Does my website need a privacy policy?
If your business is covered by the Privacy Act, yes. If it isn't, it's not a legal requirement, but it's still a good idea. The tricky part is knowing whether you're covered, because some small businesses are covered no matter how small they are. Here's how to tell, and what the policy needs to say.
Last updated
The short answer
In Australia, businesses covered by the Privacy Act must have a clearly expressed, up-to-date privacy policy, and in practice that means one on the website. The Act generally covers businesses with annual turnover over $3 million, plus health service providers, businesses that trade in personal information, Australian Government contractors and some others whatever their size. Most smaller businesses are exempt, but a privacy policy is still recommended, and the right to sue for a serious invasion of privacy isn't limited to businesses the Privacy Act covers.
Who the Privacy Act covers
The Privacy Act applies to businesses with annual turnover of more than $3 million. It also applies to smaller businesses that provide a health service and hold health information, buy or sell personal information, provide services under an Australian Government contract, operate a residential tenancy database, or are reporting entities under the anti-money laundering laws. That last group grew on 1 July 2026 to include many lawyers, accountants, real estate agents and conveyancers. A small business can also choose to opt in. The OAIC's small business page has a step-by-step checker.
What a privacy policy must cover
What you collect
The kinds of personal information you collect and hold, such as names, contact details, payment details or health information.
How you collect and store it
Through forms, bookings, email, phone or cookies and tracking tags, and how you keep it secure.
Why you collect it
The purposes you collect, hold, use and share it for, such as answering enquiries, delivering a service or marketing.
Access and correction
How people can see the information you hold about them and ask for it to be corrected.
Complaints
How people can complain about how you've handled their information, and how you'll deal with it.
Overseas sharing
Whether you're likely to send information overseas, for example to a US-based form tool or email platform, and to which countries if that's practical to list.
Automated decisions, from 10 December 2026
If software uses personal information to make significant decisions about people, the kinds of information and decisions involved.
Small businesses that are covered anyway
- Health service providers that hold health information, including GPs, dentists, physios, psychologists, pharmacies and other businesses that provide a health service and keep health information.
- Businesses that buy or sell personal information, such as mailing lists.
- Contractors providing services under an Australian Government contract.
- From 1 July 2026, lawyers, accountants, real estate agents and conveyancers who provide services covered by the anti-money laundering laws.
- Businesses related to a larger business that is covered.
Why it's worth having one even if you're exempt
- Customers look for it. A clear privacy policy tells people you take their details seriously, especially before they fill in a form.
- The privacy tort applies to everyone. Since June 2025, people can sue for a serious invasion of privacy. It isn't limited to businesses the Privacy Act covers.
- The rules may change. The government has proposed changes to the small business exemption. It hasn't been removed, but being ready costs little.
- It makes you check what your website does. Writing the policy means listing your forms, tracking tags and the tools you send data to, which often turns up things you'd want to fix anyway.
How WaTo can help
- Our website security and compliance audit lists what your forms collect, which tracking tags fire and where the data goes, and compares it with your privacy policy.
- Once you or your lawyer have settled the wording, we can put the policy on your website and link it from every page.
- We're not lawyers. If you need to know whether the Privacy Act covers your business, the OAIC's checker or a privacy lawyer can tell you.
Privacy policy questions
Is a privacy policy required by law in Australia?
For businesses the Privacy Act covers, yes. They must have a clearly expressed and up-to-date privacy policy that's free and easy to get, which usually means a page on the website. Businesses the Act doesn't cover aren't legally required to have one.
Has the small business exemption been removed?
No. The $3 million turnover exemption is still in place. The government has proposed changes to it, and some businesses lost it on 1 July 2026 because of the anti-money laundering reforms, but there's no general removal date.
Can I use a privacy policy template?
A template is a reasonable start, but it has to describe what your business actually does. A template that mentions tools you don't use, or misses the tracking tags your site runs, can be worse than a short, accurate policy.
What happens if a covered business doesn't have one?
The OAIC can issue infringement notices to covered businesses whose privacy policy is missing, out of date or missing required content. It announced a sweep of privacy policies in December 2025.
Do I need to mention Google Analytics or the Meta pixel?
If you're covered by the Privacy Act, the OAIC's guidance on tracking pixels says their use should be clearly disclosed in your privacy policy. Even if you're exempt, it's good practice to list them.
How WaTo can help with this
Guides on this topic
- The privacy policy change coming on 10 December 2026
- Website compliance checklist for Australian small businesses
- A practical cyber security policy for small business
Sources & references
- OAIC: Privacy for small business
- OAIC: APP Guidelines, Chapter 1, APP 1 open and transparent management of personal information
- OAIC: Tracking pixels and privacy obligations
- OAIC: Statutory tort for serious invasions of privacy
- OAIC: Privacy compliance sweep to put privacy policies under the spotlight
WaTo Consulting. Last reviewed 2026-11-07. Review every six months, and when the small business exemption changes.
Not sure what your website collects?
We'll list every form, tracking tag and tool on your site so your privacy policy can match it.
Mon to Fri, 8:30am to 5pm
