Website privacy policy and terms for Australian businesses: what you need and what to put in them

The legal pages your website needs depend on what your business does and which laws apply. Businesses covered by the Australian Privacy Principles (APPs) need a current privacy policy. Collection notices explain particular collections, and sales or bookings need suitable terms. Start with your real data and customer journey, then write the documents that describe them.

What each document does

Each document has a different job.

APP 1 applies to covered entities. Contract needs follow what you sell and how you sell it. A policy isn't a contract. It isn't permission to collect anything either.

For the wider build, start with our small business website guide.

Does the Privacy Act cover your business?

The OAIC says businesses with annual turnover up to $3 million generally aren't covered. Above that, a private sector organisation is generally in scope. Turnover counts all income from all sources.

Some small businesses are covered regardless of turnover. These examples are made up. Check the OAIC's full list and its privacy checklist before relying on one:

From 1 July 2026, anti money laundering rules (AML/CTF) cover certain services, including some offered by accountants. The OAIC's AML/CTF guidance says the Privacy Act applies to those businesses for their AML/CTF activities. Their other activities stay outside, unless something else brings them in. A job title doesn't decide coverage. The designated service does.

Other rules can matter even outside the APPs:

• health records laws

• tax file number and credit information rules

• state and territory regimes

• contracts and overseas laws that reach your business

Being outside the APPs isn't permission to misuse information. An exemption doesn't remove every Privacy Act provision or all privacy risk. Without an APP duty, a truthful voluntary privacy explanation is still a practical option. Publishing one isn't the same as formally opting in to the Act.

The tree doesn't decide exemption. It makes sure the question gets answered before anyone writes a policy.

Keep this as an internal record. It isn't an exemption certificate or a public policy.

Map the information your website handles

Before drafting anything, list what the site actually collects, such as:

• contact and order details

• bookings and account information

• CVs and other uploaded files

• chat messages

• technical identifiers like IP addresses

• anything sensitive, like health details

Whether information identifies someone depends on the information and its context. A name doesn't have to appear. Here's how one example enquiry might travel:

Your destinations may differ. A tag manager (the tool that loads tracking code) won't show them all. Build an inventory instead:

Add the purpose and the evidence you checked for each row. Look beyond the browser too. Server integrations, CRM exports and AI tools can all receive personal information. The OAIC's AI guidance says not to enter personal information, especially sensitive information, into public generative AI tools.

A free text box can collect health or financial details you never asked for. Collect less where you can. Give clear instructions. Set up a protected route for anything genuinely needed later.

Check what your events and URLs actually send. A page path or chosen appointment can reveal more than an analytics label suggests. So can a query string, the part of a web address after a question mark.

Keep the inventory internal. The public policy doesn't need passwords or your security setup.

What an APP privacy policy should contain

The OAIC's APP 1 guidelines list what the policy covers:

The policy covers the whole organisation, including offline handling. A page that only describes the contact form may not be an adequate APP policy.

Make the policy usable

Under APP 1, take reasonable steps to offer the policy free, in an appropriate form. The OAIC generally expects it on your website. It suggests a prominent link on every page. Check it reads well on mobile and with assistive technology. A PDF alone shouldn't lock away essential information.

On request, take reasonable steps to provide it in the form someone asks for. Keep the access, correction and complaint channels real and monitored. Send a safe test request and see who responds. Don't make one online form the only way to ask.

Don't copy a competitor's software list. Don't claim you never share information while suppliers receive it either. Describe overseas recipients from your actual arrangements. The APP 8 guidelines explain when sending data to an overseas provider is a use, not a disclosure. Server location alone doesn't settle it.

A policy describes your handling. Listing unnecessary collection doesn't make it lawful. A common mistake is a policy that still lists a tool the site stopped using.

Automated decisions from 10 December 2026

The amendment has passed. The Privacy and Other Legislation Amendment Act 2024 starts the duty on 10 December 2026. The OAIC released updated guidance on 30 September 2026. Check both again on the day you publish.

The duty applies when three things are true:

• a program you've arranged makes the decision, or does a thing substantially and directly related to it

• the decision could reasonably be expected to significantly affect someone's rights or interests

• that person's personal information is used in running the program

Your policy then has to describe the kinds of personal information the programs use. It also names the kinds of decisions made solely by a program. Then it names the kinds where a program does a thing substantially and directly related to the decision. A generic "we use AI" line won't cover it. The law doesn't require you to publish source code either.

Human review doesn't automatically take a system out of scope. Third party software you've arranged counts. So do simple rules based programs, as well as AI. A word processor used only to record a decision someone made independently is different.

Beneficial effects count as well as harmful ones. So does refusing or failing to make a decision. None of this creates a universal right to a human decision, or a ban on automation.

Two example contrasts help with issue spotting. A chatbot answering questions about opening hours doesn't automatically trigger this duty. A system that uses applicant information to rank people for a significant opportunity needs assessment. Neither is a legal verdict on every chatbot or recruitment tool.

