Website compliance checklist for Australian businesses: privacy, consumer law, accessibility and security

An Australian business website needs checks across information handling, marketing, accessibility, consumer claims and security. Which duties apply depends on your business and what it does. So confirm the rules first, then record what the site actually does and who fixes each gap. Completing this checklist doesn't certify legal compliance.

Before you start

Start with scope. An APP entity is an organisation covered by the Privacy Act's Australian Privacy Principles (APPs). Small businesses with turnover of $3 million or less are generally outside it, though exceptions matter.

Health service providers are covered whatever their turnover, and so are some others. The Office of the Australian Information Commissioner (OAIC) explains the tests. Turnover isn't the only factor. The exemption also doesn't reach the Spam Act, consumer law or disability discrimination duties.

Not every site needs the same legal pages, a cookie banner or an ABN in every footer. Your entity type, transactions and regulated activities change what's required. Our guide to Australian privacy law changes for websites explains which businesses are covered. Selling overseas can bring other laws into play, so ask an adviser who knows your business.

Check for industry rules

Regulated industries have extra rules. These pointers don't add numbered checks:

Ahpra's advertising summary bans testimonials about the clinical aspects of regulated health services. The Australian Securities and Investments Commission (ASIC) issued RG 234 on 9 June 2026. It covers financial advertising. The Tax Practitioners Board lists what registered agents must tell clients. A website is one way to do that, not a requirement.

Your eight area compliance check

The 32 checks sit in eight areas. Each area has its own section below. Give every check one of four statuses:

• Evidenced for this check

• Needs review

• Urgent

• Not applicable, with a reason

Untested work stays at Needs review. A screenshot of a policy or banner doesn't prove the system behaves that way.

Don't average the areas into a compliance percentage. Here's an example: of 32 checks, 31 have evidence. The last one shows enquiry text going to an advertising vendor. That issue needs containment and investigation, whatever the others say. Calling the site 97% compliant would mislead.

Record each finding the same way:

Privacy policy checks (1 to 4)

A privacy policy only helps if it matches what the business really does. Start with these four checks:

Under APP 1, a policy explains what you collect and why. It also covers access, correction and complaints. Likely overseas disclosure belongs in it too. The policy must also be free to read.

That's example wording, not approved legal copy. Our guide to privacy policies and website terms covers choosing the documents. A common mistake is copying another site's policy instead of mapping your own practices.

Forms and information collection (5 to 8)

Every form should collect only what the task needs. These checks are actions an owner can start and a developer can verify:

APP 5 asks for reasonable steps to tell people certain things at or before collection, or soon after. A line saying you'll use their details to reply isn't a complete notice for every case. The real collection, disclosures and overseas recipients decide what to explain.

An example quote form asks for a name, contact method, service and suburb. Optional context appears only where useful. Compare each field with what quoting actually needs. That's a method, not a universal field limit.

Use an authorised test submission with fictional details. Then check each copy:

• website storage and notification emails

• the CRM and any spreadsheets

• automations and agency tools

• backups

Include hidden fields and partial entries where they're captured. A warning above a free text box doesn't stop sensitive details arriving. Our guide to form design best practices covers fields and labels.

Cookies and tracking (9 to 13)

Tag manager lists miss things. Tags can be hardcoded, added by plugins or loaded inside embeds. Servers can send data too, so trace the real requests with authorised test data.

Consent mode needs care. Google's consent mode has two settings:

• basic mode stops Google tags loading until the visitor responds to the banner

• advanced mode loads them and sends cookieless measurements while consent is denied

Consent mode passes on a choice. Google says you're still responsible for obtaining consent. It doesn't govern every third party script or decide what Australian law permits.

The OAIC's tracking pixel guidance says pixel data can identify someone once a platform matches it. It lists a hashed email address as identifying data. Sensitive information generally mustn't reach third party platforms. The business deploying the pixel is responsible.

