ERP compliance checklist for Australia in 2026: STP Phase 2, Payday Super, Peppol and privacy

An ERP used in Australia in 2026 must, directly or through connected products, do five things well: report payroll to the ATO through Single Touch Payroll (STP) Phase 2; pay superannuation under Payday Super, which started on 1 July 2026 and requires super to be paid with each pay cycle; handle GST and BAS reporting; ideally send and receive Peppol e-invoices; and support your obligations under the Privacy Act 1988, including the Notifiable Data Breaches scheme. A product that falls short on any of these will need add-ons, workarounds or a separate system, and those cost money. This guide explains each requirement and the questions to ask vendors.

This guide is part of the ERP software pricing comparison overview. Rules change; check the official sources listed at the end before relying on any detail.

Single Touch Payroll Phase 2

STP requires employers to report salary, wages, PAYG withholding and super information to the ATO each time they pay employees, from their payroll software. Phase 2, which became mandatory from 1 January 2022 (with deferrals that software providers could arrange for their customers), expanded the data reported: income types, disaggregated gross pay (allowances, overtime, bonuses, salary sacrifice and similar components reported separately), and information that previously went on separate forms.

What to ask:

• Is the payroll module or connected payroll product STP Phase 2 enabled for Australia? Ask for written confirmation; the ATO lists STP-enabled products for software developers and employers.
• Are pay items mapped correctly to STP Phase 2 categories, and who does the mapping during implementation?
• How are corrections and finalisation at year end handled?

Many global ERPs do not run Australian payroll natively and integrate with a local payroll product. That separate subscription and the integration belong in your TCO.

Payday Super from 1 July 2026

From 1 July 2026 employers must pay employees' superannuation guarantee contributions at the same time as salary and wages, rather than quarterly. Based on the ATO's published guidance, contributions generally need to reach the employee's fund within seven business days of payday, with a longer period for some situations such as a new employee's first contribution. The superannuation guarantee rate is 12% of ordinary time earnings from 1 July 2025. The ATO's Small Business Superannuation Clearing House has been closed as part of the change, so businesses that used it need another payment channel, typically through payroll software or a commercial clearing house.

What this means for an ERP:

• Payroll must calculate super each pay run and create a super payment file or initiate payment for every cycle, weekly or fortnightly.
• Your clearing house or payment method must be able to keep up with the new timing.
• Reconciliation between payroll, bank and super payments now happens every pay cycle, not quarterly.
• Late or short payments can trigger the superannuation guarantee charge and penalties, so error alerts matter.

Check the detail, including transitional rules and the exact due-date method, on the ATO website; this guide summarises and may not reflect later changes. For payroll-specific comparisons, a dedicated payroll guide will go further than this ERP overview.

GST, BAS and other tax reporting

Any ERP sold in Australia should handle:

• GST tax codes for taxable, GST-free and input-taxed supplies, and imports;
• BAS reporting with drill-down from labels to transactions;
• PAYG withholding and, where relevant, PAYG instalments;
• fuel tax credits, wine equalisation tax or luxury car tax for businesses in those industries;
• state payroll tax reporting support, since each state and territory has its own thresholds and rules;
• taxable payments annual report (TPAR) data for businesses in industries where contractor payments must be reported.

Ask for a demonstration of a BAS from your own sample data, not a pre-built demo company.

Peppol e-invoicing

E-invoicing in Australia uses the Peppol framework, and the ATO is the Peppol Authority for Australia. An e-invoice is structured data sent from the seller's system to the buyer's system through accredited access points, identified by ABN; a PDF attached to an email is not an e-invoice. For businesses dealing with each other, adoption is voluntary at the time of writing, while Australian Government agencies have been moving towards e-invoicing as the default for receiving supplier invoices.

What to ask:

• Does the ERP send and receive Peppol e-invoices natively, or through a partner access point?
• Is there a per-invoice or monthly fee?
• Can received e-invoices flow straight into accounts payable approval?

If you sell to government, e-invoicing can speed up payment; check the current government payment policies on the official sites.

Privacy Act and data breach obligations

Organisations with annual turnover above $3 million, and some smaller businesses (for example, health service providers or businesses that trade in personal information), must comply with the Australian Privacy Principles. Covered businesses must also notify the OAIC and affected individuals of eligible data breaches under the Notifiable Data Breaches scheme. An ERP holds employee, customer and supplier personal information, so ask about access controls, audit logs, encryption, hosting location and breach notification commitments.

The Privacy and Other Legislation Amendment Act 2024 added a statutory tort for serious invasions of privacy (in effect from 10 June 2025) and new privacy-policy transparency requirements about automated decisions that use personal information, applying from 10 December 2026. If your ERP automates decisions that significantly affect individuals, such as credit holds on sole-trader customers, check your privacy policy. See privacy, data breaches and data location.

Record keeping

Businesses generally must keep tax records for five years. When you migrate ERPs, the old system's records must remain available in a readable form. Plan this as part of the implementation and migration scope and the exit plan.

Compliance questions for every vendor

Use the ERP buying checklist to record answers, and read USD pricing, FX and GST if the vendor bills from overseas.

Frequently asked questions

Does Payday Super apply to small businesses?

Yes. It applies to employers generally, including small businesses. Check the ATO's guidance for any transitional arrangements.

Is e-invoicing compulsory between businesses in Australia?

At the time of writing, business-to-business e-invoicing is voluntary. Check the ATO's eInvoicing pages for any changes.

Is my business covered by the Privacy Act?

Generally if annual turnover exceeds $3 million, or if you fall into a category covered regardless of size. The OAIC website explains the exceptions.

Who checks that the software is compliant?

You remain responsible for your obligations. Vendors confirm product capabilities; your implementation must configure them correctly.

Sources

• Australian Taxation Office — Single Touch Payroll Phase 2, Payday Super, GST, BAS and eInvoicing
• Office of the Australian Information Commissioner — Australian Privacy Principles and Notifiable Data Breaches
• Fair Work Ombudsman — pay and record-keeping obligations
• Treasury — background on Payday Super and privacy reforms