Short answer: if your business is covered by the Privacy Act, it must have a clearly expressed, up-to-date privacy policy, and the usual place to publish it is your website. If your business is small enough to be exempt, the law may not require one, but your analytics provider, your customers and some of your contracts probably still expect it.
The longer answer depends on a few questions most owners have never been asked: what your turnover is, what kind of business you run, and what your website actually collects. This guide goes through them one at a time, clears up the most common myths, and covers the new privacy policy rule that starts on 10 December 2026.
General information, not legal advice. This article explains the rules in plain English using the Office of the Australian Information Commissioner’s own guidance and the legislation. It isn’t legal advice for your business. If you’re unsure whether the Privacy Act applies to you, or what your policy should say, get advice from a qualified privacy lawyer.
Key Takeaways
- The Privacy Act generally doesn’t cover small businesses with annual turnover of $3 million or less, but some are covered regardless of turnover, including health service providers.
- If you’re covered, APP 1 requires a clearly expressed, up-to-date privacy policy, usually published on your website, and APP 1.4 lists what it must contain.
- A contact form collects personal information. The OAIC lists names, addresses and phone numbers, and even IP addresses, as examples.
- The OAIC’s first privacy policy compliance sweep was announced on 9 December 2025. Non-compliant policies can attract compliance and infringement notices and penalties of up to $66,000.
- From 10 December 2026, covered businesses that use computer programs, including AI, to make significant decisions using personal information must explain this in their privacy policy.
- Google’s Analytics terms require sites using Google Analytics to have a privacy policy that discloses it, whatever their turnover.
Myth 1: "Only big companies need a privacy policy"
Partly true, and that’s what makes it risky.
The Privacy Act 1988 sets out 13 Australian Privacy Principles (APPs). They apply to “APP entities”, a group that takes in businesses with annual turnover above $3 million and some smaller ones. The OAIC defines a small business as one with annual turnover of $3 million or less, and most small businesses aren’t covered [1].
Two details catch people out. First, turnover for this purpose “includes all income from all sources”, not just profit. Second, the OAIC’s own self-check asks whether your business has had an annual turnover of more than $3 million in any financial year since 2002 [1]. If you crossed the line once, you may not be a small business for privacy purposes even if you’re under it now. If your business hasn’t traded a full year, you project a full-year figure from what you’ve earned so far.
Then there’s the list that overrides turnover. According to the OAIC, regardless of turnover, the Privacy Act covers any business that is [1]:
If your business is… | Then… |
|---|---|
A health service provider | Covered |
Trading in personal information | Covered |
A contractor providing services under a Commonwealth contract | Covered |
Operating a residential tenancy database | Covered |
A credit reporting body | Covered |
A reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 | Covered |
An employee association registered or recognised under the Fair Work (Registered Organisations) Act 2009 | Covered |
A business that conducts protected action ballots | Covered |
Accredited under the Consumer Data Right system | Covered |
Related to a business the Privacy Act covers | Covered |
A small business that has opted in to the Privacy Act | Covered |
The first line matters more than most owners expect. The OAIC describes a health service provider as one that “provides services in relation to physical, emotional, psychological and mental health”, and its examples include medical practitioners, pharmacists, allied health professionals, complementary therapists, child care centres and private schools [1].
So a two-person physiotherapy clinic is covered. So is a psychologist working alone. And if you run an NDIS business that delivers health services within that description, such as therapy supports, the turnover exemption won’t help you. If you’re not sure which side of the line your supports fall on, that’s a question for the OAIC’s guidance or a privacy lawyer, not a guess.
“Trading in personal information” is the other one to check. The OAIC treats a business as trading if it discloses personal information for a benefit, service or advantage, or pays to collect it from someone else, unless the person consents or the law requires or authorises it [1]. Buying a marketing list can count.
Finally, a small business can choose to opt in to the Privacy Act. The OAIC says doing so can bring benefits, “including increased consumer confidence and trust” [1]. Some businesses opt in because larger clients or government contracts expect it.
Myth 2: "My website doesn't collect personal information"
If your website has a contact form, it almost certainly does.
The OAIC describes personal information as “a broad range of information, or an opinion, that could identify an individual.” Its examples include “an individual’s name, signature, address, phone number or date of birth” and “internet protocol (IP) addresses” [2]. A form asking for a name, email address and phone number is collecting personal information about the person who fills it in.
Here’s what a typical small business website collects without anyone thinking of it as “data collection”:
- Contact and quote forms: names, phone numbers, email addresses, sometimes street addresses and details of the job.
- Booking tools: names, contact details, appointment times, sometimes health or support needs.
- Newsletter sign-ups: email addresses and often names.
- Analytics: visit data tied to cookies or device identifiers.
