Is there a small business exemption from the Digital Duty of Care?

What does the Bill say about exemptions?

Section 25B of the Bill lets the Minister exempt an online service, or a class of online services, from some or all of the duty. The Minister must be satisfied the service poses little risk to users in Australia.

• The exemption would be made by legislative instrument, after the Bill becomes law.
• It can cover the whole duty or only part of it. The Bill's own example is an exemption from the risk assessment requirement.
• It can come with conditions.

Is the exemption based on business size?

No. The Bill's test is risk, not size. It does not mention turnover, staff numbers or user numbers. A small business whose site has higher-risk features would not qualify just because it is small.

What has the Government said about small business websites?

In its submission to the Senate inquiry, the Department said the duty is designed to be proportionate, so lower-risk services would have fewer obligations.

The Department expects the eSafety Commissioner to set different forms of risk assessment for low-risk through to high-risk services. For very low and low-risk services, it says the burden is intended to be minimal and would likely mean answering a small number of questions to confirm the service does not host or enable higher-risk material, conduct or features.

This is a statement of what the Department expects. It is not in the Bill.

What has eSafety said?

• Lower-risk services would be treated differently. eSafety says it envisages a risk-based approach, with different expectations for lower-risk services and more required where a service has higher-risk features.
• The risk assessment materials come first. eSafety aims to publish them at least six months before the requirement starts, after public consultation.
• Guidance is not binding. eSafety notes that its regulatory guidance would not be enforceable.

What did eSafety and the Department tell the Senate hearing?

At the Senate committee hearing on 10 November 2026, a senator asked whether small business websites used to sell products, engage customers or take bookings would be caught by the risk assessment requirement. Both the eSafety Commissioner and the Department answered.

• eSafety is not focused on small business websites. The Commissioner said eSafety concentrates on high-risk, high-harm services, where being online is the product itself, and not on small businesses that have a web presence.
• eSafety plans to spell out who is low risk. It said its guidance and its statement of enforcement priorities would set out criteria for the lowest-risk services. The early criteria it named were no interaction between users, no user messaging, no interaction between adults and children, and no AI chatbot.
• eSafety has met small business groups and said it would consult small business again before settling the criteria.
• The Department expects most websites to be low risk. It described the low-risk assessment as a simple checkbox process: if a site answers no to questions about things like pornography, chatbots and user-to-user interaction, the assessment is done.
• A draft was requested. The senator asked eSafety and the Department to give the committee a preliminary draft of the guidance or priorities.

These are statements of intent. They do not change the Bill, which still has no small business exemption and still applies the risk assessment requirement to every covered service. This account is drawn from the hearing broadcast. We will check it against the official Hansard transcript when it is published.

What are small business groups asking for?

The Council of Small Business Organisations Australia (COSBOA) has asked the Senate committee for an exemption written into the Act itself.

• What from: mandatory written risk assessments. COSBOA is not asking for small businesses to be exempt from the duty as a whole.
• Who for: low-risk small business online services, judged on both business size and the risk of the service.
• Possible thresholds: COSBOA suggests annual turnover under $10 million or fewer than 50 full-time equivalent staff.
• Why in the Act: so small businesses have certainty from day one and do not wait on a later ministerial decision.
• Not for everyone: high-risk services, such as those mainly providing pornography, would stay covered whatever the size of the operator.

The Digital Industry Group (DIGI) also supports a clear exemption or safe harbour for low-risk services in the Act.

Is there a precedent for an exemption like this?

COSBOA points to one. Under an existing eSafety industry standard for designated internet services, some pre-assessed general purpose services do not have to do certain risk assessments. That standard would be repealed when the duty starts, so the exemption in it would not carry over automatically.

Which websites are likely to count as low risk?

Nobody has defined this yet. The submissions and the hearing evidence point to the same features as the ones that raise risk:

• public uploads by users
• users interacting with or messaging each other
• adults and children interacting
• an AI chatbot
• distributing content to an audience
• children being exposed to harmful material.

On our reading, a website with none of these, such as a tradesperson's site with a description of services and a booking form, is the kind most likely to be treated as low risk. Check where your site is likely to sit.

When will we know?

We update the status page at each step.

What should a small business do in the meantime?

Assume your website is covered, and keep the work small. Note which features your site has, especially reviews, forums, uploads, chatbots and child users. That list is the starting point for whatever form the risk assessment ends up taking.

Last updated 14 November 2026