[ Legal pages ]
Do I Need a Privacy Policy on My Website in Australia?
A website privacy policy is required by law only if the Privacy Act covers your business, and most businesses with $3 million or less in annual turnover are exempt. Most of them need one anyway: Google Analytics' terms require it, a contact form collects personal information whether the law reaches you or not, and a site with no privacy page looks like a site with something to hide. Here is how to tell which group you are in and what to write.
I am not a lawyer and this is not legal advice. What it is: every claim below is linked to the Office of the Australian Information Commissioner, the Attorney-General's Department or the platform whose terms you have already agreed to, and it is checked against those pages as at September 2026. None of the six pages ranking above this one for the same question links to a single one of them.
The Short Answer
Three questions decide it.
- Does the Privacy Act cover you? If your annual turnover is more than $3 million, yes. If it is $3 million or less, usually no, unless you are on the OAIC's list of businesses covered regardless of size. Covered means a privacy policy is a legal requirement.
- Do you run Google Analytics, or any tool with the same clause? Then you agreed to post one when you accepted the terms, exempt or not.
- Do you collect anything at all? A contact form, a quote request, a booking, a newsletter box. Then you hold personal information, and a policy is the plain description of what you do with it.
If you answered yes to any of the three, write one. The rest of this article is what goes in it and what has changed.
The $3 Million Exemption Test
The OAIC's small business guidance, last updated 5 September 2024, puts it simply: "A small business is one with an annual turnover of $3 million or less. Annual turnover for the purposes of the Privacy Act includes all income from all sources." Assets, capital gains and the proceeds of selling assets are excluded. So it is your sales figure, not your profit, and not your bank balance.
The arithmetic catches people out. A cafe taking $60,000 a week turns over $3,120,000 a year and is covered. The same cafe at $55,000 a week is at $2,860,000 and is exempt. The line is closer to a busy small business than the word "small" suggests.
Turnover is not the only test. The same OAIC page lists businesses covered whatever their size, and two of them catch a lot of local operators:
- a health service provider, which includes allied health, a gym running health assessments, a naturopath, a physio or a massage clinic holding client health notes
- a business trading in personal information, which means buying or selling lists or details
- a contractor providing services under a Commonwealth contract
- an operator of a residential tenancy database, a credit reporting body, a reporting entity under anti-money laundering law, and a business accredited under the Consumer Data Right
A small business can also choose to opt in and be covered voluntarily. The OAIC lists "increased consumer confidence and trust" as the reason a business might.
Why Exempt Businesses Still Need One
The exemption is about the Privacy Act. It is not about the other two things that put a privacy policy on your website.
The first is a contract you have almost certainly signed. Section 7 of the Google Analytics Terms of Service, last updated 15 May 2023, says: "You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies." It goes on: "You must disclose the use of Google Analytics, and how it collects and processes data." If your site has the Analytics tag on it, and most do, that clause applies to you at any turnover.
The second is the customer. A recent Full Picture client came to me with a site running two tracking containers and no privacy policy at all. Nothing about that was illegal for a business her size. It was still the first thing I put on the list for the rebuild, because a customer who scrolls to the footer looking for the privacy page and finds nothing does not think "exempt". They think "careless", and they are booking a service where they hand over their contact details and their pet. The absence cost more than the page would have.
There is a third reason that sits between the two. If you publish a policy, you have made a promise, and the Australian Consumer Law applies to promises. So the advice is not "publish anything". It is publish something short and true, which is the subject of section five.
What the 2024 Reforms Changed, and What Is Still Coming
The Privacy and Other Legislation Amendment Bill 2024 passed on 29 November 2024. The OAIC's statement that day lists what it did: a statutory tort for serious invasions of privacy, so people can sue over privacy harms; new tiers of civil penalties and the power for the OAIC to issue infringement notices; a Children's Online Privacy Code covering any online service likely to be accessed by children; and a requirement that privacy policies describe substantially automated decisions that significantly affect people.
That last one has a date. The OAIC's APP 1 guidelines, updated 30 September 2026, set the automated decision-making transparency requirement to take effect on 10 December 2026. If your booking system automatically declines or prices a customer based on their details, that will need to be in the policy.
