Site Changes

On 1 November 2010 the Office of the Privacy Commissioner was integrated into the Office of the Australian Information Commissioner and a new website established at www.oaic.gov.au.

Note 1: Major changes to the Privacy Act 1988 will come into effect in March 2014. Agencies, businesses and not for profits need to start preparing for these changes. For more information go to our privacy law reform page at www.oaic.gov.au
Note 2: From 12 March 2013 content is no longer being added to, or amended, on this site, consequently some information may be out of date. For new privacy content visit the www.oaic.gov.au website.

What happens if I buy a small business including a customer database?

If you buy the assets of a business which include personal information, such as a customer database, you are trading in personal information and your business will have to comply with the Privacy Act unless:

you have the consent of the individuals concerned before the sale is completed; or
the purchase is required or authorised by law.

The purchase of a business is not trading in personal information and the business will not have to comply with the Privacy Act if it only involves a change of ownership, or sale of shares, of the business and the personal information is still held by the same business. In this case, the business may have new owners, but the business has not disclosed the personal information.

For more information on whether or not your small business is exempt from the Privacy Act see the Privacy Checklist for Small Business 2002 and Information Sheet 16-2002: Application of key NPPs to due diligence and completion when buying and selling a business.