What types of Australian businesses are subject to the GDPR?

The European Union's General Data Protection Regulation (the GDPR) has applied since 25 May 2018, and it is not confined to European companies. It reaches Australian businesses that have an office or staff in the EU, sell to customers there, or track the online behaviour of people in the EU. Because the regulation is extraterritorial, an entirely Australian-owned and operated business can be caught by it without ever setting foot in Europe.

This article sets out which Australian businesses are in scope, the main duties that come with being in scope, and what the regulators can do if you get it wrong. The short version is that your business size does not decide the question, but the nature of what you do with people's data does.

The GDPR applies to the processing of personal data, and "processing" is defined broadly. It covers collecting, storing, using, disclosing, combining, deleting and almost every other operation you can perform on data, whether it is held electronically or in a structured paper file.

There are two routes into the regulation, and they work independently:

Establishment in the EU: If your business has an establishment in the EU, the GDPR applies to any personal data processing carried out "in the context of the activities" of that establishment, regardless of whether the data is actually processed in the EU. An establishment does not have to be a subsidiary with full legal personality. A branch office, a warehouse, a sales team or another "stable arrangement" through which your business actually carries on activity in the EU can be enough.
No establishment, but EU data subjects involved: Under article 3 of the GDPR, the regulation also applies to a controller or processor outside the EU where the processing relates to either of the following:
- offering goods or services to people in the EU, whether or not they pay for them, or
- monitoring the behaviour of people in the EU, where that behaviour takes place in the EU.

The Office of the Australian Information Commissioner (OAIC) gives practical examples of Australian businesses that may be covered. They include a business whose website lets EU customers order in a European language other than English or pay in euros, a website that mentions customers or users in the EU, and a business that tracks individuals in the EU online and profiles them to predict preferences, behaviours and attitudes.

You can use these indicators to self-assess:

Targeted website: your site is available in a European language, prices in euros, or accepts EU delivery addresses.
EU marketing: you run advertising or email campaigns aimed at people in EU member states.
EU customers: you supply goods or services to individuals located in the EU, even free services such as apps.
EU visitors and monitoring: your site uses analytics, cookies or tracking pixels that record the behaviour of visitors from the EU.
EU establishment: you have an office, branch, warehouse, employees or other stable presence in an EU member state.

One point worth stating plainly: there is no size threshold for the GDPR itself. The OAIC confirms that Australian businesses of any size may need to comply. This is a deliberate difference from Australia's own Privacy Act 1988 (Cth), which generally applies to private sector and not-for-profit organisations with an annual turnover of more than $3 million (alongside health service providers and some other small businesses). A small Australian business below that threshold may have no obligations under Australian privacy law and still be fully caught by the GDPR because it sells to EU customers. If you are uncertain whether your EU-facing activity counts as "offering goods or services" or "monitoring behaviour", a privacy lawyer can help you work through the indicators, because the assessment depends on the specific facts.

The GDPR only protects personal data, which article 4 defines as any information relating to an identified or identifiable natural person, that is, a living individual. It does not protect data about companies or other legal entities. A company registration number or a generic business email address such as info@yourcompany.com.au is not personal data under the GDPR.

There is an important nuance for sole traders. Information about a one-person business can still be personal data where it allows the natural person behind the business to be identified. The European Commission's guidance on the application of the GDPR confirms that the rules do not govern data about companies, but information relating to one-person companies may constitute personal data where it allows the identification of a natural person. So a client database of sole trader customers, which may look like business contact data, is likely to be within scope.

Personal data includes obvious identifiers such as names, home addresses, email addresses and ID numbers, but also location data, IP addresses, cookie IDs and advertising identifiers, plus one or more factors specific to a person's physical, physiological, genetic, mental, economic, cultural or social identity. If you can identify an individual from the data, even by combining it with other information, it is personal data.

Some data attracts extra protection. "Special categories" under article 9 include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, genetic and biometric data used to identify a person, and data about sex life or sexual orientation. Personal data about criminal convictions and offences (article 10) is also treated more strictly. Processing these categories is generally prohibited unless a specific exception applies, and their presence is one of the factors that removes your business from the small-business exemptions discussed below.

Keep records of your processing activities

Controllers and processors must maintain written records of their processing activities, setting out the purposes of the processing, the categories of data subjects and data involved, who the data is disclosed to, any transfers to third countries, retention timeframes and security measures.

There is a genuine small-business carve-out here, and it is the closest thing the GDPR has to a size test. Under article 30, the record-keeping obligation does not apply to an enterprise or organisation employing fewer than 250 people, unless any of the following is true:

the processing is likely to result in a risk to the rights and freedoms of data subjects,
the processing is not occasional, or
the processing includes special categories of data under article 9 or criminal conviction data under article 10.

