SaaS legal obligations in Australia and what your software business must get right

Selling software as a subscription is a different legal proposition from selling a one-off licence. Your customers are buying an ongoing service, and that service is regulated in ways a static download never was. Three regimes matter most for an Australian SaaS business: the Privacy Act 1988 (Cth) for the personal information your platform collects and stores, the Australian Consumer Law (the ACL) for the consumer guarantees and unfair contract terms rules that apply to your standard-form agreement, and the prohibition on misleading or deceptive conduct for how you market the product.

Get these wrong and the consequences are concrete: terms in your customer contract that are void and unenforceable, regulator penalties that can run to hundreds of millions of dollars, and customer agreements you cannot rely on when you need to suspend a non-paying user or defend an uptime dispute. This guide sets out who each obligation applies to, what you must actually do to comply, and what happens if you do not.

Do these obligations apply to your business?

The first question is whether your business is captured at all. The answer differs for each regime, and the thresholds matter more than most founders realise.

• Privacy Act: You are an APP entity, and fully bound by the Australian Privacy Principles (APPs), if your business's annual turnover exceeded $3 million in the previous financial year. A business with turnover of $3 million or less is a "small business" and is generally exempt under s 6D of the Privacy Act 1988 (Cth), unless an exception applies.
• Unfair contract terms: The regime covers standard-form contracts with consumers and with "small businesses". Since the November 2023 reforms, a contract is a small business contract if at least one party employs fewer than 100 people or had an annual turnover under $10 million in its last income year. The old upfront-price caps of $300,000 and $1 million were removed, so almost any SaaS standard-form agreement with an SME customer is now in scope.
• Consumer guarantees: The ACL guarantees apply to services supplied to a "consumer", which the ACL defines by reference to price and purpose. Broadly, a customer is a consumer if the price of the services is $100,000 or less, or the services are of a kind ordinarily acquired for personal, domestic or household use. Most consumer-facing and lower-value business SaaS is captured; large enterprise contracts fall outside the guarantees.

Privacy exceptions that catch small SaaS businesses

Even below the $3 million threshold, s 6D(4) of the Privacy Act 1988 (Cth) lists activities that remove the exemption entirely. The ones most likely to catch a SaaS provider are providing a health service while holding health information, disclosing personal information for a benefit, service or advantage, and acting as a contracted service provider for a Commonwealth contract. Credit reporting bodies are also always covered.

There is also a change that has been quietly bringing small businesses into the Act. From 1 July 2026, small businesses that are reporting entities, or authorised agents of reporting entities, under the anti-money laundering and counter-terrorism financing regime are treated as organisations under the Privacy Act 1988 (Cth) regardless of turnover, under s 6E(1A). Businesses in sectors such as finance, lending, digital currency and certain professional services should check whether they are caught.

Further reform is in the pipeline. The government intends to remove the small business exemption entirely in a later tranche of privacy law reform, although no commencement date has been confirmed. In practice, many exempt SaaS businesses already comply anyway, because enterprise and government customers require contractual privacy protections regardless of the statutory position.

Privacy obligations under the Australian Privacy Principles

If you are an APP entity, the APPs set out what you must do with personal information. The principles that do the most work for a SaaS business are transparency (a clearly available privacy policy explaining what you collect and why), collection and use limits (only collect what you need for a lawful purpose), security obligations (reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure), and the right of individuals to access and correct their information.

Two principles deserve particular attention for cloud software, because your architecture is built around them.

APP 8 and overseas data flows

Most SaaS platforms use overseas infrastructure at some point: a hosting region, a payment processor, a support tool, or a sub-processor that runs analytics. Under APP 8, before you disclose personal information to an overseas recipient you must take reasonable steps to ensure the recipient does not breach the APPs, and you must tell individuals that their information may be disclosed overseas.

