Do you need a privacy policy for small business websites in Australia? It depends on your business, but the answer is yes more often than owners expect. This guide is for owners who have a contact form, a booking tool or a mailing list on their site and aren't sure what the law asks of them.
The rules come from the Privacy Act 1988 and the Australian Privacy Principles. Many small businesses are exempt, but the exemption has a long list of exceptions. Separately, tools like Google Analytics and Stripe ask you to have a privacy policy in their own terms, whether or not the Act applies to you.
We'll start with the basic terms, then cover the small business exemption, what your website collects, what a privacy policy must include, why many businesses publish one anyway, recent law changes, and how to write yours. This is general information, not legal advice. For advice on your situation, talk to a lawyer.
What is a privacy policy? The key terms, explained simply
A privacy policy is a public statement of how your business handles people's personal information: what you collect, why, who you share it with and how people can ask about it. On a website it's usually a page linked from the footer.
- Privacy Act 1988: the federal law that regulates how many businesses and government agencies handle personal information.
- Australian Privacy Principles (APPs): the 13 principles in the Act that set the rules, from collection through to security and access.
- APP entity: an organisation or agency the APPs apply to. Many small businesses are not APP entities, unless an exception applies.
- Personal information: the Office of the Australian Information Commissioner (OAIC) describes it as information or an opinion that could identify an individual. Its examples include a name, address, phone number, date of birth and IP address.
- OAIC: the national regulator for privacy. Its website is the best free source of guidance for business owners.
Note the IP address in that list. Almost every website records visitors' IP addresses in some way, through analytics, security tools or server logs. So even a simple site with no forms can handle personal information.
Does the Privacy Act apply to small business?
The OAIC defines a small business as one with an annual turnover of $3 million or less. Most small businesses under that threshold don't have to follow the Privacy Act. The OAIC notes that turnover here means all income from all sources, not just sales.
The exceptions that remove the exemption
The OAIC lists businesses that are covered by the Act regardless of turnover. A small business is covered if it:
- Provides a health service. The OAIC's health privacy guide says health service providers include GPs, dentists, physiotherapists, psychologists, pharmacists, childcare centres, and gyms and weight loss clinics.
- Trades in personal information, such as buying or selling customer lists.
- Is a contracted service provider to an Australian Government agency.
- Operates a residential tenancy database or does credit reporting.
- Is a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.
- Is related to a larger business that is covered by the Act.
- Is an employee association registered under the Fair Work legislation, or conducts protected action ballots.
- Holds Consumer Data Right accreditation, or is prescribed in the Privacy Regulation 2013.
- Has chosen to opt in to the Act voluntarily.
What personal information does your business website collect?
Before you write anything, work out what your website actually collects. Most small business sites collect more than the owner realises, because each tool added over the years brings its own data.
- Contact and quote forms: names, email addresses, phone numbers and whatever people type in the message box.
- Booking tools: contact details, appointment times and sometimes health or personal details in the notes.
- Email lists and newsletters: names, email addresses and, often, which emails people open.
- Analytics: tools like Google Analytics use cookies and similar technology to collect data about visits.
- Advertising tags: Google Ads and social media pixels can track visits so you can show ads to past visitors.
- Payments: checkout tools such as Stripe process names, card details and billing addresses.
- Hosting and security: servers and firewalls may log IP addresses. Our guide to what website hosting is explains where your site lives.
If you've added forms that feed a CRM or send automatic emails, list those too. Our guide to automation ideas for your website shows how often enquiry data moves between tools behind the scenes.
What should a privacy policy for small business include?
If the Act applies to you, APP 1 says you must have a clearly expressed and up to date privacy policy. The OAIC's APP guidelines list what it must cover:
- What you collect: the kinds of personal information you collect and hold.
- How you collect and hold it: for example, through website forms, bookings or phone calls, and where it's stored.
- Why: the purposes you collect, hold, use and disclose it for.
- Access and correction: how people can see the information you hold about them and ask you to correct it.
- Complaints: how people can complain about a breach of the APPs, and how you'll deal with it.
- Overseas disclosure: whether you're likely to send information overseas and, where practical, to which countries. Many website tools store data outside Australia.
APP 1.5 says you must take reasonable steps to make the policy available free of charge and in an appropriate form. The OAIC says this usually means publishing it on your website. You must also give someone a copy in the form they ask for, where that's reasonable.
A new item from 10 December 2026
From 10 December 2026, APP entities that use computer programs to make, or help make, decisions that could significantly affect someone's rights or interests, using their personal information, must say so in their privacy policy. The OAIC notes that generative AI tools and chatbots fall within the meaning of computer program. If you use automated tools to approve, decline or price things for customers, check the OAIC's guidance on this.