A practical workflow looks like this:

1. List the systems and providers involved.

2. Note the personal information each one uses and its role in the decision.

3. Assess whether the effect on people could be significant.

4. Separate decisions made solely by a program from assisted ones.

5. Get legal review of your conclusions.

6. Update the policy and keep the record current.

Put the right notice at each collection point

APP 5 requires reasonable steps to notify people, or make sure they're aware, at or before collection. If that's not practicable, do it as soon as practicable afterwards. A footer link to your policy isn't automatically enough. Check every matter that applies:

• who you are and how to contact you

• how and where the information was collected, if that's not obvious

• any law that requires or authorises the collection

• why you're collecting it

• what happens if someone doesn't provide it

• who you usually share it with

• how to access the policy, correct details or complain

• likely overseas recipients and their countries, where practicable

A layered notice helps. Here's an example top layer for an ordinary enquiry, with bracketed parts for your real facts. Never publish it with the brackets still in:

Add the collection circumstances or legal authority where they apply. The comparison below shows how much a short top layer can improve:

The after version is only a top layer for an ordinary enquiry. It needs the linked detail and a full APP 5 check behind it. It isn't lawyer approved, a client template or enough for health, identity or financial intake.

Keep three things separate:

• accepting contract terms

• being told how personal information is handled

• agreeing to an optional use, like marketing

One compulsory tick box shouldn't bundle all three. The OAIC warns that bundled consent can undermine whether consent is voluntary. Giving notice doesn't mean someone consented either.

Put essential wording where people see it before they submit, including on mobile and inside booking widgets. Test a real submission and the error states. The form side is covered in website form design and collection notices.

A common mistake is leaving the notice unchanged after the form gains new fields.

Cookies, pixels and third party data flows

Privacy duties apply to what tracking tools actually collect and share, not just to the banner. Sensitive information, platform rules and overseas laws can add more. Cover every tool that sends data out:

• analytics and advertising pixels

• session recording and chat tools

• video embeds and booking services

• anything sent from your server, not the browser

Describing a tool in your policy doesn't make it lawful. A policy update won't fix a bad flow.

If you're covered, check the purpose of each collection and whether it's necessary. Check whether information is sensitive and how consent works where it's needed. Then check what each provider receives and what visitor choices actually control.

The OAIC's tracking pixels guidance says URL details and hashed emails can still identify people. Hashing turns an email into a scrambled code. Matched with the platform's own data, it can still point to a person.

In June 2026, the Privacy Commissioner found Medmate and Monash IVF interfered with privacy through tracking pixels. The determinations, dated 11 June, involved health related websites. Tracking those visitors and then targeting them with social media ads was collecting sensitive information. The findings concern sensitive health information. They don't ban all tracking.

Here, agency means your technical provider. Shared means you and an outside service. The categories are examples, with no volumes. Replace them with verified facts before using it as a real data map.

Check who receives information and which countries you can name. Offshore storage isn't automatically a disclosure. Australian storage isn't a complete privacy answer either.

Test as a new visitor. Check consent choices and withdrawal where you offer them. Then confirm what the provider and your backend actually do. A tool's privacy mode is a product feature, not regulator approval.

For specific tools, see Google Analytics 4 data collection and remarketing and personal information handling. The full consent and tag setup lives in Australian privacy reforms and breach response.

Choose and present the right website terms

Website use, a purchase or booking and a professional engagement are different relationships. A brochure site doesn't need the same contract set as a subscription service.

A footer terms page isn't automatically a professional engagement agreement. Mark what applies to you:

Only include what applies. Don't copy generic exclusions that don't fit your business.

Show material price, cancellation and renewal conditions before someone commits. Don't rely on a footer link alone to bind customers to every term. Get advice on how your terms become part of each contract.

Keep a version record for each set of terms:

• a document identifier and effective date

• how the terms were shown to the customer

• the transaction it applies to

• a copy you can retrieve later

Keep only the personal information you reasonably need for that evidence. You don't need to log every visitor forever.

When terms change

Work out which customers and contracts are affected. Check what notice is needed and whether they need to agree. A broad "we can change anything at any time" clause deserves legal review. Don't swap the public file and assume everyone accepted it.

For recurring services, state the billing frequency and renewal terms. Explain any minimum commitment and exactly how to cancel. Say what happens to access or deliveries after someone cancels. Then test it. The payment system should behave exactly as the wording says.

Templates give you structure and questions. You still verify the facts and get legal drafting or review where needed. An agency can put approved wording in place and test it. It can't certify legal compliance.

A common mistake is changing the terms page without recording which version earlier customers saw.

Preserve consumer rights in your terms

The ACCC says consumer guarantee rights can't be taken away by anything a business says or does. A "no refunds" sign is its example. Warranty wording can't remove them either. The right remedy depends on the facts, so don't promise a refund for every complaint.

Change of mind is separate. The guarantees don't cover it. A business with a change of mind policy must still follow it. Its other promises still matter too.