The practical consequence is that "our data is hosted in Australia" and "we use AWS in Sydney" are materially different statements for privacy purposes. Map where customer data actually flows, including through subcontractors, and make sure your privacy policy and your data processing agreement with customers tell the same story. Your agreements with sub-processors should flow down the same protections so that you are not left accountable for a breach that happens further down the chain.

The notifiable data breaches scheme

The NDB scheme in Part IIIC of the Privacy Act 1988 (Cth) applies if there is unauthorised access to, or unauthorised disclosure or loss of, personal information that a reasonable person would conclude is likely to result in serious harm to affected individuals.

If you become aware that there are reasonable grounds to suspect an eligible data breach, you must carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days. If the assessment confirms an eligible data breach, you must prepare a statement and give it to the Office of the Australian Information Commissioner (the OAIC), and notify affected individuals, as soon as practicable. The statement must describe the breach, the kinds of information concerned and the steps individuals should take in response.

For a SaaS business this is not an abstract compliance point. A compromised admin credential or a misconfigured database that exposes customer data is precisely the scenario the scheme targets, and your incident response plan should assume notification is the default outcome.

Consumer guarantees for your SaaS service

The ACL implies guarantees into the supply of services to consumers, and they operate automatically regardless of what your contract says. For a SaaS service, the guarantees that matter are that the service will be rendered with due care and skill, that it will be reasonably fit for any purpose you said it would achieve, and that it will be supplied within a reasonable time where no time is fixed in the contract.

You cannot exclude these guarantees. A clause that purports to do so is void. For services acquired for business purposes, however, the law allows a supplier to limit its liability for a failure to meet a guarantee to supplying the services again or paying the cost of having them supplied again. That is how many SaaS suppliers structure their liability caps: a cap tied to fees paid over a defined period, with liability for guarantee failures limited to re-supply of the service.

The service descriptions on your website, the support levels in your plan tiers and your refund policy all need to be consistent with what the guarantees require. If you promise "99.9% uptime" in marketing and then disclaim all liability for outages in the fine print, the disclaimer will not protect you and the marketing claim may create an expectation the service then fails to meet.

Unfair contract terms in your standard-form agreement

If you use a standard-form contract, and almost every SaaS business does, the unfair contract terms regime in Part 2-3 of the ACL applies to your terms with consumers and small businesses. A contract is presumed to be a standard form contract, and it is up to the business that prepared it to prove otherwise, so a "take it or leave it" sign-up flow puts you squarely within the regime.

A term is unfair if it would cause a significant imbalance in the parties' rights and obligations, it is not reasonably necessary to protect your legitimate interests, and it would cause detriment to the other party if applied or relied on. In deciding whether a term is unfair, a court must consider how transparent the term is and the contract as a whole. A term hidden in the fine print, written in dense legal language, or presented in a way a customer cannot readily understand is far more likely to be struck down.

For SaaS agreements, the terms that commonly attract scrutiny are unilateral variation clauses that let you change the product, price or contract at will without notice, broad indemnities in your favour, automatic renewal with no meaningful notice or easy exit, and suspension or termination rights that operate without cause or warning. Since 9 November 2023, these terms are not just void if unfair. Proposing or relying on an unfair term is itself a contravention of the ACL, and each unfair term is a separate contravention.

Financial products and services are regulated separately: the unfair contract terms protections in the ASIC Act apply to standard-form contracts for financial products and services, and are enforced by ASIC rather than the ACCC.

Marketing claims and misleading or deceptive conduct

Section 18 of the ACL prohibits conduct in trade or commerce that is misleading or deceptive, or likely to mislead or deceive. For a SaaS business, the risk areas are exaggerated uptime or performance claims without qualification, describing features or security certifications the product does not actually have, and pricing that is not upfront about automatic renewals, tier limits or early termination fees.

The same claim that creates a consumer guarantee expectation can also be a misleading-conduct problem. If you advertise a capability in your onboarding deck or on your pricing page, your customers can reasonably expect the service to deliver it. Claims about uptime, data residency and security should be qualified, accurate and matched to what the product actually does.

