Customer Details and Reviews: What Australian Privacy Law Expects of a Small Business

Somewhere in your business right now there's a list. A spreadsheet, a notes app, the contacts on the work phone. Names and mobile numbers — the thing that lets you text a customer after the job to ask how you went.

That list is personal information. Nothing dramatic follows from that sentence — but there are expectations about how you look after it, and they're easier to meet than most owners assume. Here's what good handling looks like for a business your size.

Six things the law is driving at

Australia's privacy rules for businesses are built on a set of principles — the Australian Privacy Principles, set out by the Office of the Australian Information Commissioner — rather than a rulebook of exact instructions. For a customer list used to ask for reviews, they come down to six habits.

Collect only what you need. A first name and a mobile number is enough to ask for a review. If you don't need it for the job or the ask, don't collect it.

Tell people what it's for. When someone gives you their number, they should have a fair idea of what you'll do with it. "We'll text you when we're on our way, and we might text afterwards to ask how we did" is enough. No policy document, no small print — one honest line.

Keep it secure. A password on the device, a login that isn't shared, a list that lives in one place instead of six.

Don't use it for something unrelated. The number was given so you could do the job and follow up on it. That's not a licence to add it to a marketing blast, lend it to a mate's business or hand it to a lead-gen outfit. It also isn't a tool for choosing who gets asked — the same customers, the same neutral invitation.

Let people out. If a customer says stop, that's the end of it. More on doing that properly below.

Don't keep it forever. If someone hasn't been a customer for years, there's no reason for their number to still be on a device.

There's nothing hard in that list. Do those six and you've covered most of what the principles ask of a business your size.

Does this even apply to me? (Or: can I store customer phone numbers?)

Yes, you can store customer phone numbers — you'd struggle to run a business otherwise. What owners usually mean is whether the Privacy Act applies to a business as small as theirs, and the honest answer is: it's fiddly.

There's a turnover-based threshold below which many small businesses aren't covered, and it has been under reform for some time — the OAIC has publicly backed removing it as part of the wider review of the Act. Some businesses are covered regardless of turnover, depending on what they do and what they hold. The OAIC's small-business guidance is the place to check where you sit today.

Our advice is simpler than the threshold: behave as though it applies. Working out whether you're exempt takes longer than handling six principles well, the exemption is on the reform agenda, and "we're small so it doesn't apply" is a weaker footing than it sounds if a customer asks why their number ended up somewhere it shouldn't have.

One group should assume it applies now: if your business provides a health service and holds health information — a physio, a podiatrist, a psychology practice — that information sits in a stricter category and the Act covers you regardless of size, so read the OAIC's guidance for health service providers rather than this article.

The one line that does two jobs

If you've read our piece on texting customers for reviews, you'll know the Spam Act wants the customer's consent before a review request goes out, and that the cleanest way to get it is one line on the quote, booking form or invoice. Here's the happy coincidence: that same line is also how you tell the customer what their number is for — which is what the privacy principles ask of you at the moment you collect it. One sentence at intake, and you've covered both. We won't re-explain the Spam Act side here; that article does it properly.

Keep it somewhere sensible

This is where lists actually go wrong — not in the law, but on a Tuesday afternoon.

Who can see it? In a small team the answer is often "everyone, because it's in the shared drive". Ask instead who needs to. Fewer people with access means fewer copies floating around.

What happens when someone leaves? If the customer list lived in a staff member's phone contacts, or they exported it to their own laptop to "work from home", it walks out the door with them. Make it a habit: when someone finishes up, their access ends the same day — and the list was on a business system, not a personal device, to begin with.

The personal spreadsheet. Someone exports the list to tidy it up, and now there's a second copy — on a personal account, in a downloads folder, attached to an email. Each extra copy is another thing to secure, another thing to update when a customer opts out, another thing to forget. One list, one place.

Honour the opt-out everywhere. A customer replies STOP to a review request. In the tool that received it, they're marked as opted out — good. But their number is still on the spreadsheet, still in the work phone, still on the newsletter list. Six weeks later a text goes out from somewhere else, and now the customer is certain you don't listen. An opt-out has to reach each copy, and it has to be permanent. The easiest way to make that true is to have fewer copies.

Tidy it once a year. Customers you haven't worked for in years, numbers that bounce, duplicates. A shorter list is easier to protect and easier to keep honest.

Strip the law out of this article and this section still stands. That's the point — good handling is mostly good housekeeping.

Where a system helps

Most of the above falls over because it relies on someone remembering, across several tools and several people, each time. That's the gap Gold Reviews is built for. The customer's consent is recorded against each job before a text goes out; each review request carries an opt-out line; when a customer replies STOP, that's recorded and honoured on later sends; and the customer list lives in one place, on the platform, rather than scattered across personal phones and spreadsheets. What you do with your list beyond that stays your decision — the system makes the tidy way the default way and keeps the record. How we handle information on our side is set out in our own privacy policy.

This is general information, not legal advice — for your own situation, check the OAIC's guidance or talk to your adviser.

You've already got the list. Handled well, it's the quiet engine behind the reviews that bring in the next customer. See what Gold Reviews costs.

This article is general information for Australian small businesses, not legal advice. Primary source: Australian Privacy Principles — OAIC.