GDPR can apply to your Australian business even if you have no EU office and earn less than AU$3 million a year.
What matters is whether your activities meet the EU’s establishment, targeting, or monitoring tests.
An EU client contract may also require GDPR safeguards. Before you change your systems or promise compliance, work out which activities and data flows those tests actually cover.
Let’s look at this together.
What the GDPR Is
The General Data Protection Regulation (GDPR) is the EU law governing how you collect, use, store, share, and delete personal data.
That data can include someone’s name, location, or online identifier if it identifies them or makes them identifiable.
Your duties depend partly on your role, like:
- A controller decides why and how data is processed
- A processor handles it on the controller’s instructions.
So, if you run a subscription service and also host a client’s records, you may be a controller for one activity and a processor for the other.
Thus, identify each role before deciding who must answer requests, secure the data, or report a breach.
Does the GDPR Apply to Australian Businesses?
The GDPR applies to your Australian business when the relevant processing meets an EU establishment, targeting, or monitoring test.
That’s why the OAIC sets out these tests for Australian entities, because this circumstance is quite tricky.
As a case in point, check each activity against them: a visitor opening your website from Paris is different from a campaign inviting people in France to subscribe.
The first three tests below decide when the law applies. The examples then show where Australian businesses commonly need to check their work.
The Establishment Test
The establishment test applies when you process data in the context of an EU establishment’s activities, even if your systems sit in Australia.
An EU branch may qualify, but an incorporated company is not required.
Check whether you carry out real activity through stable arrangements there and which processing supports it.
The Targeting Test: Offering Goods or Services to People in the EU
The targeting test applies when you offer goods or services to people in the EU and process data related to that offer.
The service can be free. EU shipping options, euro payments, and campaigns aimed at EU users can indicate intent.
A website that people in the EU can merely access is insufficient on its own, as the European Data Protection Board’s guidance explains.
The Monitoring Test: Tracking Behaviour of People in the EU
The monitoring test applies when you track the behaviour of people while they are in the EU. An app that builds profiles from their activity or location may qualify.
Check what your analytics and advertising tools record, whether you can identify users, and how you use the results.
However, be aware; A tracking tool’s presence alone does not settle the test.
Australian Businesses Most Often Caught
Australian retailers shipping to the EU, software firms signing up EU users, and apps profiling people there have obvious activities to test.
Review your sales pages, checkout settings, campaigns, and user tracking against the three tests.
If you process data for an EU client, check your contract as well. It may require security evidence, help with individual requests, and fast incident reporting.
Also, considering that receiving the client’s data alone does not prove every activity you perform falls directly within GDPR’s territorial scope; have counsel assess your role and processing.
GDPR vs the Privacy Act 1988 and the Australian Privacy Principles
GDPR can cover your EU-facing work regardless of turnover, while Australia’s Privacy Act 1988 generally exempts businesses with annual turnover of AU$3 million or less, subject to exceptions.
The Australian law contains 13 Australian Privacy Principles (APPs); there is no federal law named the “Data Protection Act.”
If both laws cover your work, these differences affect what your team must build and prove:
| Question | GDPR | Australian Privacy Act and APPs |
|---|---|---|
| Coverage | Establishment, targeting, or monitoring tests; no turnover exemption. | AU$3 million small business exemption, with exceptions. |
| Individual rights | Conditional rights to access, correction, erasure, portability, objection, and protection from certain automated decisions. | Access and correction under APPs 12 and 13; no equivalent general rights to erasure, portability, or objection. |
| Data handling | Lawful basis, notices, and security suited to the risk. | APP rules on collection, use, disclosure, and reasonable security steps. |
| Breach reporting | A controller generally notifies the EU authority within 72 hours when a breach poses a risk. | Covered entities notify the OAIC and affected people as soon as practicable after an eligible breach is established. |
Just a heads-up that meeting an APP duty does not automatically meet its GDPR counterpart.
Consider keeping a separate record of each decision and use a cybersecurity compliance guide to connect those duties to your security work.
The Rights the GDPR Gives Individuals
GDPR rights require you to find someone’s data, decide what the law permits, and act across every relevant system.
