Does the privacy law apply to a small business?

There is a turnover threshold below which many obligations do not apply, and several categories of business are covered regardless of size - anyone handling health information among them. It is worth establishing which side you are on early, because the answer changes what the application has to be able to do rather than what your policy page says.

What does the breach scheme actually require of the software?

The obligation is to assess a suspected breach promptly and notify if it qualifies. The software's part is making assessment possible: knowing what was accessed, by whom and when. An application without that detail cannot answer the question inside the window, which turns a contained incident into a disclosed one.

Do Australian customers expect local hosting?

Often, and more strongly in government and health than elsewhere. Latency is the other half - a server in Europe adds a noticeable delay to every request from Sydney, which is felt in an interactive application well before anybody measures it.

Is the tax the simple part?

Comparatively, yes - one broad rate with a short list of exclusions. The requirements that catch people are about the document rather than the calculation: a compliant tax invoice has to contain specific fields, including your business number, and above a threshold the buyer's details as well.

Laravel in Australia

Laravel development services for Australian businesses

A breach notification scheme with a clock attached, real-time payments that arrive without being asked for, and a business register worth validating against. What an Australian Laravel build handles.

Updated September 22, 2026

Australia is an easy market to serve technically and an easy one to under-scope, because the differences are not where teams look for them. The tax is simpler than Europe's. The privacy regime has a deadline attached. And the payments arrive in a way that changes how orders are reconciled.

The breach scheme is a software requirement in disguise

The notifiable data breach scheme obliges an organisation to assess a suspected breach quickly and to notify the regulator and affected individuals where it is serious. The clock is short and it starts when you become aware of something, not when you finish investigating.

That is a legal obligation with an engineering precondition: you have to be able to find out what happened. An application that logs authentication but not access cannot say which records a compromised account read, and an organisation that cannot say is left disclosing the widest plausible scope.

The design that makes this answerable is unremarkable and has to exist before the incident:

Access to sensitive records logged with actor, record and timestamp, kept long enough to be useful and outside the database being protected.
Exports and bulk reads treated as events worth recording, because that is what exfiltration looks like.
An honest data inventory - what personal information exists, in which tables - so scope is a query rather than a guess.

None of it is expensive built in. All of it is impossible to reconstruct afterwards.

Real-time payments change reconciliation

Australia's instant payment infrastructure means money can arrive within seconds, addressed to an identifier rather than an account number. It is a push: the customer sends it, rather than you charging them.

The consequence for an order model is that payment confirmation is no longer a response to a request you made. It is an inbound event you have to match to an invoice, usually on a reference that a human typed and may have typed wrong.

So the work is matching logic and a queue for the ones that fail to match, with somebody able to resolve them - not a webhook handler that assumes success. Applications built around card payments arrive at this late, having modelled payment as a synchronous result.

Direct debits exist alongside and behave like direct debits anywhere: a mandate with a lifecycle, and a return window that makes received different from settled.

The business register is worth using

Australian businesses have a public identifier, and the register that holds it is queryable. For business-to-business products that means validating the number at signup, confirming the trading name and knowing whether the entity is registered for tax - all before a human has to check anything.

It also matters for invoicing. A compliant tax invoice must carry your business number, and above a threshold it must identify the buyer. Those are format requirements on a generated document, which means they belong in the template and in a test, not in somebody's memory.

Distance is a real constraint

Sydney is a long way from most hosting regions, and the round trip is felt. For a content site it is noise; for an interactive application with a chatty request pattern it compounds, and it is usually cheaper to fix by serving from an Australian region than by optimising the application.

Where customers are government or health, local hosting is frequently a requirement rather than a preference, which makes it a decision to take before choosing infrastructure.

Working with us

We work remotely from Ankara. The time difference is the awkward part of this arrangement and we would rather be direct about it: there is little overlap with the Australian working day. What makes it work is that the engagement is written rather than synchronous - reviewable pull requests, written updates, and one scheduled call at an hour that suits you rather than an expectation of being available on demand.

The engineering is our usual application development and integration work, with the access logging designed in at the start because the breach scheme makes it a capability rather than a nicety.

Reconciling real-time payments is mostly a schema question, and amounts, timestamps and the decisions you cannot take back is where we set those out. The breach clock is only as good as the access log behind it, which turns out to be an authorisation question.

Invoicing and payment. In US dollars, by bank transfer to an IBAN. Codefacture Yazılım A.Ş. is a Turkish company and the invoice carries no Turkish VAT under the export-of-services exemption. We are not registered for GST in Australia, so none is charged.