- Chat widgets and AI assistants: whatever the visitor types, which can be anything.
- Payment pages: names, billing details and order history, often held by a third-party processor.
For a covered business, there’s a second rule beyond the privacy policy. APP 5 says that at or before the time you collect personal information, or as soon as practicable afterwards, you must take reasonable steps to tell the person certain things, including who you are and how to contact you, why you’re collecting the information, who you usually disclose it to, and that your privacy policy explains how they can access and correct it and how to complain [3].
On a website, that usually means a short collection notice near the form, with a link to the full policy. One sentence and a link is often enough to start the conversation; the detail lives in the policy.
Myth 3: "A privacy policy template is fine as long as it's there"
A privacy policy template can be a sensible starting point. Published unchanged, it’s usually wrong.
APP 1.3 requires a covered business to have a “clearly expressed and up-to-date” privacy policy about how it manages personal information. The OAIC’s guidelines say a clearly expressed policy should be easy to understand, “avoiding jargon, legalistic and in-house terms”, easy to navigate, and should only include information relevant to how that business handles personal information [4]. A template copied from another business, or a generic overseas one, can’t meet that standard, because it describes someone else’s practices.
APP 1.4 then sets out what the policy must include, at a minimum [4]:
APP 1.4 item | In plain English | Website example |
|---|---|---|
(a) Kinds of personal information collected and held | What you collect | Names, phone numbers and job details from the quote form |
(b) How it’s collected and held | Where it comes from and where it’s kept | Website forms, phone calls, a booking system |
(c) Purposes for collecting, holding, using and disclosing it | Why you collect it and what you do with it | To quote, book and invoice; to send the newsletter people signed up for |
(d) How people can access and correct their information | How someone asks to see or fix their details | Contact email or phone for privacy requests |
(e) How people can complain, and how you’ll handle it | The complaints process | Who to contact, and what happens next |
(f) Whether you’re likely to disclose it to overseas recipients | Whether any of it leaves Australia | A CRM or email platform that stores data overseas |
(g) If so, the likely countries, if practicable to list them | Where it goes | The countries your providers name |
Item (f) surprises a lot of owners. Many of the tools small businesses use every day, from email marketing platforms to CRMs, are run by overseas companies. Check where your providers say they store data, because the policy has to address whether disclosure overseas is likely.
The OAIC also says how the policy should be presented. A covered business must take reasonable steps to make the policy available free of charge and in an appropriate form, which is generally expected to mean publishing it on the website. The OAIC suggests the policy should be “prominently displayed, accessible and easy to download”, for example with a prominent link or privacy icon on each page of the site [4]. A footer link on every page does that job. It also says a layered approach, a short summary that links to the full policy, can help people understand it.
And “up to date” means what it says. Add a booking tool, a chat assistant or a new email platform, and the policy needs to change with it.
Myth 4: "Nobody actually checks"
That used to be a fair assumption. It’s less safe now.
On 9 December 2025, the OAIC announced its first-ever privacy compliance sweep. It planned to review the privacy policies of approximately 60 entities in six sectors that collect personal information in person: rental and property, chemists and pharmacists, licensed venues, car rental companies, car dealerships, and pawnbrokers and second-hand dealers [5]. The sweep was set to begin in the first week of January 2026 and assess policies against APP 1.4.
The release was clear about the stakes: “Entities found to have non-compliant privacy policies may face compliance and infringement notices and penalties of up to $66,000.” It also explained why that’s now possible. Changes to the Privacy Act passed in 2024 “expanded the possible regulatory consequences for infringements of certain foundational requirements of the Act”, including “the failure to have a privacy policy containing certain information” [5].
The legislation backs that up. The Privacy and Other Legislation Amendment Act 2024 inserted a new section 13K into the Privacy Act, listing breaches for which infringement notices or compliance notices can be issued. The list includes breaching APP 1.3, the requirement to have a privacy policy, and APP 1.4, the contents of the policy [6].
To be precise about scope: the first sweep targeted businesses that collect information in person, not websites as such. But the rule it enforced, APP 1.4, is the same rule your website privacy policy has to meet. The sweep’s sectors were a starting point, not a boundary.
Myth 5: "The new AI rules are for big tech companies"
This is the change with a date on it. From 10 December 2026, covered businesses that use automated decision-making must say so in their privacy policy.
The rule comes from Part 15 of Schedule 1 to the Privacy and Other Legislation Amendment Act 2024, titled “Automated decisions and privacy policies”. The Act received Royal Assent on 10 December 2024, and its commencement table says Part 15 starts “the day after the end of the period of 24 months beginning on the day this Act receives the Royal Assent”, which the Federal Register lists as 10 December 2026 [6]. The same Part adds the new APP 1.7 to the list of breaches that can attract infringement notices.