Penalties and consequences of non-compliance

The consequences of getting this wrong are no longer limited to having a term struck out. Since the November 2023 reforms, the ACL penalty framework applies to unfair contract terms. For a body corporate, the maximum penalty for each contravention is the greater of $100 million, three times the value of the benefit obtained from the contravention, or 30% of the company's adjusted turnover. For an individual, the maximum is $2.5 million per contravention. The same penalty scale applies to contraventions of the misleading or deceptive conduct provisions.

Under the Privacy Act 1988 (Cth), the OAIC can seek civil penalties for interferences with privacy, up to 2,000 penalty units for an ordinary interference with privacy and significantly more for serious or repeated interferences. Failing to comply with the notifiable data breaches obligations can also attract penalties, and the OAIC has expanded investigative and enforcement powers. Beyond penalties, a data breach notification is a reputational event that enterprise customers and their procurement teams will scrutinise in every subsequent tender.

There are also practical commercial consequences. A void unfair term can take away the very clause you were relying on to suspend a customer, limit your liability or increase your price, and regulators such as the ACCC have made unfair contract terms an enforcement priority.

A compliance checklist for your SaaS business

Work through the checklist below to confirm each obligation is covered:

• Privacy status: Confirm whether you are an APP entity, including whether any exception or the AML reporting-entity change captures you despite turnover under $3 million.
• Privacy policy: Keep it accurate, current and consistent with your product, your data flows and your marketing claims.
• Data flow map: Identify every overseas disclosure, including via sub-processors, and check your position under APP 8.
• Agreements: Make sure your SaaS terms cover the service scope, SLAs and support levels, data ownership and portability, fees and renewals, suspension and termination, and liability.
• DPA: Have a data processing agreement with customers and vendors that aligns with your terms and covers security, breach notification and cross-border transfers.
• UCT audit: Review your standard-form terms for clauses that unilaterally vary key terms, impose broad indemnities or restrict exit, and consider whether each term is transparent and reasonably necessary.
• Breach readiness: Have an incident response plan that assumes a 30-day NDB assessment clock starts the moment you suspect a breach.
• Marketing review: Check uptime, feature, security and pricing claims against what the product actually delivers, and state renewal and cancellation terms clearly.
• Records: Keep invoices and records that meet ATO requirements, including GST treatment of subscriptions.

When a lawyer should review your setup

A commercial lawyer can do three things that materially reduce risk for a SaaS business. First, they can give scoping advice on whether the Privacy Act 1988 (Cth) applies to you, including the exceptions and the recent changes that capture small businesses. Second, they can draft or audit your customer terms, privacy policy and data processing agreement as a coordinated set, so the documents do not contradict each other on data, liability and SLAs. Third, they can run a targeted unfair contract terms review of your standard-form agreement, identifying the clauses most exposed under the current law and restructuring them while preserving the protections you actually need.

This is not a once-only exercise. Every time you add a product tier, change your pricing model, introduce a new sub-processor or expand into a new market, the assumptions in your documents shift. A short review at each milestone is cheaper than defending an ACCC investigation or a customer dispute built on a term you assumed was enforceable.

The threshold most SaaS founders miss

Founders routinely assume that because their startup is small, consumer and privacy law barely touches them. The assumption fails on both fronts. The unfair contract terms regime now reaches standard-form contracts with businesses of up to 100 employees or $10 million in turnover, with no price cap, and since November 2023 an unfair term can cost you a penalty as well as the term itself. On the privacy side, the small business exemption is narrower than it looks, and the anti-money laundering changes brought a wave of small reporting entities under the Privacy Act 1988 (Cth) from 1 July 2026, with full removal of the exemption expected in a later tranche of reform.

The first action to take this week is to answer two questions: are you an APP entity under the current law, and does your standard-form agreement contain terms you could not justify as reasonably necessary if a regulator read them? If you cannot answer both with confidence, that is the point where a lawyer's review is worth the cost.