Watch for wording like this:

The ACCC's February 2025 sweep of more than 2,000 retail websites found wording like this. It didn't publish a breach rate.

Unfair contract terms are banned in standard form consumer and small business contracts. The ACCC's consumer contracts page says proposing, using or relying on them can attract penalties. That applies to contracts made or renewed from 9 November 2023. If a court decides a term is unfair, it's void. A tick box doesn't change that.

For small business contracts, the test is fewer than 100 employees or turnover under $10 million. Only a court can finally decide a term is unfair. Review one sided terms in the context of the whole agreement, like variation, termination and exit charges.

The 2026 unfair trading, fee and subscription amendments have passed. Their main rules start on 1 July 2027. For scope and transition, see consumer law risks in website journeys.

Match the document set to the website

Different website models need different documents. The type of business isn't a coverage verdict on its own:

Take a restaurant booking. Review the deposit, the cancellation deadline and the contact route against the real offer. There's no universal lawful fee or cancellation period to copy.

For a professional firm, footer terms aren't automatically the engagement letter. Don't invite detailed confidential documents before your intake process is ready for them.

For an online store, check the price, delivery promise and returns information match everywhere customers see them. A legal page can't repair contradictory promises elsewhere. The ACCC's online shopping guidance says online sellers have the same responsibilities as physical businesses. On eBay, it notes, the product comes from the seller.

For more on each model, see professional services website requirements and restaurant booking website design. The Australian ecommerce website checklist and healthcare website data handling cover stores and health sites.

Disclaimers and accessibility statements

A disclaimer can explain scope, the limits of general information and when to get advice. It can't fix a misleading headline or remove legal duties. Skip boilerplate that promises immunity.

For regulated health, financial or legal content, ask a qualified reviewer to check the actual statements. A named reviewer line needs real review, permission and relevant qualifications. If nobody's been appointed, leave the line out.

W3C's statement guidance says to include at least your commitment, the standard you apply and contact details. Known limitations are worth adding too. W3C also says statements aren't technical assessments or declarations of conformity.

Keep an aspiration separate from a tested result. Don't claim conformance with the Web Content Accessibility Guidelines (WCAG) from an automated score. An overlay or the statement itself doesn't prove it either. State the scope and date of any real assessment.

The Australian Human Rights Commission's guidance says organisations should conform with WCAG 2.2 at a minimum Level AA. That guidance isn't a statement template every business must publish word for word.

Write the statement for people trying to use the service. A plain explanation of a known barrier and a working alternative helps more than technical criteria. Don't publish unfilled fields or a compliance badge you haven't earned. For the detail, see Australian website accessibility guidance.

Make the underlying data handling work

APP 11 applies to covered entities. They must take reasonable steps to protect personal information. Those steps include technical and organisational measures. For the practical basics, the ACSC's small business guide recommends:

• multi factor authentication (MFA), starting with the most important accounts

• turning on automatic updates

• backing up regularly, including the website

• giving each user only the access they need

Add HTTPS across the whole site and checks on the suppliers you use. A list of products doesn't certify compliance. For WordPress sites, see WordPress security responsibilities.

Retention and removal depend on the facts and your legal duties. Set retention by purpose and by any legal requirement. There's no single number of years for enquiries, health records, orders and identity documents.

Once information isn't needed and no law requires keeping it, assess your duties. That can mean destroying it, or removing what identifies people. Trace every copy, including exports, vendor copies and backups. Plan how an old restore avoids quietly bringing back records due for deletion. Website backup retention and recovery explains restores.

A common mistake is deleting a live record and forgetting the inbox, CRM and backup copies. Keep the records the law requires. Coordinate with whoever holds them. Name an owner for requests and incidents.

Breach response sits in the reforms guide linked above. Protect the internal inventory and credentials. The public policy should be transparent without revealing details someone could exploit.

Review changes and check before launch

Review the policy whenever what you collect, who you use or what you sell changes. An annual review is a practical backstop, not a substitute for keeping it current.

Resolve material open issues before release. Review is an operational process, not proof of compliance from a tick score.

Privacy reform is still moving. The Attorney-General's consultation on exposure draft legislation ran from 31 August to 18 September 2026. The draft proposes changes including direct marketing and breach notification. These are proposals, not current law.

In December 2025, the OAIC announced a sweep of about 60 entities in six sectors. They all collect information in person. It said it would assess their policies against APP 1.4. The announcement isn't a finding about anyone.

Before launch, run these checks:

There's no score. An unresolved essential item stays open even if everything else passes. Keep previous approved versions. Record what changed, why, who reviewed it and when. The website launch checklist and website redesign checks cover the wider release.

What we recommend at Elev8d

Frequently asked questions

Next steps

Work through these in order.

Written by Ajay K.Co-founder, Elev8d

Ajay is the co-founder of Elev8d and writes most of what you will read here. Psychology grad turned marketer, which is a fancy way of saying he cares about why people click, not just where things rank. Every guide is written in plain English for Australian businesses, tested on real campaigns before it earns a spot on this site.