Privacy basics for small business

Not a legal treatment. The practical version: what changes when a chat window enters a business that holds information about other people.

By Nauman Hashmi

Reviewed October 2026. This page names fast-moving vendor detail, so it carries a review date.

The shape of the obligation

If you hold personal information about people — patients, clients, participants, tenants, employees — you have obligations about how it's collected, used, disclosed and secured. The Australian Privacy Principles under the Privacy Act are the framework, and health service providers are covered regardless of turnover.

Pasting a client's record into a third-party tool is potentially a disclosure and potentially an offshore one. That's the whole issue in a sentence, and it's why the tier question matters more than the tool question.

Where this page stops

This is orientation, not advice. Thresholds, exemptions and notifiable breach duties turn on specifics, and health, NDIS and legal practice each carry obligations on top of the Privacy Act. Get your own advice before relying on any of it.

The four decisions that do the work

One approved tool and tier, funded by the business. Everything else depends on this.
A written never list. Specific categories, not “be careful”.
A de-identification habit. Roles instead of names, ranges instead of dates, practised until automatic.
A record of the decision. Dated, so you can show what you decided and when the tools changed.

The indirect identification trap

Removing a name isn't always de-identification. “The 34-year-old woman with the rare condition at the Wagga clinic” identifies someone to anybody who knows the practice. Small communities and unusual circumstances collapse anonymity quickly, and this is the part people get wrong in good faith.

Your existing software counts too

Practice management systems, transcription services and CRMs are all adding AI features, often on by default. The same questions apply — questions to ask any AI vendor. Meeting transcription is the most common example, covered in AI note-takers in client meetings, and from 10 December 2026 some automated features also need describing in your privacy policy: what changes on 10 December.

Where to read the source

The Office of the Australian Information Commissioner publishes the APP guidelines and guidance for small business. Read the primary source rather than a summary of it, including this one.

Obligation, habit, and the difference

Most small-business privacy worry is a mix of two things: an actual obligation — to a client, a patient, a participant, a professional body — and a habit of treating everything in the business as equally sensitive. Separating them is most of the work.

The practical test: if this document leaked, who would be harmed and how? A tender response leaking is a commercial problem. A participant's plan leaking is a different category entirely. Treating both the same way means either over-protecting the tender or under-protecting the plan, and in practice it's usually both.

De-identifying properly

Deleting a name is not de-identification. In a small community, a role plus a suburb plus a date identifies someone as surely as a name does — which matters in regional clinics and disability services more than anywhere.

Remove the combination, not just the name: role, location, date, rare condition, unusual circumstance.
Replace rather than blank, so the document still reads and the output still makes sense.
Decide once, as a business, which document types can be de-identified at all — some can't be, and that's a legitimate answer.

Where the information can't be safely de-identified, the work stays with the qualified person. That line is the subject of the never list, and in clinical settings this content should be reviewed by someone qualified in your field — we say that plainly rather than implying our version is enough.

If you handle patient or participant information, the privacy work comes before any training. That's the engagement to ask about.

Start an enquiry

Tell us what the business does. If we're the wrong fit we'll say so, and usually we can point you somewhere better.