When does it apply?
Under the new APP 1.7, the privacy policy must include extra information if all three of these are true [4][6]:
- The business has arranged for a computer program to make a decision, or to do something substantially and directly related to making a decision.
- The decision could reasonably be expected to significantly affect the rights or interests of an individual.
- Personal information about that individual is used in the operation of the program.
The OAIC reads “computer program” broadly. Its guidelines say it covers “commonly-used software, apps, or word-processing tools”, and that generative AI tools, “including chatbots and other types of AI”, fall within the definition [4]. It also says a decision can be in scope “even where a computer program output does not replace the entire decision-making process or is subject to human review.”
“Significantly” does real work in that test. The OAIC says the impact “must be more than trivial and must have the potential to considerably influence the circumstances or outcomes for the individual concerned” [4].
What does it look like in practice?
The OAIC gives examples of arrangements it would generally treat as in scope [4]:
- using another company’s AI system to screen and rank job applications that lead to a hiring decision
- letting staff use an AI chat tool to draft performance assessments that determine promotions
- contracting a software company to automatically approve or decline refunds
- a case management system that automatically escalates particular types of complaints
A chatbot that only answers questions about your opening hours is a long way from those examples. An assistant that decides who qualifies for a service, approves or refuses refunds, or ranks applicants is much closer. If your website or back office does anything like that, the 10 December 2026 date applies to you, provided you’re covered by the Act in the first place.
What must the policy say?
APP 1.8 lists the information required where APP 1.7 applies [4]:
- the kinds of personal information used in the operation of those computer programs
- the kinds of decisions made solely by the operation of those programs
- the kinds of decisions where the program does something substantially and directly related to making the decision
The OAIC says businesses can group this information by category, but the detail “must be meaningful to a reasonable person”, and commercial-in-confidence information about the systems doesn’t have to be disclosed [4].
If you’ve added AI to customer-facing processes this year, our earlier piece on four in ten Australian contact centres planning to replace or upgrade their chatbots covers the wider shift. The privacy policy is where it now has to be written down.
Myth 6: "If I'm exempt, my privacy policy doesn't matter"
Two things can still make your website privacy policy matter even if the Privacy Act doesn’t cover you.
Your analytics provider may require one
If your site uses Google Analytics, Google’s own terms of service set conditions that don’t depend on your turnover. Section 7 says: “You will have and abide by an appropriate Privacy Policy and will comply with all applicable laws, policies, and regulations relating to the collection of information from Users.” It adds: “You must disclose the use of Google Analytics, and how it collects and processes data”, and that the policy must give notice of your use of cookies or similar technology used to collect data [7].
So a small business that’s exempt from the Privacy Act, but runs Google Analytics on its website, still has a contractual reason to publish a privacy policy that mentions it. Check the terms of your other website tools too; booking, chat and advertising platforms often have similar conditions.
What you say has to be true
A privacy policy is a statement to your customers about how you handle their information. Under the Australian Consumer Law, statements to customers can’t be misleading. The ACCC has shown it will act on privacy representations: on 12 August 2022 it announced that Google had been ordered to pay $60 million for breaching the Australian Consumer Law by “representing to some Android users that the setting titled ‘Location History’ was the only Google account setting that affected whether Google collected, kept and used personally identifiable data about their location” [8].
That was a very large company, but the principle is simple and applies to everyone: don’t say “we never share your information” if your CRM, email platform or booking tool means you do. A short, accurate policy is better than a long, reassuring one that isn’t true.
What a Website Privacy Policy Should Cover, Section by Section
If you’re covered, or you’ve decided to publish one anyway, here’s a practical outline built from APP 1.4 and the website questions above. It’s a checklist for your draft, not a privacy policy template to copy.
- Who you are and how to contact you about privacy, with a real email address or phone number.
- What you collect, listed plainly: contact details, job or booking details, payment details, and anything else your forms ask for.
- How you collect it: website forms, phone calls, email, bookings, in person, and from third parties if that happens.
- Why you collect it and how you use it: quoting, booking, invoicing, customer service, marketing people have agreed to.
- Who you share it with: the kinds of service providers you use, such as hosting, email, CRM, booking, payment and accounting platforms.
- Analytics and cookies: which tools you use, what they collect, and how people can manage cookies.
- Chat, AI and automated tools: what the tool does, and from 10 December 2026, the APP 1.8 information if your use meets the APP 1.7 test.
- Overseas disclosure: whether information is likely to go overseas and, where practicable, which countries.
- Access and correction: how someone asks to see or fix their information.
- Complaints: how to complain to you and how you’ll handle the complaint.
- Date last updated, so you and your customers can see it’s current.
