Yes, in some form. Even a one-page policy counts. Formal governance becomes non-negotiable once you hold customer data, operate under the Privacy Act, or have more than a couple of people creating and saving business records.
The short answer
Yes, in some form. Even a single page counts as a legitimate starting point. Formal information governance becomes non-negotiable once your business holds customer data, operates under the Privacy Act, or has grown past one or two people creating and saving business records without any shared system between them.
Why “we’re too small for this” doesn’t hold up
The Australian Privacy Act applies to a meaningful number of small businesses handling personal information, not just large corporations, there are exemptions based on annual turnover, but exceptions to those exemptions exist too, particularly for businesses that trade in personal information or provide health services. Assuming you’re exempt without checking is a common and avoidable risk.
Beyond legal exposure, there’s a more practical reason informal governance breaks down: it depends entirely on shared, unwritten understanding. That works reasonably well when it’s just the founder and one or two long-serving staff who’ve absorbed the informal rules over time. It stops working the moment someone new joins, or someone who held that knowledge leaves. What felt like “we all just know how this works” turns out to have been one or two people’s memory the whole time.
What minimum viable governance actually looks like
Formal doesn’t have to mean complicated. A useful starting policy fits on a single page and covers four things: what types of information you keep, where each type is stored, how long each type needs to be retained, and who’s accountable for making sure that actually happens. That’s enough to give a new hire a clear starting point, give an auditor something to review, and give your own team a shared reference point instead of relying on institutional memory.
When to formalise, and why not to wait
The practical trigger point is size, not revenue or industry: once more than one or two people are creating and saving records, informal knowledge stops scaling reliably. Every additional person is another point where the informal system can quietly diverge from how it’s supposed to work.
It’s tempting to treat this as something to deal with later, particularly under audit pressure or after a near-miss. In practice, it’s considerably cheaper and less stressful to write a basic policy now, while there’s no urgency attached to it, than to reconstruct one under pressure, trying to document what “should have been happening all along” after the fact is a harder exercise than writing it down in advance.
Also worth knowing
- The Australian Privacy Act applies to many small businesses handling personal information, not just large ones.
- Informal ‘everyone just knows’ governance breaks down as soon as someone leaves or a new hire joins.
- Formal doesn’t mean complex. A short written policy is a legitimate starting point.