Hundreds of thousands of Australian small businesses may face annual risk assessments under new federal online safety laws. The proposed legislation could impact local businesses like hairdressers and cafes, adding to their regulatory burden. This includes tradies, who often rely on simple websites for customer engagement, further broadening the scope of affected businesses.
Small businesses face new compliance costs
The Council of Small Business Organisations Australia (COSBOA) is advocating for exemptions for low-risk businesses. Skye Cappuccio, COSBOA’s CEO, expressed concern that the Digital Duty of Care bill, introduced to Parliament on October 15, will increase compliance costs for small businesses. Cappuccio specifically noted that the bill, in its current form, could require hundreds of thousands of businesses to undergo annual audits, despite their low-risk nature.
The bill aims to strengthen online safety by requiring online services to prevent foreseeable harm to users. However, its broad definition of online services may include ordinary business websites, regardless of size or turnover. This broad scope has raised concerns about the proportionality of the regulatory burden on small businesses.
Compliance costs could reach thousands
While COSBOA has not calculated potential costs, Karl Morris, managing director of Goop Digital, warned that compliance could cost businesses thousands of dollars. Morris is concerned about the impact on the 800 websites managed by his agency, which serves various clients, including tradespeople, medical practices, funeral homes, accountants, and lawyers. He highlighted the potential for significant financial strain on these businesses, many of which operate on tight margins.
Related Post: Why Are Businesses Overcomplicating Basic CMMC Requirements Instead of Simplifying?
The proposed assessments would require businesses to document online safety risks, retain records for six years, and provide them to the eSafety Commissioner within 30 days if requested. Although external auditors are not mandatory, businesses may seek professional assistance, incurring additional costs. Morris questioned the necessity of such extensive requirements for low-risk websites, suggesting that the focus should be on regulating actual risks rather than imposing blanket measures.
Many small business websites serve as simple digital shopfronts, providing contact information and generating customer inquiries. Morris argues that requiring these businesses to undertake additional compliance work would not significantly address online safety risks associated with major digital platforms. He described these small businesses as “collateral damage” in the broader effort to regulate online safety.
The government has stated that low-risk websites would face minimal obligations, but the legislation lacks automatic exemptions for small businesses. COSBOA and Morris call for explicit exclusions for low-risk operators, such as businesses with fewer than 50 employees or annual turnover below $5 million. Cappuccio emphasized that a local hairdresser’s website, for example, poses minimal risk and should not be subject to the same regulatory requirements as larger platforms.
If passed, the legislation would provide a 12-month transition period before new obligations take effect. The Digital Duty of Care is part of a broader package of online safety reforms, which may also impact how businesses advertise online, engage with customers on social media, and manage their digital presence. Morris advocated for a risk-based approach, urging the government to focus regulatory efforts on high-risk entities rather than burdening small businesses with unnecessary compliance measures.