Most business websites collect some personal information, even if it is only a name and an email address from a contact form. Online stores go further and hold delivery addresses, order histories and phone numbers. A privacy policy tells visitors what you collect and what you do with it. For many businesses in Australia it is also a legal requirement.
The rules come from the Privacy Act 1988 and the Australian Privacy Principles. Not every small business is covered, so the first step is working out where you stand. This guide gives general information on who needs a policy, what it should cover and how to present it on your website.
Does the Privacy Act apply to your business?
The Privacy Act covers Australian Government agencies and many private sector organisations. The Office of the Australian Information Commissioner (OAIC) explains that a small business is one with an annual turnover of $3 million or less. Turnover here means all income from all sources. It does not include assets held, capital gains or proceeds from capital sales.
Many small businesses under that threshold are still covered. The OAIC lists several types of business that must comply whatever their turnover. Some of the most common are below.
- Health service providers.
- Businesses that trade in personal information.
- Contractors providing services under a Commonwealth contract.
- Operators of a residential tenancy database and credit reporting bodies.
- Businesses related to another business the Privacy Act covers.
- Small businesses that have chosen to opt in.
The opt in option is worth a thought even if you are not required to comply. The OAIC notes that opting in could bring benefits such as increased consumer confidence and trust. The full list of exceptions is on the OAIC page about small business and the Privacy Act. If you are unsure which side of the line you sit on, that page is the place to start.
What an APP privacy policy must cover
Australian Privacy Principle 1 deals with the open and transparent handling of personal information. Under APP 1.3, a business covered by the Act must have a clearly expressed and up to date privacy policy. APP 1.4 then sets out what the policy has to include. The OAIC summarises those points in its guide to developing an APP privacy policy.
The policy must explain the kinds of personal information you collect and hold. It must say how you collect that information and how you hold it. It also needs to set out the purposes for which you collect, hold, use and disclose it. These are the core facts any visitor would expect to find.
A policy must also tell people how they can access their personal information and ask for it to be corrected. It must explain how someone can complain if you breach the Australian Privacy Principles. Finally, it must say whether you are likely to disclose information to overseas recipients. Where practical, it should also name the countries where those recipients are likely to be.
That list is the minimum rather than the whole story. The OAIC notes that from 10 December 2026 covered businesses must also explain when a computer program makes or informs decisions that significantly affect people’s rights or interests. The OAIC says the policy should cover whatever else is needed to describe how you manage personal information. For a website, that may include the details collected through forms, accounts and online orders. If you run an online store, privacy sits alongside other housekeeping such as these SEO tips for a WordPress ecommerce store.
Writing a policy people can read
The OAIC encourages businesses to write for readers rather than treat the policy as a legal risk document. It suggests avoiding legal jargon, acronyms and in house terms. Use the active voice, short sentences and clear headings. Be specific and avoid vague words like “may” where you can.
A layered approach works well online. The OAIC describes linking first to a short summary, which then links prominently to the full policy. It suggests keeping the summary to no more than 500 words. The guide also says the policy should be understandable by someone aged 14.
Typical summary headings in the OAIC guide include scope, collection, disclosure, rights and choices, how to make a complaint and contact details. Using headings like these helps visitors find the answer they came for. Good structure is part of web design and the user experience on any page. A privacy policy is no exception. Test the draft on a few customers or staff before you publish it.
Publishing the policy on your website
APP 1.5 requires the policy to be available free of charge and in an appropriate form. If you have a website, the OAIC says the policy should be published there. It should be easy to download and accessible, including to people with a disability. A link in the footer of every page is one simple way to keep it within reach.
People may also ask for the policy in a different form, such as a printed copy. Under APP 1.6 you need to take reasonable steps to provide it in the form they ask for. Plan for this before the request arrives. A simple process saves time and shows customers you take their privacy seriously.
Your website is often where customers first judge how carefully you run your business. A clear policy that is easy to find adds to that impression. It sits naturally alongside the other trust signals of a professionally designed website. Keep the policy wording consistent with what your forms and checkout actually do.
Keep the policy up to date
A privacy policy is not a set and forget document. The OAIC says businesses should regularly review and update the policy so it reflects current practices. Review it whenever you add a new form, booking tool or mailing list to your site. A policy that describes old systems can mislead the people relying on it.
Changes to how your business is set up are also a good time to review your paperwork. That includes the privacy policy on your website. The post on business structures suitable for web designers outlines three common options. If you are unsure how the Privacy Act applies to your structure, speak with a qualified adviser.
State and territory privacy laws
The Privacy Act is a federal law, but it is not the only privacy law in Australia. The OAIC notes that the Act does not cover local, state or territory government agencies. Most states and territories have their own laws for their public sector. Western Australia has the Privacy and Information Sharing Act 2024, which the OAIC lists as starting on 1 July 2026.
Health information has extra layers in some places. In NSW, Victoria and the ACT, private health providers must comply with both federal and state or territory privacy laws when handling health information. Laws and processes differ between states and they change over time. Check the current rules for your state before relying on any summary.
Frequently asked questions
Does every small business website need a privacy policy?
Not every small business is covered by the Privacy Act. Businesses with an annual turnover of $3 million or less are often exempt, but there are many exceptions, including health service providers. A small business can also choose to opt in to the Act.
Can I copy a privacy policy from another website?
A copied policy is unlikely to describe how your own business handles information. APP 1.4 requires the policy to cover the kinds of information you collect and how you collect, hold, use and disclose it. Those details are specific to each business, so the policy needs to reflect your own practices.
Where should the privacy policy go on my website?
The OAIC says that if you have a website, the policy should be published there. It should be easy to download and accessible to people with a disability. A short summary that links to the full policy is one approach the OAIC describes.
How often should I update my privacy policy?
The OAIC says you should regularly review and update your policy. A good trigger is any change to the information you collect or the tools you use. Keeping it current means it stays accurate for the people who read it.
This article is general information only about Australian privacy rules and is not legal advice. Privacy laws and processes differ between states and territories and they change over time. For advice about your own business, speak with a qualified lawyer.