Google's Analytics rules prohibit identifying data in collection. If enquiry text is reaching an ad vendor, contain it first and then investigate. Our guide to conversion tracking setup covers the implementation.

Test each choice

Agree the expected behaviour with your adviser and implementer first. Then test each state:

• a new visitor before any choice

• rejection

• acceptance

• withdrawal later on

• a returning visit

Test forms, bookings and checkout too, not just the homepage. Keep redacted evidence and the configuration version.

A common mistake is installing a banner and never testing what the site sends.

Remarketing and advertising audiences (14 to 16)

Audiences built from site visits can reveal more than you intend. Check them before you use them:

Health, hardship and children's contexts need extra care before you build an audience. Customer matching uploads need a recorded source and purpose. Hashing an email isn't permission. Our guide to Google remarketing covers platform setup.

Email and SMS marketing (17 to 19)

Marketing messages need a consent basis you can prove. These checks cover the record, the scope and the exit:

The Australian Communications and Media Authority (ACMA) calls express consent best practice in its spam guidance. Inferred consent can apply with a provable, ongoing relationship and directly related marketing. Keep records, because it's up to you to prove consent. A purchased list or an old CRM import carries no automatic permission.

Unsubscribe rules are specific:

• honour requests within 5 working days

• keep the option working for at least 30 days after sending

• charge no fee

• ask for no login or extra personal details

Don't tell people to reply STOP from a sender that can't receive replies. A common mistake is treating an enquiry as permission to send marketing.

Register branded SMS sender IDs

Branded SMS has a separate step. Since 1 July 2026, an unregistered sender ID loses your business name. A warning label shows instead, as ACMA explains. Register through your telco or message provider. It's separate from consent and covers transactional messages too.

Then send a real test to an authorised phone. Check the name displays and the unsubscribe route suits the sender type. A sender that can't take replies needs another way to unsubscribe.

Test with an authorised recipient. Record each stage:

• the starting preference and the sign up

• the unsubscribe request

• removal from active journeys

• suppression after a sample import

AI chatbots and embedded tools

These tools don't get their own check numbers. They feed checks 3, 5 to 9, 11 to 13 and 30 to 32.

For each chatbot or embed, record:

• the supplier and the owner who approves changes

• what it collects and where the data goes

• who can access the data and how long it's kept

• any model training setting, where relevant

AI chatbots

A chatbot collects data like a form. The OAIC's AI guidance says public facing chatbots should be clearly identified. It treats AI generated or inferred personal information as a collection.

Limit what the bot collects, explain how it's handled and offer a human route. A label saying it isn't professional advice doesn't excuse wrong or misleading answers. Decide which claims the tool may make.

The OAIC's September 2026 update sets out three conditions, and all must apply:

• a computer program makes the decision, or does something closely tied to it

• the decision could significantly affect someone's rights or interests

• personal information is used

A simple FAQ bot doesn't automatically meet that test. Check eligibility, screening or similar workflows with your privacy adviser.

Embedded tools

Embedded tools can load before anyone clicks. List every one:

• booking and payment

• video and maps

• review feeds and chat

• CAPTCHA and session replay

Check what loads before interaction and after a choice, because behaviour varies by configuration. If an essential task depends on a blocked tool, offer a usable alternative.

Accessibility basics (20 to 22)

Accessibility checks are about whether people can complete essential tasks. Start with these three:

The Disability Discrimination Act makes disability discrimination by providers of goods and services unlawful. The Australian Human Rights Commission says organisations should meet WCAG 2.2 at Level AA at a minimum. WCAG is the main set of web accessibility guidelines.

W3C's Easy Checks find some barriers, not every failure. Automated tools can't check everything either. W3C says human judgement is required. Zooming text to 200% is a useful check, though it isn't the whole reflow requirement.

The Accessibility Quick Check is a manual review of 27 WCAG 2.2 AA questions. A score appears once eight are answered. It isn't a scan, an audit or certification. Our guide to website accessibility for Australian businesses covers the full set of checks.

