The enterprise client's procurement form asks who is responsible for privacy at your organisation. Your marketing team has asked to trial a new analytics tool that would start logging every visitor's IP address and device type. A staff member who resigned last week still had an active login to the customer database, and no one is sure who else holds the password. This is the moment where privacy stops being a checkbox on a to-do list and becomes a question of ownership: who, if anyone, is accountable for how your business handles personal information.
What your options actually are
Australian privacy law does not require you to appoint someone with the title of privacy officer. The Privacy Act 1988 (Cth) (the Act) regulates conduct, not job titles. APP 1 of Schedule 1 to the Act requires every entity covered by it to take such steps as are reasonable in the circumstances to implement practices, procedures and systems that ensure compliance with the Australian Privacy Principles (APPs) and that enable people to make inquiries or complaints about that compliance. A privacy officer is one common way to deliver that governance, but the Act never names the role. The titles businesses use, privacy officer, privacy compliance officer or data protection officer, all describe the same function in Australia, and Australian law, unlike the European regime, does not require a designated data protection officer.
That makes the real decision narrower than it first appears. You are choosing between three arrangements:
- A named privacy officer: a formal role, however small, with privacy written into the job description.
- Privacy ownership attached to an existing role: the founder, operations manager or office manager carries it as a defined part of their duties.
- No clear owner: privacy matters are handled as they come up, by whoever happens to notice them.
In a small business the first two arrangements usually collapse into the same outcome, because the officer is almost never a full-time hire. The third option looks like it costs nothing and usually costs the most, because it is the one that fails precisely when a complaint, a regulator inquiry or a breach demands a fast, coordinated response.
Five factors to weigh
Whether the Privacy Act applies to you at all
The Act's main privacy protections apply to most businesses with an annual turnover above $3 million, and to some smaller ones. A business is a small business, and generally outside the Act, if its annual turnover for the previous financial year was $3 million or less (s 6D(1) of the Privacy Act 1988 (Cth)). New businesses are assessed on their current year turnover instead (s 6D(2)).
Even below that threshold, s 6D(4) pulls a small business into the Act if it:
- Provides a health service: providing a health service while holding health information brings you in regardless of size.
- Trades in personal information: disclosing personal information to someone else for a benefit, service or advantage.
- Collects data from third parties: providing a benefit, service or advantage in return for collecting personal information from others.
- Acts as a contracted service provider: under a Commonwealth contract.
- Is a credit reporting body: an organisation that collects and provides credit information and is regulated under Part IIIA of the Act.
There are two traps worth naming. First, the turnover test looks backwards at the previous financial year, so a business can be covered by the Act before its current year income reflects the growth. Second, a body corporate related to a larger company is not a small business operator regardless of its own turnover (s 6D(9)). If your business falls outside the Act today, your status can change as revenue grows or as the business model shifts into one of the categories above.
What kind of information you hold and how sensitive it is
The sensitivity of the data you hold changes what is at stake. The Act treats some information as sensitive information, a category that carries higher stakes than ordinary contact details, and health information is the clearest example. Health information is defined broadly to include information about an individual's health, illness, disability or injury, their expressed wishes about future health services, and genetic information (s 6FA of the Privacy Act 1988 (Cth)). A business that holds health information is not only pulled into the Act regardless of turnover, it holds information that regulators treat as high-stakes.
The penalty structure reflects that. A serious interference with privacy can attract a maximum penalty for a body corporate of $50 million, three times the value of any benefit obtained, or 30% of adjusted turnover, whichever is greatest (s 13G of the Privacy Act 1988 (Cth)). Whether an interference is serious depends on factors such as the kind and sensitivity of the information, the number of people affected, and whether children or vulnerable people are involved (s 13G(1B)). A breach involving health information or other sensitive data is far more likely to be characterised as serious than one involving a mailing list.
Two more data types deserve attention:
- Payment card data: even if you never see a full card number, how payment data flows through your systems is a question someone should own.
- Employee records: if your business is covered by the Act, records held in connection with a current or former employment relationship are generally exempt from the APPs (s 7B(3) of the Privacy Act 1988 (Cth)), but employment contracts, state laws and staff expectations still apply, so the exemption is not a reason to leave employee data unowned.
The pattern is simple: the more sensitive the information, the more damage one mistake can do, and the stronger the case for a named owner.
How many hands touch the data
The number of people and systems with access to personal information is the strongest practical predictor of a breach. Each login, each exported spreadsheet and each shared folder is a place where an accidental disclosure can happen. As a rough self-check, if you cannot answer the question of who can export the customer list within a minute, the informal approach has already outgrown itself.
