Almost every business website collects some personal information. A contact form collects names and emails. An online store collects addresses and order details. Analytics and advertising tools collect information about how visitors use the site. So does your website need a privacy policy? For many businesses the answer is yes, and even where it isn’t strictly required, it is good practice.
This guide explains when a privacy policy is required in Australia, what it should cover and how to keep it accurate. It is general information, not legal advice.
When a privacy policy is required
The Privacy Act 1988 and the Australian Privacy Principles (APPs) apply to many organisations. Businesses covered by the Act must have a clearly expressed and up-to-date privacy policy.
Many small businesses with an annual turnover of $3 million or less are currently exempt. But some small businesses are covered regardless of turnover, including:
- Health service providers, such as clinics, allied health and some wellness businesses.
- Businesses that trade in personal information.
- Contractors providing services under Commonwealth contracts.
- Businesses that have chosen to opt in to the Act.
Reform of the small business exemption has been proposed, so check the current position with the Office of the Australian Information Commissioner (OAIC).
Why it is worth having one anyway
- Platforms and tools often require it. Advertising platforms, app stores, payment providers and some plugins expect a privacy policy if you collect personal information.
- Customers expect it. A clear policy builds trust, particularly for online stores and booking forms.
- It prepares you for change. If your business grows or the rules change, you already have the basics in place.
What an APP privacy policy should cover
Under APP 1, a privacy policy must cover:
- The kinds of personal information you collect and hold.
- How you collect and hold it.
- The purposes for which you collect, hold, use and disclose it.
- How people can access their personal information and ask for it to be corrected.
- How people can complain about a breach of the APPs, and how you will deal with the complaint.
- Whether you are likely to disclose personal information to overseas recipients and, if practical, the countries involved.
The policy must be available free of charge and in an appropriate form. For most businesses, that means publishing it on the website, usually linked from the footer.
Website-specific things to include
- Forms: what you collect through contact, quote and booking forms, and what you do with it.
- Analytics: that you use tools such as Google Analytics to understand how people use the site.
- Cookies and advertising: whether you use cookies, pixels or tags for advertising and retargeting. See our guide to retargeting ads.
- Email marketing: how people can unsubscribe. See email marketing and the Spam Act.
- Third-party services: booking systems, payment providers, email platforms and AI tools that process visitors’ information, some of which may store data overseas.
- Contact details for privacy questions.
Common mistakes
Copying another business’s policy
A copied policy rarely matches what your business actually does, and it may describe practices you don’t follow. It can also breach copyright.
Setting and forgetting
Every time you add a new tool, such as a chatbot, a booking system or an advertising pixel, check whether the policy needs updating. Our article on website chatbots notes that chatbot conversations often contain personal details.
Collecting more than you need
The simplest way to reduce privacy risk is to collect less. Ask only for the information you actually use, and delete what you no longer need.
Keep information secure
A privacy policy is only a description. The practices behind it matter more: secure forms, updated software, strong passwords and limited access to customer data. See what website maintenance involves.
Need help with your website’s privacy setup?
Madexify helps small businesses across Pakenham, Officer, Beaconsfield, Berwick, Narre Warren, Cranbourne, Clyde and Bunyip review what their website collects, set up consent tools and keep privacy pages in step with the tools they use. For legal advice on your obligations, speak with a lawyer. See our services, or contact us to review your website.
Sources: OAIC: APP guidelines, chapter 1; OAIC: small business. Accessed 26 September 2026. This article is general information, not legal advice.
This article is part of our Website Security and Tech Guide. Browse all our guides on the guides page.
