From 1 July 2026, a big change quietly lands on a lot of Central West businesses. Tranche 2 of Australia’s anti-money-laundering reforms brings real estate agents, accountants, conveyancers, lawyers and dealers in precious metals into the AML/CTF regime — and once you’re a “reporting entity”, the Privacy Act applies to how you handle personal information for those purposes, even if you turn over less than $3 million and have always relied on the small business exemption. As law firm HWL Ebsworth explains, the OAIC estimates more than 100,000 small businesses will be caught by this single change.

That’s a direct hit for Orange, Bathurst and Dubbo. The region runs on exactly the kinds of firms now in scope — independent accounting practices, family real estate agencies, and small law and conveyancing offices. Most have never had to think about the Australian Privacy Principles. Now they’ll be collecting and verifying driver licences and passports for customer due diligence, which is precisely the sensitive data the regulator cares about. The timing is sharp, too: the OAIC is already running its first privacy compliance sweep, and the Commissioner now has the power to issue infringement notices of up to $66,000 for something as basic as not having a compliant privacy policy.

You’ve got about five weeks. The practical steps: map what personal information you collect for AML/CTF checks; stop keeping full copies of ID documents — from 1 July you only need to record the minimum detail that proves you verified someone; publish a clear, compliant privacy policy; train your staff; and make sure you’ve got a data breach response plan. None of this is hard, but it doesn’t happen by itself.

If you’re a Central West firm working out what “Privacy Act compliant” actually looks like, our team works with regional financial and professional services businesses on exactly this — have a chat with us.