover the trigger test, the core duties (lawful basis, transparency, individual rights, security, breach notification, processor contracts, international transfers and the EU representative), the penalties, and a practical checklist.

The GDPR's extraterritorial reach is set out in Article 3. It applies to the processing of personal data of individuals in the EU or EEA by a controller or processor not established in the EU, where the processing relates to:

Offering goods or services: providing goods or services to individuals in the EU or EEA, whether or not they pay. An EU customer buying from your online store, or signing up to your software, is enough.
Monitoring behaviour: tracking individuals' behaviour within the EU, for example through website analytics, cookies, pixels or behavioural advertising.

The test turns on where the individual is when their data is collected or used, not on where your business is based. An Australian business that sells to EU customers, runs ads targeting France or Germany, tracks EU website visitors, or takes EU sign-ups for a SaaS product can be within scope even with a fully Australian team.

Crucially, the GDPR has no small business exemption. Under the Privacy Act 1988 (Cth), a business with an annual turnover of $3 million or less in the previous financial year is generally a small business (s 6D) and falls outside the definition of an "organisation" that must comply with the Australian Privacy Principles (s 6C). That exemption says nothing about the GDPR. A sole trader with modest turnover who sells online to EU customers can still be caught.

A quick self-assessment:

EU sales: do you accept EU shipping addresses or payments in euros?
EU marketing: do you run advertising campaigns targeting EU countries, or offer your site in EU languages?
EU tracking: does your website track visitors from the EU using cookies, pixels, analytics or remarketing tools?
EU users: do individuals in the EU sign up to your services, newsletter or account system?

If the answer to any of these is yes, treat the GDPR as relevant. If your services are strictly local, you do not target the EU and you have no EU users, the regulation is unlikely to reach you, although privacy compliance remains a commercial expectation worth meeting.

Choose and document a lawful basis

You cannot process personal data just because it is useful. Under Article 6, every processing activity needs one of six lawful bases. For most small businesses the relevant ones are:

Consent: the individual actively agrees, by a clear affirmative act. A pre-ticked checkbox is not consent: Article 4 requires consent to be freely given, specific, informed and unambiguous.
Contract: you need the data to deliver the product or service the customer asked for.
Legal obligation: you must process the data to comply with a law.
Legitimate interests: you have a genuine business reason that is not overridden by the individual's privacy rights.

The practical task is to write down which basis you rely on for each activity, because you may need to show it later. If you rely on consent, keep a record of when and how it was given, and make withdrawing it as easy as giving it.

Be transparent about collection and use

Article 12 requires information about processing to be concise, transparent, intelligible and easily accessible, in clear and plain language. Before or when you collect data, you must tell people:

What: what personal data you collect and why
Basis: the lawful basis you rely on
Sharing: who you share it with, including service providers
Retention: how long you keep it
Rights: how they can exercise their rights

For most businesses this means a privacy policy that actually matches what you do, plus short collection notices on forms, at checkout and where you sign people up. A template that describes practices you do not have is a liability, because the GDPR's transparency rules are about accuracy.

Honour individual rights within the deadlines

The GDPR gives individuals a set of rights over their data: access, rectification, erasure (the "right to be forgotten"), restriction of processing, data portability and objection to processing such as direct marketing. Under Article 12 you must respond to a request without undue delay and in any event within one month of receiving it, extendable by up to two further months if the request is complex or there are many of them.

For a small team the challenge is operational, not legal: you need a repeatable process so a request is not lost in an inbox. A dedicated email address or form, basic identity verification, a checklist of systems to search (CRM, email marketing, support desk, order system), template responses and a tracking log will cover most businesses.

Secure the data and report breaches on time

Under Article 32, you must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art and the cost of implementation. For a small business, appropriate measures usually include strong passwords and multi-factor authentication, access controls so staff only see what they need, encrypted storage and backups, and vetting your software providers.

If a personal data breach occurs, Article 33 requires you to notify the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to individuals. You must also document the breach. If the breach is likely to result in a high risk to individuals, Article 34 requires you to communicate it to the affected individuals without undue delay, for example where unencrypted customer data has been exposed. A written incident plan, naming who does what and when, matters before anything goes wrong.

Contract with anyone who processes data for you

If you use a third party to process personal data on your behalf, such as a cloud platform, email marketing tool, CRM, booking system or outsourced support provider, Article 28 requires a contract that binds the processor and sets out the subject matter and duration of the processing, its nature and purpose, the types of personal data and categories of data subjects, and the parties' obligations and rights. The processor must act only on your documented instructions, help you respond to rights requests and breaches, and delete or return the data when the service ends.

