Customer data and privacy: what small service businesses actually have to do

Every service business is a data business whether it set out to be one or not. A dog groomer holds addresses and pet medical notes. A mobile massage therapist holds health history. A migration agent holds passport details. A tattoo studio holds consent forms and photographs of people's bodies.

Most privacy guidance is written for organisations with a compliance department. This is the version for a business with three staff and no lawyer on retainer.

First: find out whether the Act applies to you

Australia's Privacy Act has long included an exemption for small businesses under a turnover threshold, with significant carve-outs — health service providers are covered regardless of size, as are businesses that buy or sell personal information, and several other categories.

Two things to know about that. The first is that the health services carve-out is broader than people assume, and catches a lot of businesses that do not think of themselves as healthcare. The second is that this area has been under active reform, and the exemption has been a standing target for removal.

So the practical answer is: do not assume you are exempt, and do not rely on a figure you read in a blog post, including this one. Check your own position against the OAIC's guidance or ask your accountant. What follows is worth doing either way, because most of it is ordinary good practice rather than compliance theatre.

Collect less

The single most effective privacy measure is not holding the data in the first place.

Go through your intake form and ask of each field: what do I do with this? Date of birth is genuinely useful if you send birthday offers or need to confirm someone is over eighteen. It is dead weight if you have never once used it. An emergency contact matters for a treatment that carries risk and is an oddity on a lawn-mowing booking.

Every field you delete is one you cannot lose, cannot leak, and do not have to explain.

Know where it actually lives

Most small businesses cannot answer "where is your customer data?" accurately. The honest answer is usually: some in the booking system, some in a phone's contacts, some in a WhatsApp thread, some in a staff member's personal notes app, some on a clipboard in the van.

That scattering is the real risk. It is not that any one copy is insecure — it is that nobody knows how many copies exist, so nobody can secure, update or delete them all.

Write the list down. It takes twenty minutes and it is usually uncomfortable reading.

Lock the obvious doors

Three things cover most of the realistic risk for a business this size:

Individual logins for every staff member. A shared password is not a login. When someone leaves, you cannot revoke a shared password without disrupting everyone, so in practice nobody does, and the former employee keeps access indefinitely.

Two-factor authentication on anything holding customer data — your booking system, your email, your payment provider. This is the single highest-value security change available to a small business and it costs nothing.

Role-based access. A casual covering the front desk needs to see today's bookings. They do not need the full customer list with contact details and notes, and they certainly do not need the reports. Most systems let you scope this; most businesses never do.

Consent that means something

If you send marketing — SMS or email — Australian spam rules require consent, a clear sender identity, and a working unsubscribe. A pre-ticked box is not consent. "They booked with us once in 2019" is not consent.

In practice: a separate, unticked opt-in at booking, and an unsubscribe that works on the first click without a login. Keep the record of when and how someone opted in, because that record is the entire defence if it is ever questioned.

Transactional messages — a booking confirmation, a reminder, a receipt — sit differently from marketing. Sending someone an appointment reminder they asked for is not a marketing message. Sending them a discount offer is, even if it is attached to the reminder.

When someone asks for their data, or asks you to delete it

This request will come eventually, usually from someone who is annoyed about something else. Two things make it painless:

Know how to export one customer's record before you are asked. If that takes a morning of copy-pasting, fix it now rather than under time pressure.

Understand what you cannot delete. Tax law requires you to retain records of transactions for a set period, and that obligation does not evaporate because a customer asked. You can usually delete contact details and notes while retaining the financial record. Say so plainly rather than refusing outright or over-promising.

If something does go wrong

The instinct is to keep it quiet. That instinct is wrong, and in some cases unlawful — where a data breach is likely to cause serious harm, there are notification obligations to both the people affected and the regulator.

Have a short plan written down: who you ring, what you turn off, who you tell. It will never be a polished document and it does not need to be. It needs to exist before the day you need it.

This is general information, not legal advice. Thresholds, exemptions and obligations in this area change, and your position depends on your industry and turnover — confirm yours with the OAIC or your own adviser.

Trimsy gives each staff member their own login with role-based access, supports two-factor authentication, and keeps one customer file you can export or redact in one place rather than five.