Does the Digital Duty of Care apply to my small business?
Possibly. Nobody can say for sure until the law is final. As introduced, the bill has no small business exemption and it reaches many ordinary websites. The duty is about keeping users safe, though, so a brochure site with a contact form carries far less risk than a forum, a booking app or a site where customers post.
Last updated
The short answer
As introduced in October 2026, the Digital Duty of Care Bill has no revenue, staff or user threshold, so small businesses that run an online service, including many websites, could be covered. The Minister would be able to exempt services that pose little risk to Australian users. The council of small business organisations, COSBOA, has asked for ordinary low-risk business websites to be exempt. Small businesses whose websites let visitors post, chat, upload, review, message each other or use AI tools are the most likely to need to act.
Why small business isn't automatically left out
The bill applies to 'online services', which include designated internet services. Law firm Allens notes that this covers many website operators, and that there is no general small business carve-out. COSBOA says the bill as drafted doesn't include a revenue, headcount or user threshold, and that while the Minister can exempt low-risk services, nothing is yet in place or announced. The duty is about harm to users, so what your website lets people do matters more than how big your business is.
Features that raise the risk
Comments, reviews and forums
Anywhere visitors can post words or pictures other people will see.
Chat and messaging
Live chat between customers, member messaging or group chats on your site or app.
Uploads
Photo, video or file uploads that other users can view or download.
AI chatbots and generators
AI tools on your site that create text or images, especially if users can share what they make.
Services for young people
Sport clubs, tutoring, childcare, youth programs or games where under-18s have accounts or talk to others.
Member areas and communities
Logged-in areas where members can see each other's profiles, posts or activity.
Lower-risk examples
- A brochure website with service pages, a contact form and no way for visitors to post publicly.
- An online shop where customers buy, but can't post reviews or message each other.
- A booking form that only the business sees.
- Even these may technically be online services under the bill. Whether they'd need a written risk assessment will depend on the final law, any exemptions and eSafety's guidance.
What a small business can do now
- List what your site and apps let people do. Comments, reviews, uploads, chat, member profiles, AI tools and any plugins that add them.
- Switch off what you don't use. Old comment sections, forums nobody visits and unused plugins add risk for no benefit. Removing them also makes the site more secure.
- Moderate what you keep. Make sure someone reviews posts, there's a way to report content and you can remove it quickly.
- Watch for the final law and eSafety guidance. If the bill passes, there would be 12 months before the duty starts. We'll update this page as it moves.
How WaTo can help
- Our website security and compliance audit lists every feature on your site that lets visitors post, upload, chat or use AI, alongside the privacy and security checks.
- We can remove features you don't need, add moderation and reporting to the ones you keep, and keep the site updated through website maintenance.
- We're not lawyers. If your business runs a community, app or service for young people, get legal advice once the final law is known.
Small business Digital Duty of Care questions
Is there a small business exemption?
Not as the bill was introduced. There's no revenue, staff or user threshold. The Minister could exempt low-risk services, and COSBOA has asked for low-risk small business websites to be exempt, but no exemption has been announced.
My website is just a few pages and a contact form. Do I need to do anything?
Not yet. The bill isn't law, and a site where visitors can't post or interact with each other poses little risk. It's still worth writing down what your site does, in case the final law or eSafety guidance asks small sites for a simple record.
We have Google reviews and a Facebook page. Are those covered?
Those platforms are run by Google and Meta, so the duty would mainly fall on them. Reviews and comments hosted on your own website are a different matter.
When would it start?
If the bill passes, the duty would start 12 months after Royal Assent. Some takedown changes would start the day after.
What are the penalties?
Up to $109.2 million for a company under the bill as introduced. Those are maximums. The eSafety Commissioner would also be able to issue warnings and directions to fix problems.
How WaTo can help with this
Guides on this topic
- The Digital Duty of Care, explained
- Digital Duty of Care risk assessment: what to include
- Website compliance checklist for Australian small businesses
- Is my website safe?
Sources & references
- COSBOA: New online safety laws could create new hurdles for small business
- Allens: Australia's digital duty of care, what the draft bill means for online services (September 2026)
- Department of Infrastructure: Digital Duty of Care
- Johnson Winter Slattery: Australia's proposed digital duty of care, what online services need to know
WaTo Consulting. Last reviewed 2026-11-07. Review after the Senate committee reports (due 20 November 2026), after the Senate vote, and when any exemption is announced.
Not sure what your website lets people do?
We'll list the features that matter for the Digital Duty of Care and tell you which ones you can switch off.
Mon to Fri, 8:30am to 5pm