In practice, this carve-out is narrower than it looks. A business with fewer than 250 employees that continuously processes customer data as a routine part of its operations is likely to be processing on more than an occasional basis, which brings the record-keeping obligation back into force. The exemption mainly protects very small businesses whose data handling is incidental, low risk and infrequent. Whether your processing is "occasional" and whether it creates "a risk to the rights and freedoms of data subjects" are judgment calls, and a privacy lawyer can assess your position against those tests.

Appoint a data protection officer

A data protection officer (DPO) is a person designated to monitor and advise on GDPR compliance. The GDPR only requires one in three situations under article 37:

the processing is carried out by a public authority or body (other than courts acting in a judicial capacity),
your core activities consist of processing operations that require regular and systematic monitoring of data subjects on a large scale, or
your core activities consist of large-scale processing of special category data or criminal conviction data.

The key phrases are "core activities", "regular and systematic monitoring" and "large scale". A business whose main line of work is data processing, such as a data analytics firm that continuously tracks and profiles individuals across the EU, is the clearest example. A retail business that handles employee and customer data as a supporting function usually does not need a DPO. The DPO can be a staff member or an external contractor, provided they have expert knowledge of data protection law and practice.

Nominate a representative in the EU

If your business is caught by the GDPR but has no establishment in the EU, you will generally have to appoint a representative established in an EU member state under article 27. The representative is the point of contact for EU supervisory authorities and for individuals on all questions related to your data processing. There are exceptions for occasional, low-risk processing, but in most cases where an Australian business is squarely in scope, a representative will be required.

Penalties for getting it wrong

Enforcement sits with the data protection authority of each EU member state. Those authorities can investigate, order you to stop processing, order you to erase data, and impose administrative fines.

The fine structure under article 83 has two tiers:

Up to €10 million, or 2% of your total worldwide annual turnover for the preceding financial year, whichever is higher, for breaches of obligations such as record-keeping, security of processing, data protection impact assessments and DPO requirements.
Up to €20 million, or 4% of your total worldwide annual turnover, whichever is higher, for the most serious breaches, including the basic principles of lawful processing, data subjects' rights, and transfers of personal data out of the EU.

Because the fines are calculated on worldwide turnover, they can be substantial even for a mid-sized Australian business. The turnover figures are not capped at the EU revenue of your business, which is part of why the GDPR is taken seriously by Australian exporters and technology companies.

A compliance checklist for Australian businesses

If you think the GDPR may apply to you, these are the practical steps to work through:

Confirm scope first: Map where you have an EU establishment, EU customers or monitoring of EU individuals before spending money on compliance.
Document your data flows: Identify what personal data you collect, why, where it is stored, who it is shared with, and whether it is transferred out of the EU.
Check the exemptions: If you employ fewer than 250 people, work out whether your processing is occasional and low risk, or whether the record-keeping obligation applies to you anyway.
Update your privacy notices: GDPR notices must be concise, transparent and explain the lawful basis for each processing purpose.
Test your consent and direct marketing practices: Consent must be freely given, specific, informed and unambiguous, and withdrawal must be as easy as giving it.
Review your contracts: If you engage processors such as cloud providers or marketing agencies, the GDPR requires written contracts that set out the processor's obligations.
Plan for data subject requests: Individuals can ask for access, correction, erasure and portability of their data, and you need a process and a timeframe (generally one month) for responding.
Prepare for breach notification: A personal data breach affecting EU individuals generally has to be notified to the relevant supervisory authority within 72 hours where it risks their rights and freedoms.
Consider a DPO and an EU representative: Work out whether the article 37 triggers apply, and whether article 27 requires you to appoint a representative.

When a privacy lawyer can help

A privacy lawyer's first job is to tell you definitively whether the GDPR applies to your business at all, because the scope tests involve judgments about establishment, targeting and monitoring that are not always obvious. From there, a lawyer can review your data flows and privacy notices against both the GDPR and the Privacy Act 1988 (Cth), draft the processor agreements and consent mechanisms, and set up your record-keeping and breach response processes so that they satisfy both regimes at once. Where your processing is high risk, a lawyer can also guide you through a data protection impact assessment, which the GDPR requires before certain types of processing begin. This is an area where the cost of getting the assessment wrong, in fines and in enforcement action, comfortably exceeds the cost of advice.

The trigger Australian businesses most often miss

For most Australian businesses, the surprise is the second limb of article 3: monitoring behaviour. It is easy to assume the GDPR only reaches businesses that actively sell to Europe, but a website with EU visitors, analytics cookies and retargeting pixels can be monitoring behaviour that takes place in the EU. That is why the first step is not updating your privacy policy, but auditing your actual data practices to see whether you are in scope at all. If you collect any personal data from people in the EU, assume the GDPR is looking at you until a proper assessment of your establishment, targeting and monitoring activities says otherwise.