Privacy laws – Australia reforms are coming
What Allied Health & wellness businesses need to know (and do)
If you run a small business in the Allied Health or wellness space — whether you’re a naturopath, physio, psychologist, coach, bodyworker, or energy healer — there are big changes to Australia’s privacy laws that you need to know about. And before your eyes glaze over: no, this isn’t just about giant tech companies or complex IT systems. These reforms directly affect how you collect client details, store session notes, send marketing emails, and even manage your team.
Let’s break it all down so you can understand what’s already law, what’s coming soon, and what you actually need to do about it.
Why are these Privacy Laws changing?
The Australian Government is updating the Privacy Act 1988 to better reflect how modern businesses handle personal information — especially sensitive data like health records. These changes are also designed to bring our privacy standards in line with global laws like the EU’s GDPR (remember the panic when that was brought in a few years ago?) I will try to make this a little less scary for you.
The intention behind these changes is not to make your life more difficult! It’s a protective move designed to give individuals more control over their data and to increase accountability for businesses. The problem? Many of the new rules apply equally to large corporations and tiny one-person practices, without much recognition of the realities of small business life.
So let’s look at what’s already changed — and what’s still on the horizon.
What’s already in effect (as of December 2024)
1. Stronger powers for the privacy watchdog
The Office of the Australian Information Commissioner (OAIC) can now:
- Investigate businesses without waiting for a complaint
- Impose much heavier penalties (up to $50 million for serious breaches)
- Demand that you provide evidence of compliance (for example, showing that you have a Privacy Policy that reflects the data you collect and what you do with it, not a generic template that has no relevance to your actual practices.)
2. Doxxing is now a criminal offence
If someone shares personal details (like an address or phone number) online with the intention of causing harm, they could face up to 7 years in prison. This doesn’t change your obligations as a business, but it highlights how seriously personal information is now being treated.
What’s coming soon (and what you need to be ready for)
1. The right to sue over privacy breaches
Starts: By 10 June 2025
Clients will soon be able to sue your business for serious invasions of privacy — even if they can’t show financial loss. That means something as simple as a poorly handled mailing list or shared email address could expose you to legal action.
Worse, it opens the door to class actions. If a group of clients all had their data exposed in a breach, a law firm could bundle their claims and sue you together.
2. Transparency about AI & automation
Starts: December 2026
If you use any kind of automation to make decisions — think chatbots, appointment schedulers, or software that triages client queries — you’ll need to disclose it clearly in your Privacy Policy.
3. The possible end of the small business exemption
Proposed: likely in 2025
Right now, businesses under $3 million in turnover are largely exempt from complying with the Privacy Act unless their services relate to people’s health and wellbeing. That’s set to change. If the exemption is removed (and it’s looking likely), all businesses will have to follow the same privacy rules — regardless of size or industry.
What it means for you
Here’s what the changes add up to for small allied health businesses:
- You’ll be legally responsible for how you collect, store, use, and share any personal data — even if you’re just a solo practitioner with a Gmail address and a Wix site.
- You can be sued for privacy breaches, even if no one lost money — it’s the invasion of privacy that counts.
- You’ll have to stop hoarding client data “just in case” and be able to explain exactly why you’re keeping what, where, and for how long.
- You need proper consent — vague opt-ins or pre-ticked boxes won’t cut it.
Eeek! I know, that sounds terrifying, but don’t worry — I’ve got some practical tips you can implement easily that will help protect you.
The five biggest privacy pitfalls (and how to avoid them)
The five biggest privacy pitfalls (and how to avoid them)1. Collecting more than you need
Don’t ask for info just because a form builder lets you. If you’re not using a client’s date of birth for any real reason, don’t collect it.
→ Tip: Audit your forms, questionnaires, and client intake processes.
2. Dodgy consent practices
You must get freely given, specific, informed consent — and it must be easy to withdraw. If someone subscribes to your newsletter, you can’t assume they want SMS reminders too.
→ Tip: Check your email marketing platform is set up for explicit opt-ins.
3. Poor data retention habits
Check with your professional association to see if they have specific retention requirements, but general best practice for health practitioners has long been to retain treatment notes for 7 years after the last appointment, or 7 years after a minor turns 21 — whichever is longer.
You can keep information for longer, but make a note in the file explaining your reasoning. For example: “Client disclosed complex trauma history and has indicated a likelihood of returning for future treatment; notes retained for clinical continuity.” This kind of documentation shows you’ve thought it through and aren’t just defaulting to hoarding everything forever.
→ Tip: Set calendar reminders to clean out inactive client records every 12 months.
4. Weak data security
If you’re storing health records in unsecured cloud systems, sending sensitive info over email, or not using multi-factor authentication, you’re asking for trouble.
→ Tip: Enable encryption wherever possible and use secure client portals, especially for sensitive information.
5. Overlooking staff data
Even if you’re under the $3M threshold now, employee data already falls under different workplace laws. That means your payroll files, leave forms, and even internal notes must be handled with care.
→ Tip: Treat staff info with the same privacy protocols you use for clients.
What you should do now (practical steps)
If you want to stay ahead of these changes — and avoid fines, lawsuits, or the headache of a regulator poking around in your business — here’s your starting point:
1. Do a privacy audit
- Map out every point where you collect data (forms, bookings, emails).
- List what you collect, why, how it’s stored, and who has access.
- Identify risks (e.g. unsecured systems, unclear policies).
2. Write or update your Privacy Policy
Your policy should:
- Be written in plain English
- Say exactly what data you collect and why
- Outline how clients can access or correct their data
- Include how you handle breaches
→Tip: Make it easy to find — link it in your footer, booking forms, and onboarding emails.
3. Review your Terms & Conditions
These protect your business if things go wrong — not just for privacy, but for refunds, cancellations, disputes, and boundaries.
→Tip: Think of T&Cs as your clinic’s informed consent form, but for the business side. They help everyone understand what’s expected, what’s included, and where the boundaries are.
4. Create a Breach Response Plan
What happens if someone hacks your booking system or your phone is stolen with client notes?
You need a clear, calm process that covers:
- Who to notify (including the OAIC)
- How you’ll communicate with affected clients
- Steps to prevent it happening again
→ Tip: Document it now so you’re not scrambling under pressure later.
5. Train your team (or yourself)
Anyone handling client info — even your outsourced marketing agency, VA or bookkeeper — needs to know the basics:
- What counts as personal data
- How to keep it secure
- What to do if something goes wrong
- Include this in your onboarding and update regularly as laws change.
Why it’s worth the effort?
These reforms might feel overwhelming — especially if you’re juggling work, client care, admin, and, you know… being a human.
But don’t think of it as intrusive demands for compliance. Approach it instead from the perspective of building trust.
Privacy isn’t a bureaucratic box-tick. It’s a powerful signal to your clients that their safety matters to you — not just physically, but digitally and emotionally too.
That’s part of the integrity you already bring to your work. The law is just catching up. And if you’re not sure where to start, don’t panic. Start small, stay curious, and get support from someone who can turn legal complexity into calm, confident clarity.
Want a second set of eyes on your privacy practices or help drafting Policies and Terms & Conditions that actually make sense?
Reach out to our trusted legal contracts expert Michelle Whitehead from Carefree Counsel, the guest blogger responsible for this article. She speaks fluent legal, and promises never to drown you in jargon.
