Common IT Policies For Small Businesses in 2026 and Beyond

IT policies for small business are the written rules that set how your team uses technology and protects the data it touches: laptops, email, cloud apps, AI tools and customer records. Most Australian small businesses need four core policies in 2026, plus a few extras triggered by how you actually work, like remote staff, personal devices or AI.

Let’s be honest. Nobody starts a business to write policies. They sit on the to-do list until a laptop goes missing, a client asks for your privacy policy in a tender, or someone on the team pastes a customer list into ChatGPT. This guide is the shortcut: what you need, what each policy should say, and which 2026 legal changes genuinely affect you.

What do IT policies for small business actually cover?

Think of them as the instruction manual for your tech. They tell staff what’s allowed on work devices, where customer data can live, which AI tools are fine, and who to call when something breaks. Good IT policies for small business do two jobs. They remove guesswork for your team, and they prove to a regulator, insurer or big client that you took reasonable steps.

Here’s what most founders miss. IT policies aren’t laws themselves. They’re how you show you’re meeting several different laws at once. This table maps the main ones.

Law or rule	Who it applies to	What your policies need to do
Privacy Act and the Australian Privacy Principles	Businesses over $3M turnover, plus the exceptions below	Publish a compliant Privacy Policy, secure data (APP 11), manage overseas disclosure (APP 8)
Notifiable Data Breaches scheme	Businesses covered by the Privacy Act	Set out how you assess a suspected breach and who notifies the OAIC
Statutory tort for serious invasions of privacy	Everyone, regardless of size	Limit staff access to personal data and set conduct rules
Workplace surveillance laws (strictest in NSW and the ACT)	Employers monitoring email, internet, devices, GPS or CCTV	Give written notice of what you monitor, and how
Spam Act 2003	Anyone sending marketing emails or SMS	Build consent and unsubscribe rules into your Acceptable Use rules
Fair Work Act 2009	Employers	Follow a fair process before disciplining anyone for a breach

Does the Privacy Act apply to your small business in 2026?

Short answer: probably not in full, but probably more than you assume. Plenty of blog posts (including earlier versions of this one) predicted the small business exemption would be gone by now. It isn’t. What has changed is everything around it.

The $3 million test, and the exceptions that catch people out

The Privacy Act 1988 (Cth) exempts most businesses with annual turnover of $3 million or less. Turnover is only the first question, though. You lose the exemption, whatever your size, if you:

• provide a health service and hold health information (this catches psychologists, physios, NDIS providers and many wellness businesses)
• buy or sell personal information, or disclose it for a benefit
• are a contracted service provider to a Commonwealth agency
• are a reporting entity under the AML/CTF laws, which from 1 July 2026 includes many accountants, lawyers, conveyancers and real estate agents for the information they handle for that work
• are related to a larger business that isn’t exempt, or have opted in voluntarily

Tax file numbers have their own rules too. If you collect TFNs from staff, you’re handling them under a separate legal framework, exemption or not.

What the tranche 2 draft does (and doesn’t) change

On 31 August 2026, the Attorney-General released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026. It contains around 40 reforms. Removing the small business exemption is not one of them, and neither is removing the employee records exemption.

So should you relax? No. The government still agrees in principle that the exemption should go, and the draft is still a draft. More importantly, the risks that actually hit small businesses (the privacy tort, client contract terms, platform rules from Google, Apple and Meta) already apply now.

The privacy tort applies to everyone, but not to every mistake

Since 10 June 2025, individuals can sue for a serious invasion of privacy, either by intrusion into their seclusion or misuse of information about them. The exemption doesn’t protect you here. The first published judgment came out of the NSW District Court in October 2025.

There’s a catch most articles skip. The invasion has to be intentional or reckless. An honest mistake, like an email sent to the wrong customer, won’t meet that bar on its own. A staff member snooping through customer records, or leaking someone’s address to settle a grudge, very well might. Recklessness also covers ignoring an obvious risk. That’s why access controls and conduct rules in your IT policies matter: they show you didn’t look the other way.

Penalties and enforcement are already real

The headline penalty for serious interferences with privacy has been the greater of $50 million, three times the benefit gained, or 30% of adjusted turnover since late 2022. The 2024 amendments added two lower tiers that are far more relevant to smaller covered businesses: a mid-tier civil penalty that doesn’t require the breach to be “serious”, and infringement notices for administrative failures.

