Running a small business in Australia means operating across several intersecting legal frameworks at once. Most owners know the basics — pay your people correctly, don't mislead customers — but fewer have a clear picture of which specific laws impose mandatory obligations on them, as distinct from the practices that are simply good business sense. That gap creates avoidable exposure.
This article explains the four main compliance frameworks that apply to almost all Australian small businesses: work health and safety, employment law under the Fair Work system, the Privacy Act 1988 (Cth), and the Australian Consumer Law. It also covers a more recent addition — the positive duty introduced by the Respect@Work reforms — that applies to every employer regardless of size. For each framework, the article identifies what is legally required, where the most common gaps appear, and what a practical set of internal policies needs to address.
Work health and safety obligations
The national model Work Health and Safety laws — enacted as the Work Health and Safety Act 2011 in most jurisdictions — impose a primary duty of care on every person conducting a business or undertaking (a PCBU). The duty requires the PCBU to ensure, so far as is reasonably practicable, the health and safety of workers and other people affected by the work.
"So far as is reasonably practicable" is not a get-out clause. It means you must weigh the likelihood and severity of harm against the cost and practicability of eliminating or minimising it — and you must actively manage the risk rather than simply react to incidents after they occur. The duty includes:
- providing and maintaining a safe physical work environment
- identifying hazards and managing risks
- consulting workers on health and safety matters
- maintaining systems for reporting and responding to incidents
The WHS law does not require every small business to produce a thick written manual. What it requires is an effective system. In higher-risk industries — construction, food processing, healthcare, transport — written procedures and Safe Work Method Statements for high-risk activities are typically expected. In lower-risk office environments, the system may be lighter, but it still needs to exist and be followed in practice.
The most common gap in small businesses is the absence of any documented incident reporting and response process. If something goes wrong and a regulator investigates, demonstrating that a system existed — and was actually used — is central to how liability is assessed.
Fair Work obligations and employment law
If you employ staff in the national workplace relations system, you are required to comply with the National Employment Standards set out in the Fair Work Act 2009 (Cth). The National Employment Standards establish minimum entitlements that apply to all employees — they cannot be contracted out of or waived. They cover matters including maximum weekly hours, leave entitlements, requests for flexible working arrangements, notice of termination, and redundancy pay.
In addition to the National Employment Standards, most employees are covered by a modern award that sets minimum pay rates and conditions for their industry or occupation. You are required to pay at least the award rate and apply the correct conditions, regardless of what an employment contract says.
Written employment contracts are not legally mandated in every case, but they are essential in practice. A well-drafted contract sets out the key terms — role, remuneration, hours, confidentiality, and what happens on termination — and provides the baseline for managing the employment relationship consistently. Without a written contract, disputes about what was agreed become significantly harder and more expensive to resolve.
Beyond individual contracts, employment policies on conduct, leave management, and performance serve a function that is partly protective: a documented performance management process that was followed consistently is far more defensible before the Fair Work Commission than one that was improvised.
Privacy Act — the small business operator threshold
The Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles do not apply to all businesses. The small business operator exemption means that businesses with an annual turnover of $3 million or less are generally not covered.
However, the exemption is not as broad as it first appears. Small businesses are brought back into the Privacy Act's coverage if any of the following apply:
- the business provides health services (physical, psychological, or mental health)
- the business collects or discloses personal information about another person for a benefit, service, or advantage — effectively trading in personal information
- the business is a contracted service provider to the Commonwealth
- the business is a credit reporting body, a residential tenancy database operator, or a business with AML/CTF reporting obligations
If none of those exceptions apply, the Privacy Act does not legally require a small business below the turnover threshold to maintain a formal privacy policy. That said, operating without any privacy statement is increasingly difficult in practice: most customers, suppliers, and business partners expect one, and many platform agreements and government procurement processes require it. A business that collects customer contact information or employee records and has no documented approach to handling that data is also poorly positioned when it grows past the threshold.
The Australian Consumer Law
The Australian Consumer Law — contained in Schedule 2 of the Competition and Consumer Act 2010 (Cth) — applies to all businesses that supply goods or services in Australia, regardless of size or turnover. There is no small business exemption.