The penalties are no longer theoretical. On 8 October 2025 the Federal Court ordered Australian Clinical Labs to pay $5.8 million in civil penalties over the 2022 Medlab Pathology breach, which the OAIC describes as the first civil penalties ever ordered under the Privacy Act. $800,000 of that was for failing to assess the breach quickly and $800,000 for failing to notify. That is a large company, and the point for a small one is the shape of it: the fine was not for being breached, it was for what was and was not done afterwards.
What is still coming is the part the legal pages ranking for this search do not mention. The Government's response to the Privacy Act Review on 28 September 2023 agreed in principle to remove the small business exemption, subject to consultation and an impact analysis. On 31 August 2026 the Attorney-General's Department released an exposure draft of a second bill, the Privacy Amendment (Personal Data Protection) Bill 2026, with consultation having closed on 18 September 2026. Its consultation paper covers definitions, how personal information is handled, data security, access and erasure, exceptions for research and processors, OAIC powers and new technologies. I read it looking for the small business exemption and did not find it. So as at September 2026 the $3 million threshold still stands, and its removal remains a commitment rather than a law. When that changes I will update this page.
What a Privacy Policy Must Say
For a covered business the list is written down. APP 1.3 requires "a clearly expressed and up-to-date APP Privacy Policy about how it manages personal information", APP 1.5 says it must be available free of charge and in an appropriate form, and APP 1.4 sets the contents. For an exempt business writing one voluntarily, the same list is the honest template, cut to what you actually do.
| Your website has | What it collects | What the policy should say |
|---|---|---|
| A contact or quote form | Name, email, phone, whatever they type in the message | What you use it for (replying, quoting), how long you keep it, that it goes to your email or CRM, how they ask you to delete it |
| Google Analytics or a tag manager | Device, pages viewed, rough location, cookies | That Google Analytics is used, that it uses cookies, how they can opt out, and that Google processes the data |
| A newsletter box | Email address, sometimes a name | What you will send, how often, how to unsubscribe, which platform holds the list and where it is hosted |
| Online booking or payment | Names, dates, sometimes pets, children or health details, card details held by the payment provider | What is stored by you and what is stored by the provider, whether any of it leaves Australia, and how to access or correct it |
| Nothing at all: a brochure site with a phone number | Almost nothing, but Analytics is probably still there | Two paragraphs: what the analytics collects, and that the phone number is the only way you hear from them |
Two things the six ranking pages get wrong. Three of them are American and describe laws that do not apply here; a template built for California will name rights your customers do not have and miss the ones they do. And several of them, plus the generator tools, produce three thousand words for a business that collects an email address. Length is not compliance. A short policy that describes exactly what your site does is better in every way than a long one that describes a business you are not.
The one line every Australian policy needs and most miss: whether information is likely to be disclosed overseas, and where. If your form emails to a Gmail address, your newsletter lives in a US platform or your booking tool is hosted abroad, the honest answer is yes, and APP 1.4 asks you to name the countries where it is practicable to do so.
What It Costs to Get Right
On every website I build, the Privacy Policy and the Terms & Conditions are mandatory pages at $250 each, written for that business and what its forms actually do. I price them separately so nobody can quietly leave them out to make a quote look smaller, which is exactly what had happened on the site with the two tracking containers. If you would rather write your own, the APP 1.4 list above and the table are the whole brief, and a lawyer's review of a short honest page costs less than a lawyer's rewrite of a long template.
If you are not sure what your site currently collects, that is the more useful question, and it is one of the things I check in The Found Report alongside everything else that decides whether a customer trusts the page. My breakdown of website design pricing shows where the legal pages sit in a full build, and website redesign covers the case where the site exists and the pages were never written.
Frequently Asked Questions
Do I need a privacy policy on my website in Australia?
What privacy policy is required for a website?
Is it a legal requirement to have a privacy policy on a website?
What are the legal requirements for a website in Australia?
Founder & digital marketing specialist at Saltline Studio, Port Macquarie. Helping small businesses grow with custom websites and organic search.