The OAIC is using them. Its first-ever compliance sweep began in January 2026, reviewing the privacy policies of around 60 businesses that collect information in person. Non-compliant policies can attract infringement notices of up to $66,000. No court case required.

The 2024 changes also clarified that “reasonable steps” to secure personal information under Australian Privacy Principle 11 include technical and organisational measures. In plain English: a password manager and MFA count, and so do written policies and staff training.

AI and automated decision disclosures start 10 December 2026

From 10 December 2026, businesses covered by the Privacy Act must explain in their privacy policy when a computer program makes, or substantially helps make, decisions that could significantly affect someone. Think AI screening job applicants, approving refunds or scoring credit risk. You’ll need to describe the kinds of personal information used and the kinds of decisions made.

If you’re exempt, this doesn’t bind you yet. Still, if an AI tool is quietly making calls about your customers, write it down now. It’s a ten-minute job today and an awkward one after a complaint.

Which IT policies does your small business need first?

Ten policies cover the territory for most Australian small businesses. You don’t need all ten on day one. Four are non-negotiable, and the rest are triggered by what your business actually does. Use this table to decide your order.

Policy	You need it if…	Priority
IT Policy	Anyone other than you uses business tech	Start now
Privacy Policy	You collect any customer details, even just emails	Start now
Cybersecurity Policy	You hold data or money online (so, everyone)	Start now
Data Breach Policy	You hold personal information	Start now
AI Use Policy	Anyone uses ChatGPT, Claude, Gemini or Copilot for work	Next 30 days
Acceptable Use Policy	You have staff and want to monitor or restrict use	Next 30 days
BYOD Policy	Staff or contractors use personal phones or laptops	When triggered
Working From Home Policy	Anyone works remotely	When triggered
Social Media Policy	Staff post about work or run your accounts	When triggered
Incident Response Procedure	An outage would stop you trading	Within 6 months

1. IT Policy (the master document)

Your IT Policy is the umbrella. It sets the ground rules for computers, internet, email and phones, confirms the business owns the equipment, and reserves your right to monitor and discipline.

That monitoring line is where small businesses trip up. In NSW and the ACT, you generally must give employees written notice at least 14 days before computer, camera or tracking surveillance begins. A vague “we may monitor” sentence buried on page six won’t cut it. Spell out what you monitor (email logs, web traffic, device management, GPS), and pair it with a dedicated Surveillance Policy if you use CCTV or tracking. Our guide to the NSW Workplace Surveillance Act covers the detail.

Sample clause:

“The Company’s IT resources (including computers, mobile devices, email and internet access) are provided for business purposes. Limited personal use is permitted where it does not interfere with work or breach this policy. The Company conducts computer surveillance on an ongoing basis, including logging of email, internet use and access to Company systems, as described in the Surveillance Policy. Breaches of this policy may lead to disciplinary action, up to and including termination.”

2. Privacy Policy (expected even when it isn’t required)

A Privacy Policy explains how you collect, use, store and share personal information. It’s mandatory if the Privacy Act covers you. If it doesn’t, you’ll still need one: Google, Apple and Meta require it for ads and apps, and most B2B clients ask for it before they sign. Selling to customers in Europe? You’ll also want a GDPR Privacy Policy.

The most common fix our lawyers make in 2026? Removing promises the business can’t keep. “We never disclose your information overseas” sounds reassuring. But if you use ChatGPT, Gemini or a US-hosted CRM, it’s false, and a false privacy policy is a bigger problem than an honest one.

Sample clause:

“We use third-party service providers, including cloud hosting and artificial intelligence tools, to help deliver our services. Some of these providers store or process information outside Australia, including in the United States. We take reasonable steps to ensure these providers handle your personal information consistently with the Australian Privacy Principles. We do not sell your personal information.”

3. Acceptable Use Policy

An Acceptable Use Policy drills into what staff can and can’t do. Software installs. Personal Dropbox accounts. USB drives. Marketing emails sent from personal Gmail because “the CRM was slow”.

It’s also where Spam Act compliance quietly lives. Every commercial email or SMS needs consent, sender identification and a working unsubscribe. If a staff member blasts an old contact list from their own account, your business still wears the breach.

Sample clause:

“Employees must not install software on Company devices without approval from [Operations Manager]. Personal file-sharing services must not be used to store or share Company data. Marketing emails and SMS must only be sent through approved Company systems, to recipients who have consented, and must include a functional unsubscribe option.”

