Australian migration agents 2026: OMARA Code, Privacy Act 1988 + APPs

The small business exemption under the Privacy Act 1988 applies to businesses with annual turnover below AUD 3 million, but the exemption is lost if the business (a) provides health services and holds health information (migration practices frequently do — medical certificates, HIV testing results for specified visas, mental health disclosures); (b) trades in personal information; (c) is a Commonwealth contractor; (d) is a credit provider or credit reporting body; (e) opts in to the Privacy Act coverage. A migration practice that handles even a small volume of health information (which is unavoidable in practice for permanent residence and specific temporary visa streams) technically loses the small business exemption for that data. Combined with the Privacy Act Review 2022 reforms progressively removing the small business exemption entirely, the safer posture for any migration practice — regardless of current turnover — is to design its operations for full Privacy Act compliance from the outset. OMARA Code of Conduct confidentiality obligations apply independently regardless of the Privacy Act status, so the substantive standards are similar in either case.

Not indefinitely, and not without appropriate security. APP 11 requires reasonable steps to protect personal information from unauthorised access, use, disclosure, and misuse; APP 4.3 requires destruction or de-identification of personal information no longer required for a purpose. OMARA Code of Conduct Clause 8 specifies file retention obligations (typically minimum seven years post-completion of the matter, longer for specific matters). Practical implication: WhatsApp chat history is not an appropriate long-term storage for sensitive documents. Best practice is: (a) receive the document via WhatsApp, save it immediately to the encrypted practice management system with appropriate access controls; (b) delete or archive the WhatsApp copy within a defined workflow window (some practices delete after client file is opened; others keep for the duration of the active matter and delete on file closure); (c) retain the master copy in the practice management system for the OMARA-required retention period; (d) securely destroy after the retention period. WhatsApp Business Platform archives via the vendor's cloud add another layer to consider — the DPA with the vendor should include commitments on data deletion aligned with the practice's retention policy. Client agreements should mention the document handling flow so clients understand and consent.

Yes, WhatsApp messages are admissible as electronic evidence subject to authentication and chain-of-custody considerations. The Evidence Act (Cth) and state equivalents govern admissibility; WhatsApp messages can be produced via export from the app (WhatsApp offers export as text or with media, and forensic tools can produce more detailed extractions). For the RMA using WhatsApp with clients, the practical implications are: (a) WhatsApp exchanges between agent and client can be produced by either party in the review — messages that appear to make representations to the Department, or that establish the timeline of instructions, are potentially relevant; (b) messages between agent and client that are candid discussions of case strategy may be subject to legal professional privilege only where the RMA is also a legal practitioner and the communication is for the purpose of legal advice — RMAs who are not lawyers do not have privilege in the same way and their communications may be discoverable; (c) messages that record fabrication of documents, coaching of applicants to deceive, or advice to withhold material facts from the Department are potentially incriminating and can trigger criminal and Code of Conduct consequences. The safer practice: professional and factual communication, no candid strategy discussions on WhatsApp that would be embarrassing if seen by a Tribunal member, retention of the WhatsApp record as part of the file, and separate confidential communication channels (in-person meetings, phone calls without recording) for strategic discussions where the RMA is not a lawyer with privilege coverage.

Under Section 38-190 of the A New Tax System (Goods and Services Tax) Act 1999, a supply is GST-free where it is a supply of a right or option to acquire something else that would be GST-free, or where it is a supply of a service to a non-resident who is not in Australia when the service is performed, and the service is not effectively used or enjoyed in Australia at that time. For migration services, the ATO's practical interpretation (subject to specific rulings) is that services provided to an offshore visa applicant preparing their application from outside Australia can be GST-free, but services provided to an onshore visa applicant, or services provided to a family member in Australia paying on behalf of an offshore applicant, may be taxable. The specific application depends on where the client physically is at the time of supply, who is paying, and where the service is effectively enjoyed. This is a technical area — every migration practice serving mixed onshore/offshore clientele should obtain professional accounting advice on the GST treatment. Documentation of the client's location at time of engagement, and of the payment source, is important. An invoice that incorrectly treats an onshore service as GST-free risks ATO reassessment; an invoice that incorrectly treats an offshore service as GST-taxable overcharges the client and may need refund. A WhatsApp platform integrated with practice management should be configured to prompt for onshore/offshore status at intake so the correct invoicing template flows through automatically.

Several progressive reforms are expected to take effect during 2024-2026. The most consequential for migration practice include: (a) removal of the small business exemption (progressively) — will bring all migration practices regardless of turnover under full Privacy Act coverage, aligning with the OMARA Code obligations; (b) direct right of action for individuals — currently individuals must complain to the OAIC which then decides whether to investigate; the reform will allow individuals to bring actions directly in the Federal Court for privacy breaches, materially increasing exposure; (c) statutory tort of serious invasions of privacy — creating a new cause of action in tort for serious privacy breaches, opening the door to damages claims; (d) tightening of consent standards toward GDPR-style specific, informed, unambiguous consent — will require reviewing existing client agreement and privacy policy language; (e) new obligations around children's data (relevant for migration matters involving minor children); (f) new mandatory data breach reporting timeframes potentially tightened from current "reasonable practicable time" to a defined period; (g) new right to erasure aligned with GDPR (with exceptions). A migration practice signing a multi-year WhatsApp platform contract in 2026 should choose a vendor with demonstrated capacity to adapt product features to these reforms as they land — a platform vendor with an EU/GDPR compliance track record is generally better positioned than one focused solely on lower-regulation markets.