Why many small businesses publish a privacy policy anyway
Even if the Privacy Act doesn't apply to you, the tools on your website may require a privacy policy in their own terms.
- Google Analytics: the Google Analytics terms say you must post a privacy policy that gives notice of your use of cookies or similar technology, and disclose your use of Google Analytics and how it collects and processes data.
- Google Ads: if you use data segments (remarketing), Google Ads Help says your privacy policy must explain how you use data to advertise, that third-party vendors including Google use cookies to show ads based on past visits, and how visitors can opt out.
- Stripe: Stripe's Data Processing Agreement says users must provide all necessary notices, including by making a privacy policy available, so Stripe can lawfully process customers' personal data.
Trust matters too. When releasing draft privacy reforms in August 2026, the Attorney-General said almost four in five Australians report having very little or no control over how their personal information is collected or used. A clear, honest privacy policy linked next to your enquiry form tells customers you've thought about it.
A privacy policy page sits alongside the other basics of a well-run site, like accessible design. Our beginner's guide to website accessibility covers that side.
Australian privacy law changes in 2024 and 2026
Parliament passed the Privacy and Other Legislation Amendment Act 2024 on 29 November 2024. The OAIC lists its main changes:
- A statutory tort that lets people take court action over serious invasions of privacy.
- Stronger enforcement powers for the OAIC, including new penalty tiers and infringement notices.
- A Children's Online Privacy Code, to be developed by the OAIC for social media and other online services children are likely to use.
- A way to list countries and schemes with strong privacy protections, for sending information overseas.
- Privacy policy disclosures about automated decisions, starting 10 December 2026, as covered above.
On 31 August 2026, the Australian Government released a consultation paper and an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026. The Attorney-General said the proposals include a fair and reasonable test for collecting and using information, a right to erasure for large digital platforms, stronger consent standards, and measures to stop businesses trading in personal information without clear permission. Submissions closed on 18 September 2026.
That bill is a draft, not law. We won't guess at what the final version will say or when it might start. Check the OAIC and Attorney-General's Department websites for the current position before relying on any change.
How to write your small business privacy policy
A privacy policy template for small business can be a useful starting point, but only if you edit it to match what you actually do. A template that mentions tools you don't use, or misses ones you do, isn't an accurate statement of your practices.
- Start with your list of tools and what each one collects, from the earlier section.
- Work through the APP 1 items: what you collect, how, why, access and correction, complaints and overseas disclosure.
- Add what your tools require, such as the Google Analytics and Google Ads disclosures and a link to Stripe's privacy information if you take payments.
- Use plain English, and give a real contact name or role and an email address for privacy questions.
- Link it from every page, usually in the footer, and near any form that collects personal information.
- Review it whenever you add a tool, and put a "last updated" date at the top.
If you're in a covered group, such as a health service, or you're unsure whether an exception applies, get legal advice. This guide is general information only and doesn't take your circumstances into account.
Key takeaways
- (01)
Small businesses with an annual turnover of $3 million or less are usually exempt from the Privacy Act, but health services and several other groups are covered regardless.
- (02)
Most websites collect personal information through forms, bookings, email lists, analytics and IP addresses.
- (03)
Google Analytics, Google Ads data segments and Stripe all expect a privacy policy in their own terms, even if the Act doesn't apply to you.
- (04)
Base your privacy policy on what your site actually collects, cover the APP 1 items, link it from every page and get legal advice if you're unsure.
Frequently asked questions
Is a privacy policy a legal requirement for small business in Australia?
Only if the Privacy Act applies to your business. Most businesses with an annual turnover of $3 million or less are exempt, unless an exception applies, such as providing a health service or trading in personal information. Your website tools may still require one in their terms.
Can I use a free privacy policy template?
A template can help you start, but edit it so it matches what your business and website actually collect, use and share. Remove anything that doesn't apply, add every tool you use, and check it covers the APP 1 items. Get legal advice if you're covered by the Act.
Does using Google Analytics mean I need a privacy policy?
Yes, under Google's own terms. The Google Analytics terms say you must post a privacy policy that discloses your use of cookies or similar technology and your use of Google Analytics, including how it collects and processes data.
Where should the privacy policy go on my website?
Give it its own page and link to it from the footer of every page, so it's easy to find. It also helps to link it next to any form that collects personal information, such as enquiry, booking or newsletter forms.
More answers on price, hosting and timing in our FAQ.