4. Cybersecurity Policy

A Cybersecurity Policy sets your technical standards: passwords, multi-factor authentication, encryption, patching and backups. The Australian Signals Directorate’s Essential Eight is the accepted baseline. You don’t need to hit every maturity level. You do need to say which controls you’ve switched on.

The gap we see most is offboarding. Former staff and contractors keep access to shared drives, Canva, the accounting login or the company Instagram for months. One leaver with a grudge and a live password is exactly the “reckless” scenario the privacy tort was built for.

Sample clause:

“Employees must use unique passwords of at least 12 characters, stored in the Company password manager, and enable multi-factor authentication on every system that offers it. Devices must be encrypted and lock after 5 minutes of inactivity. Access to Company systems is granted on a need-to-know basis, reviewed every quarter, and removed on or before a person’s last day.”

5. Data Breach Policy

A Data Breach Policy is your emergency plan. If the Privacy Act covers you, the Notifiable Data Breaches scheme applies. Get the timing right, because many templates get it wrong.

If you suspect an eligible breach, you have up to 30 days to assess it. Once you’ve confirmed a breach likely to cause serious harm, you must notify the OAIC and affected people as soon as practicable. The 30 days is an outer limit for working out what happened, not a grace period for telling anyone.

Sample clause:

“Any employee who suspects a data breach must tell [Incident Lead] within 2 hours. The Incident Lead will: (a) contain the breach by revoking access, isolating systems or resetting passwords; (b) preserve evidence, including logs and device states; (c) complete an assessment within 30 days of the suspicion arising, and sooner wherever possible; (d) if the breach is likely to result in serious harm, notify the OAIC and affected individuals as soon as practicable; and (e) record lessons learned and update controls.”

6. AI Use Policy (the one most businesses are missing)

An AI Use Policy is now the most requested policy topic in Lawpath consultations. Your team is already using ChatGPT, Claude, Gemini or Copilot. The question is whether they’re pasting client contracts into a free account that trains on inputs.

Most founders write an outright ban. Then nobody follows it. A tiered approach works better: public tools for generic tasks, approved business accounts (with data training switched off) for work involving client information, and a hard no for health information, TFNs and anything under NDA.

Sample clause:

“Employees may use public generative AI tools for tasks that involve no confidential or personal information. Work involving client or customer information must only use the approved AI tools listed by [Operations Manager], with data training disabled. Health information, tax file numbers and information covered by a confidentiality agreement must never be entered into any AI tool. A person must review all AI-generated content before it is sent to a customer or published.”

7. Bring Your Own Device (BYOD) Policy

A BYOD Policy covers personal phones and laptops used for work. It sets minimum security standards and gives you the right to wipe work data when someone leaves. It’s essential if you engage contractors who bring their own gear.

Watch out for tracking. If your rostering or field-service app logs GPS on a worker’s personal phone, it can keep recording after the shift ends. That’s surveillance of someone’s private life. Your policy should limit tracking to working hours and require deletion of anything collected by accident.

Sample clause:

“Personal devices used for Company work must have a passcode or biometric lock, current operating system updates, and the Company’s device management profile installed. Company data must only be stored in approved apps. Location tracking through Company apps is limited to rostered working hours, and any location data collected outside those hours will be deleted once identified. The Company may remotely remove Company data if the device is lost or the engagement ends.”

8. Social Media Policy

A Social Media Policy covers how staff represent the business online and what happens when personal accounts overlap with work. The modern risk isn’t the drunk Facebook post. It’s the well-meaning LinkedIn update naming a client, or a screenshot of a dashboard with customer names in the corner.

Also decide who owns your business accounts. If the only admin on your Instagram is a casual who left last year, you have a problem that no policy can fix after the fact.

Sample clause:

“Employees must not post confidential information, customer details or images that show customer information on any social media account. Employees who identify themselves as working for the Company must make clear that views expressed are their own. All Company social media accounts must have at least two administrators, one of whom is a director.”

9. Working From Home Policy

A Working From Home Policy covers the IT and security side of remote work: secure Wi-Fi, approved devices, and handling confidential documents at home. The employment-law side, including how to respond to flexible work requests under the flexible work reforms, belongs in a separate Flexible Working Policy.

Sample clause:

“Employees working from home must use a password-protected home network with WPA2 or WPA3 encryption and must not use public Wi-Fi for Company work without the Company VPN. Confidential documents must be stored securely and kept out of view on video calls. All Company equipment must be returned within 5 business days of employment ending.”

