The 2027 compliance calendar for Australian businesses

Most business compliance calendars in Australia track tax and payroll. The other legal dates for the next 12 months sit with different regulators: privacy policies must describe certain automated decisions from 10 December 2026, the unfair trading practices law commences on 1 July 2027, and mandatory climate reporting reaches more mid-sized companies for reporting periods starting on or after that date.

If you run a business of 20 to 200 people, these changes arrive from the OAIC, the ACCC, Treasury, ASIC, Home Affairs and the Reserve Bank, often without anyone in your team whose job is to track them. This article sets out one non-tax business compliance calendar for 2027 and separates law in force, passed law and proposals.

Tax and payroll dates are left to your accountant. Wage, award and Fair Work changes are covered in our compliance updates.

Your compliance calendar at a glance

Status matters as much as the date: prepare for confirmed obligations and assess proposals separately. Suggested owners and internal deadlines below are planning choices, not additional legal requirements.

Copy this table into your planning document and name an owner for every row that applies to you.

Two changes already in effect

Since 30 May 2025, a business with annual turnover over $3 million must report a ransomware or cyber extortion payment within 72 hours of making it, or of becoming aware of a payment made on its behalf. Home Affairs has taken a more active compliance approach since 1 January 2026 (Home Affairs).

Following the RBA's review, eftpos, Mastercard, Visa, American Express and UnionPay introduced no-surcharge rules from 1 October 2026. PayPal's rule took effect on 5 October 2026. The RBA recognises exceptions under network rules and under law or regulation, so check the rules for your payment arrangements before deciding whether a particular charge remains permitted (RBA).

Check invoices, price displays and payment terminals against the applicable no-surcharge rules and exceptions. Add the 72-hour reporting step to your incident response plan if your business is covered.

For the contract and invoicing implications, read what businesses need to change about card surcharges.

Privacy policies and automated decisions, before 10 December

From 10 December 2026, businesses covered by the Privacy Act must explain in their privacy policy when a computer program makes, or does something substantially and directly related to making, a decision that could reasonably be expected to significantly affect a person's rights or interests, and personal information is used to run it. The policy must describe the kinds of personal information used and the kinds of decisions involved (OAIC).

The OAIC published its fact sheet, a flowchart and updated APP 1 guidelines on 30 September 2026. The Privacy Act generally covers businesses with annual turnover of more than $3 million in any financial year since 2002, plus some smaller ones, such as health service providers (OAIC).

List the decisions your systems make about customers and staff, and update your privacy policy before 10 December 2026.

What the ACCC is watching this financial year

ACCC priorities are not law, but they show where enforcement attention will go. The ACCC published its 2026–27 compliance and enforcement priorities on 19 February 2026 (ACCC). Those most relevant to mid-sized businesses include (ACCC factsheet):

• unfair contract terms in consumer and small business contracts, with a focus on harmful cancellation terms, including those associated with automatic renewals, early termination fee clauses and non-cancellation clauses

• environmental and sustainability claims, with a focus on greenwashing

• misleading pricing practices in the supermarket and retail sectors.

Proposing, using or relying on unfair terms in covered standard form consumer or small business contracts can attract penalties. The strengthened rules apply to contracts made or renewed on or after 9 November 2023, and to terms added or varied from that date (ACCC).

Review the renewal, cancellation and termination fee clauses in your standard form contracts this quarter.

The unfair trading practices law commences on 1 July

The Competition and Consumer Amendment (Unfair Trading Practices) Act 2026 received assent on 6 July 2026, and the whole Act commences on 1 July 2027 (Federal Register of Legislation). It adds three sets of rules to the Australian Consumer Law (Act, Schedule 1):

• A general prohibition on unfair trading practices toward consumers. It does not apply where the customer is a body corporate, or where the supply is in the course of the customer carrying on a business.

• Drip pricing rules for goods and services ordinarily acquired for personal, domestic or household use. Transaction-based charges must be disclosed alongside the base price.

• Subscription contract rules: key information when the offer is made, notices during the subscription for contracts prescribed by regulations, and a straightforward way to cancel. These can also protect a small business subscriber (fewer than 100 employees, or turnover under $10 million in its last income year) where the contract is a standard form contract.

Not every recurring arrangement is covered. Section 48C excludes leases, real-property licences, hire-purchase, instalment-payment contracts, childcare and specified school tuition, and allows further exclusions by regulation. For earlier contracts, the ongoing notice and cancellation rules apply when a renewal, extension, continuation or variation takes effect on or after commencement, as specified in section 312 (Act).

Test every consumer checkout and cancellation journey, and fix the gaps before 1 July 2027.

Climate reporting reaches mid-sized companies and their suppliers

Group 3 of mandatory sustainability reporting under the Corporations Act starts with annual reporting periods commencing on or after 1 July 2027 (ASIC RG 280, Table 2). A company that must prepare an annual financial report under Chapter 2M falls in Group 3 if it and the entities it controls meet two of three tests: consolidated revenue of $50 million or more, consolidated gross assets of $25 million or more, or 100 or more employees at the end of the financial year.

A company with 100 to 200 staff can therefore be in scope if it also meets the revenue or gross assets test. A Group 3 entity that determines it has no material climate-related financial risks or opportunities can lodge a statement saying so, explaining how it made that determination (RG 280.73–280.74).

If your business is not covered, larger customers may still ask for information to meet their own obligations. ASIC expects that, in many cases, they will use estimates and industry averages instead (ASIC).

Test your company against the three thresholds for the year from 1 July 2027, and name who answers customer emissions questionnaires.

Proposals to watch, not yet law

The Attorney-General's Department consulted on an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 from 31 August to 18 September 2026. The department says the Bill "remains subject to further consideration by government" (AGD). The consultation material does not establish an operative commencement date. Check parliamentary developments before relying on it for planning.

Treasury consulted from 3 June to 10 July 2026 on extending unfair trading practices protections to small businesses when they buy goods and services. Submissions were published on 18 September 2026 (Treasury). The consultation is a proposal to monitor, not a confirmed new obligation in this calendar.

Monitor both monthly, assess the likely business impact and prepare contingencies where useful. Confirm the final scope and commencement dates before treating a proposal as a legal obligation.

The 1 July check

Many amounts and thresholds change at the start of a financial year. On 1 July 2026, for example, the Commonwealth penalty unit rose to $364 for offences committed on or after that date (Federal Register of Legislation).

In June 2027, check each regulator for amounts that change on 1 July before you update policies, contracts or training material.

A practical workflow for your compliance calendar

1. Mark the rows that apply. Check your turnover, headcount and customer types.

2. Name one owner per row. Choose the person who can change the process, not only report on it.

3. Set an internal deadline. Allow at least four weeks before each legal date for review and sign-off.

4. Record the source. Keep the government link and the date you checked it beside each item.

5. Review watch items monthly. Plan contingencies early; move a proposal into the confirmed-obligations calendar only when the law and its commencement are settled.

6. Report quarterly. Give the leadership team a one-page status of every row.

7. Flag specialist advice early. Note which items need a lawyer, accountant or climate specialist.

Turn the dates into contract checks

When a change affects the way you charge, renew or cancel, check the agreement as well as the payment screen. Put the relevant customer terms, supplier agreement or subscription contract beside the calendar and identify which clauses need review, who owns the changes and when they must be approved.

Contractam helps Australian businesses analyse agreements, identify risks and improve contract wording. Use it to examine the terms you need to change, with the final decision staying with your business and specialist advice where needed.

This article provides general information only and is not legal advice. The requirements that apply depend on your business and circumstances. Initial research: 17 October 2026; corrections checked 18–19 October 2026.

---