Hundreds of thousands of Australian small businesses could be forced to undertake annual risk assessments under proposed federal online safety laws, potentially exposing even local hairdressers, cafes and tradies to new costs and regulations.
The Council of Small Business Organisations Australia (COSBOA) is calling for exemptions for low-risk businesses, warning the proposed laws could add to an already heavy regulatory burden.
Related Article Block Placeholder Article ID: 346829
The federal government’s proposed Digital Duty of Care legislation, introduced to Parliament on October 15, aims to strengthen online safety by requiring covered online services to take steps to prevent foreseeable harm to users.
The bill covers broadly defined online services, potentially including ordinary business websites, and does not automatically exempt operators based on their size or turnover.
COSBOA CEO Skye Cappuccio told SmartCompany that if the draft bill passes in its current form, the number of businesses needed to under annual audits will be in the hundreds of thousands.
“We are very concerned that, as drafted, the bill will increase the compliance burden on small businesses that are exceedingly low risk,” Cappuccio said.
Smarter business news. Straight to your inbox.
For startup founders, small businesses and leaders. Build sharper instincts and better strategy by learning from Australia’s smartest business minds. Sign up for free.
By continuing, you agree to our Terms & Conditions and Privacy Policy.
Compliance costs could run into thousands
COSBOA said it had not calculated the potential costs and is calling on the government to undertake and publish an assessment.
But Karl Morris, managing director of digital agency Goop Digital and deputy chair of the Geelong Chamber of Commerce, warned compliance costs could be substantial for individual businesses.
“We’re thinking probably a couple of hundred bucks, but it could be thousands,” Morris told SmartCompany.
Morris is concerned the legislation could affect all 800 websites managed by his digital agency, whose clients range from tradespeople and medical practices to funeral homes, accountants and lawyers.
Morris questioned how extensive the assessments would need to be and whether businesses seeking professional assistance would face additional costs.
As they stand, the proposed assessments would not automatically require businesses to hire external auditors. Covered operators would be required to document their online safety risks, retain records for six years and provide them to the eSafety Commissioner within 30 days if requested.
Morris acknowledged his agency could potentially profit by offering compliance assessments to clients seeking professional assistance, but questioned the need to require very small businesses to tick such boxes.
For many of his clients, websites serve primarily as digital shopfronts, providing contact information and generating customer enquiries.
“Most of the websites, they’re almost set and forget,” he said.
Related Article Block Placeholder Article ID: 347132
Morris argued that requiring such small businesses to undertake additional compliance work would do little to address the online safety risks associated with major digital platforms.
“[Small businesses] are literally collateral damage in the whole thing,” he said.
Calls for small business exemptions
The government has said low-risk websites would face minimal obligations, but the proposed legislation does not contain an automatic exemption for small businesses. For this reason, COSBOA wants low-risk operators explicitly excluded from annual risk assessments.
“A local hairdresser’s website is incredibly low risk and additional requirements such as annual risk assessments don’t make sense,” Cappuccio said.
Morris also called for exemptions for businesses with fewer than 50 employees or annual turnover below $5 million.
“Regulate the risk,” Morris said. “Don’t regulate every business that has a website.”
If passed, the legislation would provide a 12-month transition period before the new obligations take effect.
The proposed Digital Duty of Care is part of a broader package of online safety reforms, which could also affect how businesses advertise online, engage with customers on social media, and manage their digital presence.