10. Incident Response Procedure

Your Data Breach Policy handles privacy incidents. An Incident Response Procedure handles everything else: ransomware, outages, malware, a hijacked email account sending fake invoices. It’s the runbook your team follows at 4.45pm on a Friday.

Write it, then test it. A 30-minute tabletop exercise (“our Xero login has been compromised, what happens next?”) will show you which phone numbers are missing and who doesn’t know they’re responsible. Far better to find that out in a meeting room.

Sample clause:

“Incidents are rated P1 (stops trading or affects customers, 1-hour response), P2 (affects one person or function, 4-hour response) or P3 (minor, next business day). If a device may be compromised: (a) disconnect it from the network; (b) leave it powered on to preserve evidence; (c) notify [IT Lead] and [Operations Manager]; and (d) do not discuss the incident outside the business until authorised. This procedure is tested at least once a year.”

What we see in Lawpath consultations

Our lawyers review privacy and IT policies for small businesses every week. Five patterns keep coming up, and almost none of them appear in generic guides.

The privacy policy that contradicts the AI tools

Recruiters, consultants and allied health clinics all bring us the same document. It promises customer data never leaves Australia. Meanwhile the team summarises interview notes in ChatGPT and drafts client emails in Gemini. The fix is straightforward: add an AI and automated processing clause, rewrite the overseas disclosure section to reflect reality, and make acceptance of the privacy policy part of your client terms.

AI-written policies quoting American law

A growing number of owners now ask an AI tool to write their policies, then book a review. We regularly find references to HIPAA, CCPA or “federal regulations” that have no force in Australia. The structure is often fine. The legal foundation is from the wrong country. If your policy mentions a US statute, it needs a rewrite before anyone relies on it.

“We’re under $3 million, so we’re exempt”

This assumption is most dangerous in health, NDIS, childcare and wellness. Holding health information as part of a health service removes the exemption entirely, and AI tools make it worse. Our advisers routinely help these businesses map their data flows, keep clinical data inside compliant systems, and put a staff AI policy in place before anything sensitive touches a chatbot.

Templates published with the blanks still in them

It happens more often than you’d expect. A privacy policy goes live with “[insert retention period]” or a CRM clause that stops mid-sentence. With the OAIC now sweeping privacy policies, an incomplete one is a gift to the regulator. Read your live policy out loud once. You’ll spot the gaps in five minutes.

The 40-page mega-policy nobody reads

Some businesses cram every rule into one giant document. Staff don’t read it, managers can’t find the right clause during a disciplinary meeting, and updating it is painful. Keep policies modular. A short AI Use Policy can be updated in an afternoon when your tools change. A 40-pager can’t.

How do you roll out IT policies in a small business?

Writing the policies is the easy bit. Making them stick is where most small businesses stall. Here’s the sequence that works.

Step 1: Map your systems and data (30 minutes)

List every system you use: email, accounting, CRM, cloud storage, payment gateway, AI tools. Note what data lives in each, who can access it, and where it’s hosted. You’ll almost certainly find a tool nobody remembers signing up for.

Step 2: Start with the four non-negotiables

IT Policy, Privacy Policy, Cybersecurity Policy and Data Breach Policy. Get those live and acknowledged before you touch the rest. Four done beats ten half-drafted.

Step 3: Tailor, don’t copy

Templates get you 80% of the way. The last 20% is naming your actual systems and your actual people. If your Data Breach Policy says “notify the IT team” and you don’t have one, staff will freeze. If you want a lawyer to check the result, a fixed-fee review through a Lawpath legal plan catches the gaps before they matter.

Step 4: Give notice and get sign-off

Run a 15-minute team session on the essentials: approved AI tools, who to call about a breach, what to do with a lost laptop. Collect written or digital acknowledgements, and build them into onboarding through your Employee Handbook. In NSW and the ACT, that notice also needs to land at least 14 days before any new surveillance starts.

Step 5: Close the loop on offboarding

Every departure, including contractors and agencies, should trigger the same checklist:

• Remove access to email, shared drives, the CRM, accounting software and social accounts on or before the last day
• Change any shared passwords the person knew, and transfer ownership of files and accounts they created
• Recover Company devices and remotely wipe work data from personal ones
• Record the date each step was completed

Step 6: Review yearly, and after any big change

Put a 12-month reminder in the calendar. Also review when you add a major system, bring on a contractor with customer data access, start using a new AI tool, or have an incident. With tranche 2 still in consultation, expect at least one more round of updates in the next year or two.

