From the privacy commissioner's website:
The private sector provisions of the Privacy Act apply to organisations (including not-for-profits) with an annual turnover of more than $3 million.
I doubt "religious exemption" will work in the area of privacy. It's not like the government is trying to interfere with a religion's autonomy or trying to tax them out of existence. Privacy is an emerging ineliable right that everyone can insist on. jwfacts, my money is on you, because you are simply asking for information that they have on you. In that case, the WTBTS cannot claim confidentiality.