Ask whether any of these are true:
- Multiple staff hold access: to the same customer data with no role-based limits.
- Contractors and agencies: developers, marketers and support providers process data on your behalf.
- Offshore teams: logging in from overseas raises practical security and cross-border questions.
- Near misses have happened: a misdirected email, a spreadsheet shared with the wrong link, a departing employee's download.
Each of these is a reason to have one person who knows where the data lives, who can see it, and who is authorised to change that.
What customers, clients and investors will ask
Privacy governance is increasingly a commercial question, not just a legal one. Enterprise clients send procurement questionnaires that ask for a named privacy contact before a contract is signed. Investors and acquirers ask about data handling during due diligence. Insurers ask about security and breach response before they will quote. If your business sells to government, to larger organisations or to enterprise customers, expect privacy practices to be part of how you are assessed.
Even a business outside the Act can find the APPs imported into its life:
- Through contracts: enterprise terms often require the supplier to comply with the APPs and the Notifiable Data Breaches scheme as if it were bound.
- Through reputation: customers notice how a business responds to a privacy incident, and that response tends to be judged against the standard set by the Act.
The commercial reality is that "the Act does not apply to us" is rarely the end of the conversation. It answers a legal question, not a customer one.
What a breach would actually cost you
If the Act applies to you, a data breach that is likely to result in serious harm triggers the notification scheme in Part IIIC of the Act. An eligible data breach is an unauthorised access to, unauthorised disclosure of, or loss of, personal information that is likely to result in serious harm to any affected individual (s 26WE of the Privacy Act 1988 (Cth)). You must prepare a statement about the breach and give it to the Office of the Australian Information Commissioner (OAIC) as soon as practicable (s 26WK), and take reasonable steps to notify affected individuals (s 26WL). The Commissioner can also direct you to notify (s 26WR).
Those obligations land on whoever is running the business at the time. Without a pre-assigned owner, the response is improvised: who assembles the facts, who decides whether serious harm is likely, who drafts the statement, who talks to the Commissioner. The early hours of an incident usually decide whether it stays contained.
For a business outside the Act there is no statutory notification duty, but the costs are still real: customers you choose to tell, insurers, contractual claims and reputational damage. The two situations differ in who forces the response, not in whether a response is needed:
- Covered by the Act: an eligible breach means a regulator-facing response with statutory timing, and someone must drive it.
- Outside the Act: no statutory duty, but clients, insurers and customers will still expect a competent, documented response.
In both cases the answer to who owns the response needs to exist before the response is needed.
How an Artificer Legal practitioner helps you make the call
The decision to appoint a privacy officer is only as good as the assumptions underneath it. An Artificer Legal practitioner can test those assumptions before you commit to a structure:
- Coverage first: we work out whether the Act applies to your business, applying the turnover test and the small business categories to your actual operations, and flag the point at which growth will change the answer.
- Data mapping: we trace where personal information enters, moves and is stored, so the ownership decision is based on what your business actually does rather than what its policies say.
- Downside modelling: we work through what a serious interference would look like for your data profile, which data flows carry the highest risk, and what response obligations would land on the business.
- Drafting the documents the chosen path needs: an APP-compliant privacy policy, collection notices, a data breach response plan, internal privacy rules, and supplier or contractor clauses that allocate responsibility for personal information handled on your behalf.
The call stays yours. Our role is to make sure it rests on verified legal ground and that whichever arrangement you choose has the documents and processes to back it up.
The ownership, not the title, is what the law asks for
The detail most businesses miss is that the Privacy Act 1988 (Cth) never asks for a privacy officer. APP 1 asks for practices, procedures and systems that ensure compliance, and for someone who can deal with inquiries and complaints. A named owner, whoever it happens to be, is the most direct way to show those steps are reasonable when a regulator, a client or a court asks. The person matters more than the title, and the documented process matters more than the person. Doing nothing means that if a serious interference ever happens, you will be explaining to the OAIC what steps you took and why they were reasonable, from a standing start.
The decision comes down to five factors: whether the Act covers you, how sensitive the information is, how many people and systems touch it, what clients and investors will ask, and what a breach would cost. Most growing businesses land on the same answer: assign clear ownership, keep the role part-time at first, document the process, and review the arrangement as revenue, headcount and data flows grow. If the Act applies to you, the maximum penalty for a serious interference is $50 million for a body corporate, so the cost of an unowned response is no longer theoretical. A privacy officer is a governance choice rather than a legal requirement, but it is the choice that turns the reasonable steps standard in APP 1 from an abstraction into something you can point to.