Is a privacy policy a legal requirement for a small business?
It depends on whether the Privacy Act 1988 covers your business.
The Office of the Australian Information Commissioner (OAIC) says most small businesses are not covered, but some are. Its small business page defines a small business as one with an annual turnover of $3 million or less. Turnover here means all income from all sources. It does not include assets held, capital gains or proceeds of capital sales.
If the Act covers you, you must follow the Australian Privacy Principles. The OAIC's page on what a privacy policy is says any organisation the Act covers must have a privacy policy.
So the first job is not writing a policy. It is working out which side of the line you are on.
Which small businesses are covered whatever their turnover?
The OAIC lists several kinds of business that the Privacy Act covers regardless of turnover. The ones a small-business owner is most likely to recognise are:
- A health service provider
- A business that trades in personal information
- A contractor that provides services under a Commonwealth contract
- An operator of a residential tenancy database
- A credit reporting body
- A business related to a business the Act already covers
- A business that has opted in to be covered
Health service provider is wider than it sounds. The OAIC's checklist says it includes medical practitioners, pharmacists and allied health professionals, complementary therapists, child care centres and private schools.
Trading in personal information is also wider than selling a list. Swapping your customer list for someone else's is the OAIC's own example.
The checklist also asks about your history. If your turnover has been more than $3 million in any financial year since 2002, you need to comply.
The full list is longer. Work through the OAIC's checklist on the page linked above. It is a series of yes or no questions and takes a few minutes.
What must a privacy policy say?
The OAIC says a privacy policy explains in simple language how an organisation handles personal information. For a business the Act covers, it must tell people:
- Your name and contact details
- What kinds of personal information you collect and store
- How you collect it and where it is stored
- Why you need to collect it
- How you will use and disclose it
- How a person can access their information or ask for a correction
- How to lodge a complaint, and how you will handle it
- Whether you are likely to disclose information outside Australia and, if practical, which countries
The last point catches many small websites. If your enquiry form feeds an email tool, a booking system or a customer database run by an overseas company, the information may be stored outside Australia. Check where each tool keeps its data before you write that line.
The OAIC also says a business must update its policy when its information handling practices change, and publicise the updated version. A policy is a description of what you do. When what you do changes, the policy changes.
What changes on 10 December 2026?
A new transparency rule about automated decisions starts on that date.
In a notice published on 30 September 2026, the OAIC said that from 10 December 2026, businesses covered by the Australian Privacy Principles must include information in their privacy policy where they have arranged for a computer program to make or inform decisions that significantly affect individuals' rights or interests.
The rule applies when three things are true:
- A computer program makes a decision, or does something substantially and directly related to making it
- The decision could reasonably be expected to significantly affect a person's rights or interests
- Personal information about that person is used by the program
When it applies, the policy must describe the kinds of personal information the program uses, the kinds of decisions made solely by the program, and the kinds of decisions the program substantially assists.
For most small websites this will not be triggered. A contact form, an email newsletter or an AI tool that drafts a reply is not a decision that significantly affects someone's rights. Software that automatically approves or declines a customer, a tenant or a job applicant might be. The OAIC has published a fact sheet and a flowchart, linked from that notice, to help you decide.
If you use AI in the business, our guide to using AI safely covers the wider privacy questions.
Should you have a policy even if the law does not require one?
In most cases, yes, if your website collects anything about a person.
A contact form collects a name, an email address and often a phone number. A booking form or online shop collects more. People are entitled to wonder what happens next. A short policy answers that before they ask.
There are practical reasons too:
- Some advertising, analytics and form tools ask you to have a privacy policy in their terms of use. Check the terms of the tools you use
- Larger customers and government buyers may ask for one before they deal with you
- If your business grows past the turnover threshold, or starts offering a health service, you will need one anyway
One caution. A policy is a public statement about how you behave. If it promises something you do not do, that is worse than having no policy. Write down what actually happens, not what sounds good.
A worked example: a physio clinic and a plumber
These are illustrations of how the OAIC's checklist plays out. They are not legal advice for your business.
A physiotherapy clinic has four staff and a turnover well under $3 million. Its website takes online bookings and a short health history. Under the OAIC's checklist, a health service provider needs to comply with the Australian Privacy Principles whatever its turnover. The clinic must have a privacy policy, and it should cover the health information it collects, the booking system that stores it and where that system keeps its data.
A plumber has a turnover under $3 million and a website with a single enquiry form. The form sends a name, phone number and suburb to the plumber's inbox. She does not sell or swap customer details and has no Commonwealth contracts. On the checklist she is unlikely to be covered. She still adds a one-page policy. It says what the form collects, what it is used for, which email provider stores it, and how to ask for details to be deleted.
Both owners did the same first step. They listed every place the website collects information, then followed where it goes.
How do you write one without copying someone else's?
Start from what your website actually does, not from a template.
- List every form, booking tool, shop checkout, chat tool and tracking tool on the site
- For each one, write down what it collects, why, and which company stores it
- Note whether any of that is stored outside Australia
- Decide who in the business answers a request to see, correct or delete information
- Write it in plain sentences a customer would understand
- Link to it from the footer and from near each form
- Put a date on it and review it when you add a new tool
You can see the structure in our own privacy policy. Do not copy its wording. It describes our tools and our practices, not yours.
When we build a site, we list what each form and tool collects so the owner has the facts for their policy. That is part of every small business website package.
When should you get legal advice instead?
A simple brochure site with one contact form rarely needs a lawyer to write its policy. Some situations do.
- You are a health service provider or handle health information
- You collect information about children
- You share or sell customer information to anyone
- You use software that makes or shapes decisions about people, such as approvals or screening
- You sell to customers overseas, where other privacy laws can apply
- You have had a data breach or a privacy complaint
This article is general information, not legal advice. The OAIC says its own checklist is not a substitute for legal advice either. Use the official pages linked here, and speak to a lawyer or your industry association if any item on that list describes you.
Marketing emails have separate rules under the Spam Act. See our guide to email marketing for small business.
If you are planning a new site and want the privacy basics set up properly from the start, tell us what you need.
Common questions
Do I need a privacy policy if my turnover is under $3 million?
Not always. The OAIC says most small businesses with a turnover of $3 million or less are not covered by the Privacy Act. Some are covered whatever their turnover, including health service providers and businesses that trade in personal information. Use the OAIC's small business checklist to check.
What is the 10 December 2026 privacy change?
From that date, businesses covered by the Australian Privacy Principles must say in their privacy policy if a computer program makes or substantially assists decisions that significantly affect people, and what personal information it uses. The OAIC published guidance on 30 September 2026.
Can I copy a privacy policy from another website?
It is a poor idea. A policy has to describe what your business actually collects, where it is stored and who it is shared with. Another site's policy describes their tools, not yours, and promising things you do not do creates its own problems.
Where should the privacy policy go on my website?
Put a link in the footer so it appears on every page, and link to it near any form that collects personal details. The OAIC says a policy may be available on a website, and it should be written in simple language.
Sources
General information for Australian small businesses. Check the original source before relying on a price, product feature or rule.