What are the common IT policy mistakes to avoid?

Writing rules you won’t enforce. A ban that management ignores is worse than no rule at all, because it undermines every other clause. If personal email on work laptops is fine in practice, say so.

Naming people instead of roles. If your breach plan names “Jenny” and Jenny resigns, the plan is out of date the next morning. Name roles, and keep a separate contact list.

Forgetting contractors. Freelancers and agencies often have the same access as employees. If your policies only apply to “employees”, contractors can argue they’re off the hook. Extend coverage in your contractor agreements.

Using an overseas template. A GDPR policy isn’t a Privacy Act policy, and US templates reference laws that don’t exist here. That goes double for policies drafted by AI tools.

Treating the exemption as permission to do nothing. The exemption survived the latest draft, but the privacy tort, client contracts and platform rules didn’t wait for it. Being exempt from the Act is not the same as being exempt from risk.

Frequently asked questions

What are IT policies for small business?

They’re written rules for how your business and staff use technology and protect data. They cover devices, email, passwords, AI tools, customer information, monitoring and what to do when something goes wrong. Most Australian small businesses start with an IT Policy, Privacy Policy, Cybersecurity Policy and Data Breach Policy.

Do small businesses need a Privacy Policy in Australia?

It’s legally required if the Privacy Act covers you: turnover above $3 million, or an exception such as providing a health service or trading in personal information. Below that, you’ll still need one in practice, because Google, Apple, Meta and most business clients ask for it.

Has the Privacy Act small business exemption been removed?

No. As of October 2026 the $3 million exemption is still in force. The tranche 2 exposure draft released on 31 August 2026 did not remove it. The government supports removal in principle, so build good habits now rather than waiting for a deadline.

Can a small business be sued for a privacy breach?

Yes. Since 10 June 2025, individuals can sue anyone, including exempt businesses, for a serious invasion of privacy. The invasion must be intentional or reckless, so an honest mistake usually won’t qualify. Staff misusing customer data, or ignoring an obvious risk, can.

What’s the difference between a Cybersecurity Policy and a Data Breach Policy?

A Cybersecurity Policy is preventive. It sets standards like passwords, MFA, encryption and backups. A Data Breach Policy is your response plan: who assesses a suspected breach, how fast, and who notifies the OAIC and affected people. You need both.

Do I need to tell staff I’m monitoring their computers?

Yes. In NSW and the ACT, employers generally must give written notice at least 14 days before computer, camera or tracking surveillance starts. Other states have their own rules. Name exactly what you monitor in your IT Policy or Surveillance Policy and get staff to acknowledge it.

Is an AI Use Policy necessary for a small business?

Yes, if anyone on your team uses ChatGPT, Claude, Gemini or Copilot for work. Without one, client data ends up in tools that may store or train on it. A tiered policy (public tools for generic work, approved accounts for client work, no sensitive data ever) is easy to follow.

Can I fire an employee for breaching an IT policy?

Only if the breach is serious, the policy was clearly communicated, and you follow a fair process. A minor slip is a performance conversation. Deliberate data theft or harassment may justify dismissal. Rushing it is a common route to an unfair dismissal claim, so get advice first.

How quickly do I have to report a data breach?

If the Privacy Act covers you and you suspect an eligible breach, you have up to 30 days to assess it. Once you confirm a breach likely to cause serious harm, notify the OAIC and affected individuals as soon as practicable. Don’t sit on a confirmed breach until day 30.

How often should I update my IT policies?

At least once a year, plus whenever something significant changes: a new system or AI tool, a new type of data, a legal reform, or an incident. With tranche 2 privacy reforms in consultation, most businesses should expect another update cycle soon.

Where can I get free cyber security help for my small business?

The government-funded Small Business Cyber Resilience Service, run by IDCARE, gives free one-on-one support to businesses with 19 or fewer employees, including sole traders. It helps you build defences and recover after an incident. Call 1800 595 170.

How Lawpath can help

If you’ve read this far and realised you have none of these policies, you’re not behind. Most small businesses are exactly where you are. The difference between a scramble and a smooth response is usually one afternoon of setup.

Lawpath has helped more than 650,000 Australian businesses get their legals sorted, and every policy in this guide is in our library of 550+ customisable templates. You answer a few questions, the document builds itself, and it stays in one place for next year’s review.

Start your IT Policy today from the Lawpath legal document library. Then tick off the other three non-negotiables this month.