The four jobs below cover the requests your team may receive, decisions made by software, and the time you have to respond.
Access, Rectification and Erasure
People can request access to their data, correction of errors, or erasure when a GDPR ground applies.
As an illustration, data that is no longer needed may qualify for deletion, although some records must be retained by law.
That’s why, always check your live systems and suppliers before you promise to remove every copy.
Data Portability and the Right to Object
Data portability can require you to provide certain data a person gave you in a machine-readable format when processing is automated and based on consent or a contract.
People can also object to some uses of their data.
If someone objects to direct marketing, your team must stop using their data for it across the relevant lists and platforms.
Automated Decision-Making and Profiling
People have protection against decisions made solely by automated processing when those decisions have legal or similarly significant effects.
If software rejects an application without meaningful human involvement, document the decision and check what review or challenge process the law requires.
Plus, routine profiling does not automatically meet this threshold; exceptions and safeguards also matter.
Responding to a Data Subject Request
Respond to a valid rights request without undue delay and generally within one month.
Complex requests can allow up to two extra months, but you must explain the extension within the first month.
Assign an owner to the inbox, verify identity where needed, locate the data, consult your privacy adviser on exceptions, and log the response.
For further details, consider checking the European Data Protection Board’s small business guidance that explains the timing.
What Are the Penalties for Non-Compliance?
Breaches of the GDPR (Regulation (EU) 2016/679) can carry substantial fines, but the headline figures are statutory maximums, defined in the two upper tiers.
- Up to €10 million or 2% of worldwide annual turnover for certain breaches, whichever is higher.
- Up to €20 million or 4% for more serious breaches, whichever is higher.
Regulators assess each case and can also order changes or restrict data flows.
If an EU client cannot get your data breach incident record or transfer terms, a tender or renewal may stall before a fine enters the picture.
How to Comply with GDPR as an Australian Business
You could start GDPR compliance by identifying the processing in scope, then give each duty an owner, a working control, and evidence.
The eight steps below move from the applicability test through data handling and security to breach response.
Legal counsel should confirm your legal decisions; your team can build and operate the technical measures.
Assess Whether the GDPR Applies to You
Assess GDPR applicability for each activity, rather than labelling your entire business “in” or “out.”
List EU operations, offers aimed at people there, and tracking of their behaviour.
Record whether you control the processing or act for a client, then give the activity list and contracts to your legal adviser.
Map and Minimise Your Data Flows
Map EU personal data from collection through storage, staff access, suppliers, backups, and deletion.
Record the system owner and retention period, then remove fields and copies you no longer need.
Data loss prevention services can help find sensitive files and track sharing after you know which flows to govern.
Identify a Lawful Basis for Each Processing Activity
Choose and record a lawful basis for each purpose before you use personal data.
Consent, a contract, a legal obligation, and legitimate interests are possible bases when their conditions apply.
A blanket consent box cannot make that choice for you. Have your adviser review sensitive data and uses that may need further safeguards.
Review and Update Privacy Policies and Consent Notices
Update your privacy notices so people can see what you collect, why, on which basis, who receives it, and how long you keep it.
Explain their rights where you collect the data. If you rely on consent, record it and make withdrawal workable.
Match the notice to what your form, app, and staff actually do.
Strengthen Data Security Controls
In this phase, you should protect the systems holding EU personal data with measures suited to the risk.
Start with multi-factor authentication, limited access, patching, tested backups, and monitoring; use encryption where warranted. Record the scope and test results.
Article 32 does not mandate an Australian framework or a DLP product, though DLP rules can help restrict unapproved file transfers.
Appoint a Privacy Officer or EU Representative
Then, appoint a formal data protection officer or EU representative when the relevant GDPR test requires one; name an internal privacy owner in any case.
A DPO is required for specified activities such as large-scale monitoring or sensitive-data processing.
An EU representative is a contact point for some businesses outside the EU caught by targeting or monitoring rules.
Article 27 has an exception for qualifying occasional, low-risk processing. Ask counsel to assess both roles separately.
Review Cross-Border Data Transfers
Review each transfer from an EU client or supplier into your Australian systems, including onward access by subcontractors.
