Startup legal obligations and what to plan for before you launch

Most startup founders draft their business plan around strategy: the product, the market, the financials. The legal side gets treated as a problem for later. That is the wrong order. In Australia the moment you start trading you switch on a bundle of legal obligations, and some apply from your very first sale. Others wait until you cross a turnover threshold, enter a regulated industry, or take on your first employee. The practical approach is to map those obligations while the plan is still a document you can edit, so you know what each launch step will cost and what happens if you miss it.

This guide sets out the obligations that matter to an Australian startup, the triggers that switch each one on, and the verified consequences of missing them. It covers structure and registration, tax and superannuation, industry licences, consumer law, privacy, employment and intellectual property, and finishes with a checklist you can drop into your plan.

Which legal obligations apply to your startup

No single law covers every startup. Three things decide what you owe: how you structure the business, what you do, and how large you get. The table below is a self-assessment tool: find the trigger that describes your situation, and the obligation it switches on.

Two thresholds do most of the work for a typical online startup: $75,000 for GST and $3 million for privacy. Neither excuses the obligations that apply from day one, which are registration, consumer law and industry licensing. Work through the table against your actual model before you draft the rest of the plan.

Choose a structure and register the basics

The first obligation is deciding who the business legally is. The three common structures are sole trader, partnership and company, and each changes what you owe:

• Sole trader: You trade in your own name, need an ABN, and you and the business are legally the same person. Profits are your income and business debts are your debts.
• Partnership: Two or more people share control and profits. Each partner is personally liable for the partnership's debts, so a written partnership agreement covering contributions, decision-making, profit splits and exit is well worth having.
• Company (Pty Ltd): A separate legal entity. The company owns the assets and owes the debts, which limits your personal exposure, and it is the structure investors expect to invest in. In return you take on directors' duties and reporting obligations.

If you incorporate, you must register the company with ASIC. The standard registration fee for a proprietary company was $611 from 1 July 2025, and ASIC indexes its fees annually, so budget for a few hundred dollars plus your constitution and any professional help. Once registered, directors owe statutory duties including the duty of care and diligence in s 180 of the Corporations Act 2001 (Cth), and the company must keep written financial records that correctly record its transactions and retain them for seven years under s 286 of the Corporations Act 2001 (Cth).

If you trade under a name other than your own name or your company's registered name, that name must be registered as a business name with ASIC. It is an offence to carry on a business under an unregistered business name, so check availability early, including the domain and social handles you plan to use. A company with co-founders should also put its constitution and a shareholders agreement in place before shares are issued, so decision rights, vesting and exit are agreed in writing rather than assumed.

Register for the taxes that apply to you

Tax registration is the obligation founders most often postpone, and it is the one the ATO enforces automatically:

• GST: You must register for GST once your GST turnover reaches $75,000 in a 12-month period, or $150,000 for non-profits, and registration must happen within 21 days of becoming required, per the ATO. Once registered you add 10% GST to most sales, claim credits for GST on your purchases, and lodge activity statements. If your forecast in the plan puts you near the threshold, plan for registration in the launch timeline rather than waiting to be caught.
• PAYG withholding: If you pay employees, you must withhold tax from their wages and remit it to the ATO. This applies from the first pay run, not after some probation period.
• Superannuation guarantee: For every eligible employee you must pay superannuation of at least 12% of ordinary time earnings, a rate that has applied since 1 July 2025 according to the ATO. Payments are due quarterly by 28 January, 28 April, 28 July and 28 October. From 1 July 2026 the Payday Super reforms require super to be paid on each payday rather than quarterly, so build that into your payroll planning now.
• Record-keeping: Companies are legally required to keep financial records for seven years, and the same discipline protects every structure: track revenue and expenses from day one, use a separate business bank account, and keep receipts. If you cannot reconstruct your income and expenses, you cannot lodge accurate returns.

Get the licences your industry requires

Industry-specific obligations depend on what you sell. Health services, financial services, alcohol, childcare, building and construction, food handling and several other sectors require licences or registration before you can lawfully trade. Local council approvals can also apply to premises and signage.

These obligations are easy to identify but easy to underestimate for time. A liquor licence or a financial services licence can take months to obtain and may impose conditions on how you operate, so put applications in the plan's timeline with their lead times. Confirm what is required before you start trading, because trading without a required licence exposes you to fines and can force you to stop mid-launch. Where a profession requires it, professional indemnity insurance, and public liability insurance generally, is a cost to budget alongside the licences.

Sell within the Australian Consumer Law

The Australian Consumer Law (the ACL), which is Schedule 2 of the Competition and Consumer Act 2010 (Cth), applies to any business supplying goods or services in trade or commerce. There is no small business exemption and no turnover threshold, so it binds you from the first sale.

The core duties are the consumer guarantees. Goods must be of acceptable quality, which s 54 of the ACL defines as fit for their common purpose, free from defects, safe and durable, judged by what a reasonable consumer would accept given the price and any claims you made. Services must be supplied with due care and skill. When a guarantee fails, consumers can seek a repair, replacement or refund, and you cannot contract out of these rights. A "no refunds" sign or a clause in your terms that excludes the guarantees is ineffective and can itself breach the ACL.

Two further duties deserve a line in your plan. First, unfair contract terms: standard form consumer and small business contracts must not contain terms that are unfair, and since November 2022 such terms can attract penalties as well as being declared void. Second, advertising: what you say on your website, in ads and on labels must not be false or misleading, including claims about what a product does or who made it. If your plan promises a product feature, make sure the marketing language can support it.

