An important consideration for an organisation entering into a contract with another organisation involving the collection, storage, use or disclosure of personal information will be whether the Privacy Act 1988 (Cth) (the Privacy Act) covers the contractor. Generally, a business with a turnover of $3 million or less is exempted from the operation of the Privacy Act.136 The small business contractor would thus be exempt from having to comply with the National Privacy Principles (NPPs) which set out guidelines for handling personal information.