Professional services compliance and legal obligations for Australian businesses

There is no single statutory definition of "professional services" in Australian law. The label appears in contracts, insurance policies and industry rules, but your legal obligations attach to what you actually do, not the term you use for it. If your business sells specialised knowledge, judgement or advice, that is a professional service for the purposes of this article, and a specific set of duties applies from day one.

Those duties cover registration and tax, industry licensing, consumer law, privacy, employment, and intellectual property. This article sets out who they apply to, the thresholds that bring you within scope, what each duty requires, and what happens if you get it wrong.

Who these obligations apply to

Professional services are services delivered by people with specialised training, qualifications or experience, typically involving judgement, analysis or advice rather than the supply of physical goods. Legal, accounting and auditing work, management and strategy consulting, IT and cybersecurity, engineering and architecture, financial planning and broking, and health and allied health practices all fall within the description.

Because there is no single "professional services" licence, you need to work out which regimes catch your particular activities. The main triggers are:

GST: you must register if your GST turnover is or is projected to be $75,000 or more.
Privacy: the Privacy Act 1988 (Cth) applies to APP entities, which is generally any business with annual turnover above $3 million, plus businesses that fall within an exception.
Financial advice: you need an Australian financial services licence (AFSL) to provide financial product advice.
Tax and BAS services: you must be registered with the Tax Practitioners Board to provide tax agent or BAS services for a fee.
Business name: you must register a business name with ASIC if you trade under a name other than your own.
Legal, migration and health practice: legal practice, migration assistance and most health professions require state-based or national registration.

Self-assess against these triggers before you take on your first client. The remainder of this article explains what each duty involves.

Register your business and meet your tax obligations

Most professional services businesses start with an Australian Business Number (ABN). If you will trade under a name other than your own name, or your company's name, you must also register a business name with ASIC. It is an offence to trade under an unregistered business name.

GST is the tax obligation that catches most firms by surprise. Under s 23-15 of the A New Tax System (Goods and Services Tax) Act 1999 (Cth), your registration turnover threshold is set by reference to your projected GST turnover. For most businesses that threshold is $75,000. Once your current or projected turnover meets it, you must register within 21 days, and penalties apply if you fail to register when required. GST is charged at 10% on your fees, and you can claim input tax credits for business purchases, which is one reason some firms register before they reach the threshold.

Hold the licence or registration your service requires

Some services can only be provided by a registered or authorised practitioner. Providing them without the right authorisation is usually an offence and can expose you to penalties, voided engagements and personal liability. The main regimes that require authorisation are:

Financial product advice: you must be authorised under an AFSL to provide financial product advice, for example recommending a particular financial product to a client. Unlicensed conduct carries serious civil and criminal consequences under the Corporations Act 2001 (Cth).
Tax and BAS services: you, your company or your partnership must be registered with the Tax Practitioners Board to provide tax agent services for a fee. As a condition of registration you must maintain professional indemnity (PI) insurance that meets the Board's requirements.
Legal practice: in most states, legal practice requires a practising certificate under the Legal Profession Uniform Law, and approved professional indemnity insurance is a condition of holding it.
Migration and health: migration assistance can only be provided by a registered migration agent, and most health professions require registration under the national registration scheme.

PI insurance is mandatory in some fields and commercially essential in most others. Corporate and government clients commonly require evidence of PI, public liability and cyber cover as a condition of engagement, so check what your target clients will demand before you price your work.

Comply with the Australian Consumer Law

The Australian Consumer Law (the ACL) is Schedule 2 of the Competition and Consumer Act 2010 (Cth) and applies to almost every business selling services in trade or commerce, including business-to-business engagements.

Section 18 of the ACL prohibits engaging in conduct that is misleading or deceptive, or likely to mislead or deceive. It covers your website, proposals, pitches, invoices and client communications. Claims about performance, timing, outcomes or your own credentials need to be accurate and appropriately qualified, and qualified where they are opinions or forecasts. A breach of s 18 does not attract a pecuniary penalty, but clients can sue you for the loss they suffer and seek injunctions.

Section 29 of the ACL separately prohibits making false or misleading representations about services, including their standard, quality, value or grade. This is a penalty provision. Under s 224 of the ACL, a body corporate can face a maximum pecuniary penalty of the greater of $100 million, three times the benefit obtained, or 30% of adjusted turnover for a contravention of Part 3-1 of the ACL, which includes s 29.

The ACL's consumer guarantees for services also matter. When services are supplied to a consumer, the ACL implies guarantees that the work will be rendered with due care and skill (s 60), will be reasonably fit for any purpose you were told about (s 61), and will be supplied within a reasonable time (s 62). A client is a "consumer" for services if the price is $100,000 or less, or the services are of a kind ordinarily acquired for personal, domestic or household use. Many business-to-business advisory engagements above $100,000 fall outside the guarantees, but the misleading conduct protections in s 18 and s 29 still apply regardless of the client's size or the contract value.