The penalties are serious. For the major contraventions, such as misleading representations, unconscionable conduct and unfair contract terms, s 224 of the ACL caps the penalty for a body corporate at the greater of $100 million, three times the benefit obtained, or 30% of adjusted turnover, with individuals capped at $2.5 million. The ACCC enforces these provisions, and it regularly does so against businesses that assumed consumer law would not reach them.

Get privacy right before you collect data

The Privacy Act 1988 (Cth) regulates how businesses handle personal information, and it is where the small business exemption misleads the most founders. Under s 6D of the Privacy Act 1988 (Cth), a business with annual turnover of $3 million or less is generally a "small business" and is exempt from most of the Act. But the exemption has important exceptions. Businesses that provide health services, businesses that trade in personal information such as selling or disclosing it for a benefit, and related bodies corporate of larger organisations are caught regardless of turnover. A health-focused startup or a startup whose model involves sharing customer data can owe full privacy obligations on day one.

When the Act applies, your obligations include having an APP privacy policy, collecting only what you need and telling people why, keeping information secure, and notifying affected individuals and the Office of the Australian Information Commissioner when a data breach is likely to cause serious harm. Even where the exemption applies, a clear privacy policy is the standard your customers, app stores and enterprise buyers will expect, so budget for one either way.

A serious interference with privacy is a civil penalty provision under s 13G of the Privacy Act 1988 (Cth), with a maximum penalty for a body corporate of the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover, and $2.5 million for individuals.

Employment obligations when you hire

Hiring turns on a new layer of obligations. You must pay at least the award rate that applies to each employee's role, comply with the National Employment Standards under the Fair Work Act 2009 (Cth), and give every new employee a Fair Work Information Statement. An employment contract should set out duties, hours, pay, leave, confidentiality and what happens on termination, and it should assign to the business any intellectual property the employee creates in the role.

Superannuation at the 12% rate applies from the first dollar of ordinary time earnings for eligible employees, with the quarterly due dates noted above. Two mistakes recur. The first is misclassifying employees as contractors, which can leave you liable for unpaid entitlements, super and tax. The second is assuming a probation period or a handshake deal removes the paperwork. The Fair Work Ombudsman investigates underpayment claims across all business sizes, and the cost of an underpayment claim usually far exceeds the cost of a properly drafted contract.

Protect the intellectual property your plan depends on

Your plan will name a brand, a product and content that the business needs to own. Three obligations follow. First, check and register the brand: a trade mark application with IP Australia protects your name and logo nationally, but registration takes months, so the search and filing should sit early in the launch timeline, not after the brand is in the market. Second, secure ownership: copyright in code, designs and content belongs to the creator by default, so contractor agreements must assign IP to your business in writing, and employment contracts should do the same. Third, avoid infringing others: a clearance check that your name, product and marketing do not step on someone else's trade mark or copyright is cheaper than a rebrand or a dispute.

What non-compliance costs

The obligations above each carry their own enforcement regime, and the penalties apply to businesses of any size.

Beyond the dollar figures, non-compliance costs credibility with the investors, lenders and customers your plan is written to convince. A due diligence review that finds unregistered names, missing assignments or a bare privacy policy can delay or kill a funding round.

A compliance checklist for your plan

Work this list into the plan's launch timeline, with an owner and a date for each item:

• [ ] Choose the structure and confirm it against liability, funding and exit goals
• [ ] Register the ABN, business name and company, and check name availability for domain and handles
• [ ] Decide the GST position against the forecast turnover, and diarise the 21-day registration rule
• [ ] Identify required licences and permits and apply with lead times in the timeline
• [ ] Draft customer terms that comply with the ACL and do not exclude the consumer guarantees
• [ ] Prepare a privacy policy and collection notices, and test whether the small business exemption actually applies
• [ ] Have employment and contractor agreements ready before the first hire or engagement
• [ ] File trade mark applications and confirm IP assignments from contractors and employees
• [ ] Set up a separate business bank account and bookkeeping from day one
• [ ] Budget for public liability and, where relevant, professional indemnity insurance

When a lawyer should review your plan

The obligations in this guide are capable of being mapped yourself, but several steps involve judgement calls that a lawyer is better placed to make. Choosing a structure is one: the trade-off between personal liability, cost, tax and investor appeal depends on your specific risk profile and funding plans, and the decision is hard to reverse cheaply. The documents are another: customer terms, employment and contractor agreements, IP assignments and a shareholders agreement all need to be drafted to your model, and the exceptions to the privacy exemption need to be tested against what your business actually does with data.

A commercial lawyer at Artificer Legal can review your plan against the obligations that apply to your model, draft the tailored documents rather than templates, and sequence the work so you are compliant before the first order rather than after the first problem. That review is also the moment to stress-test the thresholds in this article against your real numbers, because the figures change and the plan should be built on advice current to your launch date.

The exemption that is narrower than it looks

The most expensive error a founder makes is assuming a small startup is exempt from most of the law. The privacy small business exemption in s 6D of the Privacy Act 1988 (Cth) looks like a clean $3 million line, but it does not protect health service providers, businesses that trade in personal information, or related bodies of larger groups, and the Australian Consumer Law applies to every business that makes a sale regardless of size. Before you take the first order this week, fill in the trigger table at the top of this article against your actual model, and diarise the GST and superannuation dates. That one page of assessment will tell you which obligations are already live, which are waiting on a threshold, and what belongs in the launch timeline of your plan.