Write it in plain English. The OAIC’s own standard is “easy to understand”, and you’ll find it easier to keep a plain document up to date.
Where the Privacy Policy Lives on Your Website
A good policy that nobody can find doesn’t do its job. These are the places it should show up:
- The footer of every page, as a “Privacy policy” link. That matches the OAIC’s suggestion of a prominent link on each page.
- Next to every form, as a one-line collection notice with a link to the policy.
- In your email sign-up, so people know what they’re signing up for.
- In or beside a chat window, with a clear label that it’s an automated assistant. The OAIC’s guidance on commercially available AI products says public-facing AI tools, such as chatbots, should be clearly identified as such to users [9].
- In your booking and checkout flows, especially where a third-party tool collects the details.
Website terms and conditions are a separate document. They cover how people may use the site, not how you handle personal information, so don’t merge the two.
When we build websites, on custom WordPress, GoHighLevel or another framework depending on what the business needs, the footer, the forms and the integrations are all part of the build. That makes a site launch or rebuild a natural time to get the privacy policy and collection notices right. If your site has grown piece by piece, our website maintenance piece covers why the ongoing work matters, and this is part of it.
Your To-Do List Before 10 December 2026
Work through these in order. Most take less than an afternoon.
- Check whether you’re covered. Use the OAIC’s turnover test, including the “any financial year since 2002” question, and the list of businesses covered regardless of turnover.
- List what your website collects. Every form, booking tool, sign-up, chat widget, analytics tag and payment page.
- List where that information goes. Every platform it lands in, and where each platform says it stores data.
- Check your current policy against APP 1.4. If it’s a template, rewrite it to match what you actually do.
- Check for automated decisions. If any tool makes or substantially shapes a decision that could significantly affect someone, prepare the APP 1.8 information.
- Add collection notices beside your forms and a clear AI label on any chat assistant.
- Put the policy link in your footer on every page.
- Set a review date, and update the policy whenever you add a tool that touches customer information.
- Get advice where it’s unclear. Especially if you’re a health service provider, an NDIS provider delivering health services, or you use AI in decisions about people.
Important FAQs
Is a privacy policy a legal requirement in Australia?
Can I use a privacy policy template?
Do I need a privacy policy if I use Google Analytics?
What happens if my privacy policy is wrong or missing?
The Bottom Line
Know whether you're covered, then say what you actually do.
Not every Australian small business website needs a privacy policy under the Privacy Act. But more businesses are covered than owners think, especially in health and NDIS, the OAIC is now checking policies, and from 10 December 2026 covered businesses using automated decision-making have more to disclose.
Even if you’re exempt, your analytics terms and your customers expect a clear, honest policy. Work out whether the Act applies, list what your website collects, write the policy in plain English, and keep it current as your tools change.
Does your website say what it really does with customer details?
If your forms, bookings or chat tools have outgrown your privacy policy, let’s fix the website side together. See our custom web design work or contact us.
Sources
[1] Office of the Australian Information Commissioner, “Small business”, checked 4 October 2026. https://www.oaic.gov.au/privacy/privacy-for-organisations/small-business
[2] Office of the Australian Information Commissioner, “What is personal information?”, checked 4 October 2026. https://www.oaic.gov.au/privacy/your-privacy-rights/your-personal-information/what-is-personal-information
[3] Office of the Australian Information Commissioner, “Read the Australian Privacy Principles” (APP 5), checked 4 October 2026. https://www.oaic.gov.au/privacy/australian-privacy-principles/read-the-australian-privacy-principles
[4] Office of the Australian Information Commissioner, “Chapter 1: APP 1 Open and transparent management of personal information”, Australian Privacy Principles guidelines, updated 30 September 2026. https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-1-app-1-open-and-transparent-management-of-personal-information
[5] Office of the Australian Information Commissioner, “Privacy compliance sweep to put privacy policies under the spotlight”, media release, 9 December 2025. https://www.oaic.gov.au/news/media-centre/privacy-compliance-sweep-to-put-privacy-policies-under-the-spotlight
[6] Federal Register of Legislation, Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024), as made, assented to 10 December 2024. https://www.legislation.gov.au/C2024A00128/asmade/text
[7] Google, “Google Analytics Terms of Service”, section 7 (Privacy), last updated 15 May 2023. https://marketingplatform.google.com/about/analytics/terms/us/
[8] Australian Competition and Consumer Commission, “Google LLC to pay $60 million for misleading representations”, media release, 12 August 2022. https://www.accc.gov.au/media-release/google-llc-to-pay-60-million-for-misleading-representations
[9] Office of the Australian Information Commissioner, “Guidance on privacy and the use of commercially available AI products”, 21 October 2024. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products
