Enrolled with AUSTRAC? The Privacy Act now applies to you.

What actually triggers coverage. It is not your turnover, and it is not enrolment on its own. Coverage is triggered by being a reporting entity providing designated services, and it applies to the personal information you handle in connection with your AML/CTF obligations. Your AUSTRAC enrolment is simply the marker that you hold that status.

This is worth being precise about, because it cuts the other way too: if you are providing designated services but have not enrolled yet, the Privacy Act still applies to you. Enrolment is not what switches it on.

Nothing in the Privacy Act changed — the trigger was already there. Section 6E(1A) of the Privacy Act was written in 2006, alongside the original AML/CTF regime. It says that a small business operator that is a reporting entity is treated as an organisation — and so must comply with the Australian Privacy Principles — for the activities it carries on "for the purposes of, or in connection with" the AML/CTF Act and Rules. What changed in 2024 was the list of designated services. Expanding that list expanded who counts as a reporting entity, and s 6E(1A) did the rest automatically.

How much of your business is covered. Only the personal information you handle in connection with your AML/CTF obligations — the OAIC is clear that small businesses are not covered for their other business activities, and that an otherwise-exempt firm's privacy policy need only cover its AML/CTF data handling.

In practice the footprint is wider than that sounds, because the test follows the data rather than the department. Where you collect personal information for an AML/CTF purpose as well as another purpose — client details and transaction records gathered both to deliver your service and to meet your CDD obligations — the OAIC's guidance says the Privacy Act applies to that information. For most professional firms a great deal of client data is dual-purpose, which is why we recommend applying the APPs across the business as the simplest defensible position. That is our recommendation, not a claim that the whole of your business is automatically covered.

Authorised agents are covered too. If you carry out identity verification on behalf of a reporting entity — an outsourced KYC provider, a settlement agent, a paralegal service running client identity checks — you are covered in your own right, regardless of your turnover. The OAIC states that where a reporting entity provides a designated service through an agent, both the entity and the agent have Privacy Act responsibilities. We've written a full guide for authorised agents.

Read that carefully — it is not a ban on holding ID copies. It is the removal of a requirement to keep them, plus a duty to destroy them once they are genuinely no longer needed for an AML/CTF purpose or any other purpose you are permitted to hold them for. And the OAIC has explicitly said it expects this to take time: "reasonable steps" are judged against your size, resources and complexity, and against the scale of the task of changing your systems.

Copies you made before 31 March 2026 must be kept, not deleted. The OAIC's guidance is direct on this: those copies are records for the purposes of the AML/CTF Act and must be kept for 7 years following the end of the business relationship, or 7 years after the last occasional transaction. Do not run a clean-out across your historical files.

What to keep instead. For new verifications, the OAIC sets out what a compliant record looks like: the personal information taken from the document — name, date of birth, residential address, date of expiry, passport or licence number — plus the type of document, what you did to identify the customer, and the outcome of your verification and ML/TF risk assessment.

That is close to a specification, and it is exactly what CompliDesk stores. Structured, access-controlled verification records and audit trails give you the evidence AUSTRAC expects without accumulating document scans in inboxes and shared drives.