Most tyre and automotive workshop owners have never had to think about Australian privacy laws, and for good reason. For decades, the Privacy Act simply did not apply to them. Turnover of three million dollars a year or less and you were exempt, which covers the overwhelming majority of independent workshops in this country.
That exemption still exists. What has changed is that it no longer does the job you think it does.
The exemption is real, and it’s still law
The Privacy Act small business exemption applies to businesses with an annual turnover of three million dollars or less. Despite a lot of noise suggesting otherwise, it hasn’t been repealed. The Government agreed in principle to remove it, but when the second tranche of privacy reforms went out for consultation in August 2026, removal wasn’t in the draft.
So if you have had an email from a software company or an IT provider telling you that every Australian business must comply with the full Privacy Act by December, that’s not what’s happening. The December date relates to new rules about automated decision-making, and those apply to businesses already covered by the Act.
None of which means your shop is in the clear.
What gets past the exemption
Since 10 June 2025, a person can sue directly for a serious invasion of privacy. It sits in Schedule 2 of the Privacy Act, and it reaches businesses the Act doesn’t otherwise cover. There is no small business exemption.
The customer has to show the invasion was intentional or reckless, and serious. It only covers conduct after June 2025. Those are real limits, and most workshops will never go near them.
But notice what is different. There’s no regulator in the middle deciding whether a complaint is worth chasing. A former customer who believes their details were mishandled can take you to court themselves, and the OAIC has no role in it.
The exemption has a hole that has been there all along. It falls away if your business provides services under a Commonwealth contract. Pick up federal government fleet work, and turnover stops protecting you, which is worth knowing before you chase that contract. State and council fleets don’t trigger it, so it’s worth knowing which kind of contract you’re bidding on.
Why this is landing on workshops now
Think about what sits in your system for a regular customer. Name, address, mobile number, rego, every service they’ve had with you going back years, and what they paid each time. None of that felt like sensitive information when you entered it. Put together, it is a detailed picture of where someone lives, what they drive and how they spend, assembled over years without anyone deciding to assemble it. A modern automotive CRM holds that on every customer on your books.
The three questions worth being able to answer
Forget the legislation for a minute. The practical test is whether you could answer a customer standing at your counter asking three things.
What do you hold about me? Where does it actually live? Who can see it?
Most workshops can’t answer the second one. The data is in the workshop management software; the software is somewhere, and somewhere is as precise as it gets. That’s the gap, and it is the same gap whether the person asking is a customer, a fleet manager running a procurement check, or a lawyer. We looked at the wider picture in our guide to automotive workshop software in 2026.
Good customer data privacy is not a compliance program. It is knowing where your records sit, limiting who in the shop can reach them, and being able to get a human on the phone when something goes wrong. If you want the formal version, the Australian Privacy Principles set out what a covered business has to do, and they are a reasonable checklist even if the Act does not apply to you.
Where COSTAR fits
Cloud-based mechanic workshop software keeps your customer records on somebody else’s servers. COSTAR does not work that way. It is installed locally, on the workshop’s own computers, so your records do not sit in someone else’s data centre. You can point at the machine your data is on.
That isn’t a security guarantee by itself. Local storage still needs backups, sensible access control and someone keeping an eye on it. What it gives you is a straight answer to the second question and control over who holds the keys.
Support matters just as much. Microhouse is an Australian company supporting Australian and New Zealand tyre and automotive businesses, so when something breaks at 7 am or a customer asks a question you can’t answer, you’re talking to someone working under the same laws you are.
The workshops that handle this well are not the ones with the most software. They are the ones running a system that records the job properly, so the answers are already there when someone asks.
Don’t let a data breach kill your business. Book a demo and see how COSTAR and Microhouse keep your customer data where you can account for it.