The key obligations include:
- consumer guarantees that goods be of acceptable quality, fit for any disclosed purpose, and match their description
- prohibitions on misleading or deceptive conduct and false representations
- rules on unsolicited sales, lay-by agreements, and unfair contract terms
Internal policies matter here because ACL disputes typically arise not from deliberate misconduct but from inconsistency — a sales promise that the operations team cannot fulfil, or a refund process that the front-line team was never told about. Having a documented refund and warranty procedure, and training the people who speak to customers on what the law actually requires, reduces those gaps.
The Respect@Work positive duty
The Anti-Discrimination and Human Rights Legislation Amendment (Respect at Work) Act 2022 introduced a new positive duty into the Sex Discrimination Act 1984 (Cth). Under s 47C, every employer and PCBU must take reasonable and proportionate measures to eliminate, as far as possible:
- sex discrimination and sex-based harassment in connection with work
- sexual harassment in connection with work
- conduct that creates a work environment that is hostile on the ground of sex
- related acts of victimisation
This duty applies to all organisations and businesses in Australia that have obligations under the Sex Discrimination Act 1984 (Cth) — including sole traders, small businesses, and micro-businesses. There is no size threshold. The Australian Human Rights Commission has had enforcement and investigatory powers in relation to the positive duty since 12 December 2023.
"Reasonable and proportionate" means the measures you are expected to take will differ depending on your size and resources — a sole trader cannot be expected to do what a listed company does. But the direction of the duty is clear: it is not enough to respond to complaints after they arise. You are required to take proactive steps to prevent the conduct from occurring in the first place.
In practice, for most small businesses, the positive duty is met by a combination of a code of conduct that makes behavioural expectations explicit, a simple complaints process that employees trust, and periodic training. Documenting that training and any complaints received, and what was done in response, is important — it is the evidence that the duty was being discharged.
Where businesses typically go wrong
Most compliance failures in small businesses are not wilful. They arise from one of a small number of recurring patterns:
- Policies exist on paper but are not followed in practice. A code of conduct that was never given to staff, or a WHS procedure that no one has read, provides no protection and can actually make matters worse if it shows what the business claimed to do versus what it actually did.
- Contracts do not reflect the actual working arrangement. A written employment contract that describes a different role, different hours, or different pay than what the employee actually does creates immediate ambiguity in any dispute.
- The Privacy Act threshold is misunderstood. Businesses assume the exemption applies and do not check whether one of the exceptions brings them into coverage — particularly the health services exception, which is common.
- The ACL is treated as a consumer-facing issue rather than an operational one. The obligation to provide consumer guarantees is discharged internally, by having processes that ensure what was promised can be delivered. Marketing and operations being out of alignment is a recurring source of ACL complaints.
- The Respect@Work positive duty is either unknown or confused with the older vicarious liability framework. The positive duty requires proactive prevention, not just a complaints process after the fact.
How Artificer Legal can help
Getting the baseline right is not complicated, but it does require someone to look at your business specifically — not a template. The policies and contracts that work for a 50-person manufacturing business are different from those that work for a 4-person professional services firm.
Artificer Legal assists small businesses to:
- identify which legal frameworks apply to their specific business model, size, and industry
- draft or review employment contracts and workplace policies that are legally sound and actually usable
- assess whether the Privacy Act applies and, if so, what it requires in practice
- review customer-facing terms and internal procedures for ACL compliance
- set up a proportionate approach to the Respect@Work positive duty
If you are starting out, the most efficient path is a short engagement that maps your obligations and produces the core documents you actually need — rather than a library of templates you will never open.
Summary
Most Australian small businesses are subject to four overlapping legal frameworks: WHS obligations under the model WHS Act, Fair Work obligations including the National Employment Standards, the Privacy Act 1988 (Cth) if the exemption does not apply or an exception applies, and the Australian Consumer Law which applies regardless of size. The Respect@Work positive duty under s 47C of the Sex Discrimination Act 1984 (Cth) applies to all employers.
The practical task is not to produce comprehensive policy documentation for its own sake. It is to have effective systems in the areas where the law requires them, to document those systems in a form your team can actually follow, and to keep them current as your business changes. Start with what is mandatory, build in what is genuinely useful, and get legal input where the stakes are highest.