CRM Costs, Pricing Models and 2026 Rules
Privacy Act and your CRM: the $3m exemption, its exceptions, APP 7 and the 2024 changes
When the Privacy Act 1988 applies to a small business CRM, the exceptions to the $3m exemption, APP 7 direct marketing, data location, the statutory tort and 2026 automated-decision rules.
A CRM is mostly personal information: names, phone numbers, emails, notes about conversations, sometimes purchase history or health details. The Privacy Act 1988 and its Australian Privacy Principles (APPs) apply to businesses with annual turnover of more than $3 million, and to some smaller businesses regardless of turnover, such as health service providers and businesses that trade in personal information. Even if you are exempt, the statutory tort for serious invasions of privacy (in force since 10 June 2025) is not limited to Privacy Act-covered businesses, and the Spam Act and Do Not Call rules apply to everyone. If you are covered, APP 7 controls direct marketing, APP 8 governs sending data overseas, APP 11 requires reasonable security, and from 10 December 2026 your privacy policy must explain certain automated decisions.
This guide is part of the best-fit CRM overview. It is general information, not legal advice. Check the OAIC's guidance for your situation. For the CRM features that support these duties, see what a CRM does; for overseas billing as distinct from overseas hosting, see USD pricing, FX and GST.
Is your business covered?
The small business exemption generally applies if your annual turnover is $3 million or less. It does not apply, whatever your turnover, if your business is (among others):
| Exception | Why it matters for a CRM |
|---|---|
| A business that provides a health service and holds health information (this can include allied health and some fitness or wellbeing services) | Client records in a CRM are health information |
| Trading in personal information (disclosing it for a benefit, or collecting it from others for a benefit), unless done with consent or authorised by law | Buying or selling lead lists, or sharing contacts with partners for a fee, can bring you into the Act |
| A contracted service provider under a Commonwealth contract | Your contract may also set data-location requirements |
| Related to a larger business that is covered | Group businesses are assessed together |
| A reporting entity under anti-money laundering law | Applies to some financial, gambling and bullion businesses |
| A business that has opted in to coverage | Some businesses opt in to reassure customers or meet contract terms |
The list above is not complete; check the OAIC's small business guidance. Turnover is assessed by financial year, and a new business with no turnover history is assessed differently. If your turnover is approaching $3 million, plan for coverage before you cross it.
What the APPs mean in a CRM
| APP | What it requires | CRM set-up |
|---|---|---|
| APP 1 | Open and transparent management, including a clear privacy policy | Policy describes what the CRM holds and why |
| APP 3 | Collect only what is reasonably necessary; sensitive information generally needs consent | Remove unnecessary fields; flag sensitive notes |
| APP 5 | Tell people what you collect and why at or soon after collection | Notice on web forms and quote requests |
| APP 6 | Use or disclose for the purpose collected, or a permitted secondary purpose | Control exports and sharing with partners |
| APP 7 | Rules for direct marketing (below) | Opt-out and source tracking |
| APP 8 | Accountability for overseas disclosures | Know where data and support access sit |
| APP 10 | Keep information accurate and up to date | De-duplicate and review |
| APP 11 | Reasonable steps to secure it; destroy or de-identify what you no longer need | Multi-factor authentication, permissions, retention rules |
| APP 12–13 | Give access to and correct personal information on request | Ability to find and export one person's data |
APP 7: direct marketing
For covered businesses, APP 7 sets out when personal information can be used for direct marketing:
- If you collected the information from the individual and they would reasonably expect you to use it for marketing, you may do so if you give a simple way to opt out and they have not opted out.
- If you collected it from someone else, or they would not reasonably expect it, you generally need consent (or consent must be impracticable to get), and every marketing communication must include a prominent opt-out statement.
- Sensitive information (for example health information) can be used for direct marketing only with consent.
- Individuals can ask you to stop and ask where you got their information; you must respond within a reasonable period and free of charge.
APP 7 does not apply to the extent the Spam Act 2003 or the Do Not Call Register Act 2006 applies, so email and SMS are mainly governed by the Spam Act and telemarketing by the Do Not Call rules. Post, social media audiences built from your lists and other channels can still fall under APP 7. See the Spam Act and Do Not Call guide.
Data location and sovereignty
Australian privacy law does not generally require private businesses to store personal information in Australia. Under APP 8, before disclosing personal information to an overseas recipient you must generally take reasonable steps to ensure it is handled consistently with the APPs, and you can remain accountable for what the recipient does. Whether a cloud provider hosting your CRM data is a "disclosure" depends on the arrangement; the OAIC's guidance discusses this. In practice, ask each vendor:
- Where are production data and backups hosted? Is an Australian or regional data centre available, and does it cost more?
- From which countries can support staff access your data?
- Who are the sub-processors (email delivery, AI features, analytics), and where are they?
- Will the vendor notify you before changing hosting location?
Some customer contracts, government work and health records may require Australian hosting regardless of the general law.
The 2024 amendments, as at October 2026
| Change | Status | CRM relevance |
|---|---|---|
| Statutory tort for serious invasions of privacy | In force for conduct from 10 June 2025 | Individuals can sue for intentional or reckless serious invasions, including misuse of information; not limited to Privacy Act-covered entities |
| Tiered civil penalties and OAIC infringement notices | In force | Less serious breaches, including some privacy policy failures, can attract penalties |
| Clarified security obligation (APP 11) | In force | Reasonable steps include technical and organisational measures |
| Automated-decision transparency (APP 1.7–1.9) | Applies from 10 December 2026 | Privacy policies must describe the use of personal information in computer programs that make, or substantially help make, decisions that could significantly affect individuals |
Most CRM lead scoring for marketing is unlikely to "significantly affect" someone's rights or interests, but automated decisions about credit terms, account suspension, eligibility or pricing for individuals might. Review your automations before 10 December 2026 and read the OAIC's guidance. Further reforms (a second tranche, possibly including changes to the small business exemption) have been discussed but their timing is uncertain; check the Attorney-General's Department for updates.
Data breaches
Covered businesses must comply with the Notifiable Data Breaches scheme: assess a suspected eligible data breach promptly (generally within 30 days) and notify the OAIC and affected individuals if it is likely to result in serious harm. See the CRM data breach response plan.
Frequently asked questions
We are under $3 million. Can we ignore privacy?
No. You may be exempt from the APPs, but exceptions may apply, the statutory tort applies more broadly, and the Spam Act and Do Not Call rules apply regardless. Good privacy practice also reduces breach risk.
Can we upload our CRM contacts to an advertising platform?
Matching customer lists with an advertising platform is a use or disclosure of personal information. If you are covered, check APP 6, APP 7 and APP 8, your privacy policy and the platform's terms.
Do we need customer consent to use a CRM at all?
Generally not for ordinary customer records used to serve customers, but you need a notice at collection, a privacy policy and lawful use if you are covered.
What penalties apply to serious privacy breaches?
For companies, maximum penalties for serious interferences with privacy are the greatest of $50 million, three times the benefit obtained, or, if the benefit cannot be determined, 30% of adjusted turnover for the relevant period. Lower tiers apply to less serious breaches.
Sources
- Office of the Australian Information Commissioner — APP guidelines, small business exemption, direct marketing, automated decisions, Notifiable Data Breaches
- Federal Register of Legislation — Privacy Act 1988 and the Privacy and Other Legislation Amendment Act 2024
- Attorney-General's Department — privacy reform progress
- Australian Communications and Media Authority — Spam Act and telemarketing rules