This is usually handled through a data processing agreement or processor clauses in your services agreement. It is also one of the most commonly missed steps: businesses assume their vendor "handles compliance", but the GDPR puts the responsibility on you to manage the relationship, including authorising any sub-processors.

Manage international transfers

Chapter V of the GDPR (Articles 44 to 49) restricts transfers of personal data out of the EU or EEA to other countries. This matters for Australian businesses twice over: EU customers' data may sit in your systems in Australia, and your overseas software providers may store it outside the EEA.

Where the destination country has not been covered by an EU adequacy decision, an approved transfer mechanism is generally required, most commonly the standard contractual clauses, supported by a risk-based assessment of the destination. If this sounds technical, it is the part of GDPR compliance where a lawyer earns their fee, because getting the mechanism wrong can invalidate the transfer.

Appoint an EU representative if required

Under Article 27, if the GDPR applies to you because of Article 3(2) and you have no establishment in the EU, you must designate in writing a representative in the EU who can be approached by supervisory authorities and individuals on all issues related to your processing. The representative does not shield you from liability; it gives EU authorities and individuals someone to deal with directly.

There are exceptions for processing that is occasional, does not involve large-scale processing of sensitive data or criminal conviction data, and is unlikely to result in a risk to individuals. If you have ongoing EU customers or active EU targeting, an EU representative is likely to be required, and the question should be resolved as part of your compliance project.

What is at stake if you do not comply

Enforcement sits with the data protection supervisory authorities of the EU member states. Under Article 83, administrative fines can reach 20 million euros, or 4 per cent of the total worldwide annual turnover of the preceding financial year, whichever is higher, for the most serious breaches. That top tier covers failures to meet the core processing principles, to obtain valid consent, to honour data subject rights or to comply with the transfer rules. A second tier of fines up to 10 million euros or 2 per cent of worldwide annual turnover applies to other obligations, including security, breach notification and processor contracting.

Supervisory authorities can also order corrective measures such as warnings, restrictions on processing or bans, and individuals can complain to a supervisory authority or seek a judicial remedy. Beyond penalties, EU customers, payment providers and marketplaces increasingly ask for evidence of GDPR compliance, so the commercial cost of getting it wrong can exceed the fine.

A practical compliance checklist

Whatever the size of your business, a reasonable GDPR project looks like this:

Scope check: work out whether Article 3(2) reaches you, in writing, and revisit it if you start targeting the EU.
Data map: list what personal data you collect, where it comes from, where it is stored, who you share it with and how long you keep it.
Lawful basis: record the basis for each processing activity, and fix your consent collection (no pre-ticked boxes).
Privacy documents: make your privacy policy and collection notices match your actual practices.
Website: review cookies and tracking tools and, where needed, put a consent tool in place, noting that EU cookie rules (the ePrivacy regime) can apply alongside the GDPR.
Marketing: check consent and unsubscribe processes, keeping in mind that emailing recipients in Australia also engages the Spam Act 2003 (Cth), which prohibits unsolicited commercial electronic messages without consent (s 16) and requires a functional unsubscribe facility (s 18).
Contracts: put data processing agreements in place with every provider that processes data for you.
Incident plan: write down who does what if a breach happens, including the 72-hour notification step.
Rights workflow: set up a simple process for access and deletion requests.
EU angles: assess whether you need an EU representative, and how EU data reaches you or your providers.

Where a lawyer helps

A lawyer's role in a GDPR project is to answer the questions where the answer is not obvious: whether the trigger test actually reaches you, which lawful basis is defensible for a particular activity, whether an approved transfer mechanism is required for a specific provider, what the EU representative requirement means for your structure, and how to respond if a supervisory authority or an individual makes contact. A lawyer can also draft the data processing agreement, review your privacy documents against your actual data flows, and advise on how the GDPR interacts with your obligations under the Privacy Act and the Spam Act so the two regimes do not contradict each other.

Start with a scoping check, not a template

The step Australian businesses most often miss is the first one: deciding, in writing, whether the GDPR reaches them at all. The trigger turns on where the individual is, not where you are, so it is easy to drift into scope by accident, through one EU order, one ad campaign or one analytics tool. Before you buy a template privacy policy or a consent tool, do the scope check and the data map. If you cannot answer the scope question confidently, take it to a lawyer first; the documents can come after.