Handle personal information under the Privacy Act

The Privacy Act 1988 (Cth) (the Act) and the Australian Privacy Principles (the APPs) apply to APP entities. Under s 6D of the Act, a business is generally a small business, and exempt, if its annual turnover for the previous financial year was $3 million or less. The exemption does not apply if you provide a health service and hold health information, handle tax file numbers, are a credit reporting body, or have chosen to be treated as an APP entity. Even where the Act does not strictly apply, many clients contractually require you to meet APP-like standards.

If you are an APP entity, the APPs require you to have a clear privacy policy, collect personal information only for purposes you disclose, use and disclose it only for those purposes, keep it secure, and give individuals access and correction rights. If you experience an eligible data breach, you must prepare a statement and notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable under Part IIIC of the Act.

The stakes are high. For a serious or repeated interference with privacy, a body corporate can face a maximum penalty of the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover under s 13G of the Act. The Government has also announced a second tranche of reforms that proposes removing the small business exemption, so if you currently rely on it, treat that position as temporary and monitor developments.

Get the employment and workplace basics right

If you hire employees, you must comply with the Fair Work Act 2009 (Cth): the National Employment Standards, any applicable modern award, superannuation, and pay as you go withholding. As a person conducting a business or undertaking you also carry duties under work health and safety laws, even in an office-based firm.

If you engage contractors, make sure the arrangement is genuine. Sham contracting, where an employee is told they are an independent contractor to avoid employment obligations, is prohibited under s 357 of the Fair Work Act 2009 (Cth). The 2024 Closing Loopholes reforms increased the penalties that apply and reformed the defence, so this is an area regulators are actively targeting. A written contract that calls someone a contractor does not, by itself, make them one.

Protect the knowledge you sell

Professional services firms trade in knowledge, so intellectual property is a core asset. A registered trade mark gives you exclusive rights to use your brand across Australia in respect of the goods and services you register it for, which is far stronger protection than a business name registration. Business name registration tells clients who you are; a trade mark protects the brand itself against confusingly similar use by others.

You also need to decide who owns the intellectual property in your deliverables. If you do not document it, disputes arise over whether the client owns the report, code or designs you produced, and whether you can reuse templates and tools for other clients. Your client agreement should assign or licence IP explicitly, and your engagement terms should state what happens to work product at the end of the project.

The consequences of getting it wrong

Non-compliance is not an abstract risk. The enforcement figures are significant:

Consumer law: up to $100 million for a body corporate for a contravention of a penalty provision such as s 29 of the ACL, plus damages claims from clients.
Privacy: up to $50 million for a body corporate for a serious interference with privacy, plus mandatory notification and remediation costs.
GST: penalties for failing to register when required, plus interest and the GST itself.
Licensing: unlicensed financial services or tax agent work can lead to penalties, criminal consequences and contracts that cannot be enforced, meaning you may do the work and never be paid.
Employment: sham contracting penalties and orders to back-pay entitlements.

Beyond penalties, a compliance failure can void your contracts, trigger professional indemnity claims, and exclude you from corporate and government panels that require clean compliance records. For a knowledge business, that can be fatal.

A practical compliance checklist

Work through this list before you onboard your first client, then review it at least quarterly:

Apply for an ABN and register any business name with ASIC.
Calculate your current and projected GST turnover; register within 21 days if it meets the $75,000 threshold.
Confirm whether your services require a licence, registration or practising certificate, and keep it current.
Check the professional indemnity insurance requirements in your field and what your target clients will require.
Publish a privacy policy and prepare a data breach response plan; reassess your APP status as revenue grows.
Put a service agreement in place covering scope, fees, client responsibilities, limitations of liability, confidentiality and IP ownership.
If you hire, use compliant employment contracts and never label an employee as a contractor.
Calendar quarterly reviews of your contracts, insurance, registrations and privacy settings.

Where a lawyer helps

A commercial lawyer can map your services against the regimes that apply, which is the step most founders get wrong because they assume one licence or one document covers everything. A lawyer can also advise on business structure, draft your client agreements, statements of work, confidentiality and IP assignment terms, review marketing claims against s 18 and s 29 of the ACL, and check whether a professional standards scheme in your state could limit your civil liability. Engaging a lawyer early, before the first client contract or first hire, is cheaper than unpicking a voided engagement or an employee classification dispute later.

The thresholds that shift as you grow

The two figures that catch professional services firms out are $75,000 and $3 million. The first is your GST registration threshold: growth that pushes projected turnover past it starts a 21-day clock you can easily miss. The second is the privacy threshold, and it is a moving target, because the Government has proposed removing the small business exemption altogether. The practical first step this week is to calculate your current and projected turnover, work out whether any privacy exception applies to you, and put the quarterly review on your calendar before the growth happens.