Australia is absent from the European Commission’s adequacy list, so some transfers need a mechanism such as standard contractual clauses and an assessment of the safeguards.
Direct collection from a person in the EU raises a different transfer question.
We recommend giving your adviser the hosting, access, and supplier facts before choosing a mechanism, since where the data is stored and who can reach it also shapes your data sovereignty position.
Build a 72-Hour Breach Response Process
Build a breach process that gets suspected exposure to a decision maker as soon as your team learns of it.
A controller generally has 72 hours from awareness to notify an EU authority when a personal data breach poses a risk.
A processor tells its controller without undue delay; a high-risk breach may also require notice to affected people.
Give staff one reporting route, log when you become aware, and test how quickly suppliers provide facts.
What GDPR Compliance Means for an Australian SMB
For an Australian SMB, GDPR compliance starts with the EU-facing work you actually do and the evidence you can produce for it.
Let’s see how Australia’s exemption, your existing controls, privacy reforms, and customer reviews affect that work.
Why the Small Business Exemption Gives You No Cover
Australia’s small business exemption does not protect you from the GDPR.
If your EU-facing activities meet its establishment, targeting, or monitoring tests, the relevant processing may fall within scope regardless of your turnover.
The OAIC says most businesses with annual turnover of AU$3 million or less are exempt from the Privacy Act.
Health service providers, businesses trading in personal information, and some Commonwealth contractors are exceptions.
Thus, assess your Australian and EU obligations against the data you handle and the client terms you accept.
Where Essential Eight and SMB1001 Controls Already Meet GDPR Security Duties
The Essential Eight and SMB1001 can support the GDPR’s security duties when the controls protect the EU data your team handles. Your evidence should show where each control operates and who looks after it:
- Prevent unauthorised access: Show where MFA and restricted administrator access protect the relevant systems.
- Reduce disruption: Keep patch records and backup restoration results for those systems.
- Assign ownership: Use SMB1001 records to show who maintains each control and checks that it still works.
This evidence helps your team answer a client questionnaire and see which gaps still need work.
You will still need separate decisions on a lawful basis, individual rights, and transfer terms.
How Australia’s Privacy Reforms Are Closing the Gap
Australia’s privacy reforms bring some local duties closer to GDPR-style expectations for security and transparency. Weigh up, their status and start dates differ:
- **In force: **APP 11.3 confirms that reasonable security steps for covered entities include technical and organisational measures.
- **From 10 December 2026: **Certain covered entities must include information about significant automated decisions in their privacy policies.
- Still proposed as at September 2026: The 2026 exposure draft includes a fair-and-reasonable handling test and a 72-hour OAIC notification duty once an entity has reasonable grounds to believe an eligible breach occurred.
Review your Australian privacy practices as each duty takes effect, then assess your EU-facing processing against the GDPR requirements that already apply.
What EU Clients and Cyber Insurers Ask You to Prove
EU clients and cyber insurers may ask where their data sits, who can access it, and whether your controls work.
A tender or renewal can stall when those records sit across supplier portals and old inboxes. Consider to keep the following evidence together:
- A map of systems, data locations, and subcontractors;
- Recent access reviews, control test results, and penetration test findings; and
- An incident path showing who alerts the client and when.
Your contract and cyber insurance policy determine the questions you must answer.
Keeping these records current helps your team respond without delaying a client review, although customer approval or an insurer’s response does not certify GDPR compliance.
Meet Your GDPR Obligations with Redscale
When an EU client sends a due diligence form, the problem is your team needs to show where its data lands, who can move it, and how an incident reaches the client.
If those answers sit across SaaS portals and tickets, sales waits for IT. Onboarding can pause while a contract condition is still open.
Redscale brings data controls, monitoring, and evidence into the work your team runs each day:
Our data loss prevention services identify sensitive files and restrict unsafe sharing.
Our managed security services watch the systems involved, investigate alerts, and helps build an incident timeline.
Also, Redscale OSCP- and CREST-certified testers validate exposed access paths when a client requires technical evidence.
Book a free discussion with Redscale today to strengthen your security framework and support your European expansion.