Advertising claims and pricing (23 to 26)

Every claim and price on the site needs to hold up. These four checks cover the common gaps:

The Australian Competition and Consumer Commission (ACCC) says you must be able to prove advertised claims. Don't rely on fine print to fix a misleading headline.

Consumer prices must show the total. Price display rules let prices shown only to businesses exclude GST. In an example consumer service, setup is $110 and the first month is $55, both including GST. The initial commitment is $165, then $55 a month under the stated cancellation terms.

Show every mandatory amount, and don't add GST again. The ACCC's Online reviews for product and services guidance makes two points. It's against the law for a business to create fake or misleading reviews. A business may also mislead consumers if it suppresses or edits negative reviews, or removes genuine ones.

Regulated health services can't use testimonials about clinical aspects, as noted above. Our guide to getting Google reviews legally covers collecting them.

Parliament passed the Competition and Consumer Amendment (Unfair Trading Practices) Act 2026. Treasury says its bans start on 1 July 2027. It covers unfair trading, drip pricing and subscription contracts within its scope. It doesn't pause any current consumer law duty. Our guide to dark patterns and consumer law covers the detail.

Keep refund and cancellation wording consistent with the consumer guarantees. Wording that says no refunds can't remove the rights the ACCC's remedies guide describes. Change of mind is a separate policy choice.

Security and ongoing responsibilities (27 to 32)

Some of these checks are legal duties and some are prudent controls. HTTPS or a trust badge can help users without proving lawful handling.

ASIC requires a company's name and ACN on documents such as invoices and letterhead. That page doesn't mention websites or set a footer rule. Check the rules for your entity type.

Registered business names must be displayed where you trade to the public. They also go on correspondence, receipts and invoices. Clear identity on the site is still good practice.

Keep information only as long as it's needed

APP 11 requires reasonable steps to destroy or deidentify information you no longer need. That applies unless a law requires you to keep it. It covers archived and backup copies too.

There's no unrestricted right to erasure. Nor is there a promise of instant removal from every backup. Agree legal retention and backup handling with the responsible owner. A common mistake is keeping every record forever.

Route requests and review changes

Give access and correction requests one route and one owner. Complaints need the same. Record when each request arrived and how it closed.

Changes can quietly undo earlier fixes. New widgets or an agency exit can bring back old data flows. So can a changed booking tool or a restored backup. Record who approved the change and whose access was removed. Then retest the affected checks.

Escalate a suspected breach

If the audit finds a suspected breach, record what you saw and escalate straight away. A breach becomes notifiable when it's likely to result in serious harm. The OAIC's four steps are contain, assess, notify and review.

Take reasonable steps to finish the assessment within 30 days. That's a limit, not a waiting period. The OAIC says to act immediately.

In an example case, an old agency integration still exports enquiries after a new CRM goes live. Record the destination and have the implementer disable it. Preserve evidence, then assess what was disclosed. Editing the privacy policy alone doesn't fix it.

Our guides to WordPress security, website backups and recovery and website maintenance responsibilities go deeper. The Australian Cyber Security Centre's small business guide covers access, updates and backups.

A 30 minute first pass

A first pass finds the next work. It's triage, not a full assessment:

Half an hour can't cover legal analysis, full accessibility testing or server investigation. Test with permission, fictional data and controlled recipients. Never send live marketing to real customers as an experiment.

Then record, prioritise and assign each issue. Fix it, retest it and keep the evidence. Active exposure or a blocked essential task comes first.

Common mistakes and their fixes

What we recommend at Elev8d

Frequently asked questions

Next steps

Written by Ajay K.Co-founder, Elev8d

Ajay is the co-founder of Elev8d and writes most of what you will read here. Psychology grad turned marketer, which is a fancy way of saying he cares about why people click, not just where things rank. Every guide is written in plain English for Australian businesses, tested on real campaigns before it earns a spot on this site.