Website compliance checklist for Australian small businesses
No single law tells a small business how its website must look. Instead, a handful of existing laws apply to what the website does: the forms, the newsletter sign-up, the tracking tags, the prices and who can use it. This checklist puts them in one place, with what to look for and where the rule comes from.
Last updated
The short answer
An Australian small business website should have a current privacy policy that matches what the site actually collects, collection notices on forms, tracking tags that are listed in the policy, marketing sign-ups that follow the Spam Act, prices shown in line with consumer law, reasonable accessibility for people with disability, and basic security such as HTTPS, updates and backups. Some of these rules only apply if the Privacy Act covers the business. No law requires a formal website audit.
Which rules apply to which businesses
The Spam Act, the Australian Consumer Law and the Disability Discrimination Act apply to businesses of every size. The Privacy Act mostly applies to businesses with turnover over $3 million, plus health service providers, businesses that buy or sell personal information, Australian Government contractors and, from 1 July 2026, lawyers, accountants, real estate agents and conveyancers for their anti-money laundering work. The right to sue for a serious invasion of privacy, which started in June 2025, isn't limited to businesses the Privacy Act covers. If you're not sure where you sit, the OAIC's small business page walks through it.
The checklist
1. A privacy policy that's easy to find
Linked from every page, usually in the footer, and up to date. For businesses the Privacy Act covers, the OAIC can issue infringement notices when a policy is missing or out of date.
2. The policy says what it should
What you collect, how and why, who you share it with, whether it goes overseas and to which countries, and how people can see, correct or complain about their information.
3. Tracking tags are listed
If the site runs Google Analytics, the Meta pixel, TikTok, Microsoft Clarity or similar, the privacy policy should say so and why. The OAIC's guidance on tracking pixels says this should be clearly disclosed.
4. Extra care on health and other sensitive pages
Ad pixels on booking or condition pages can send sensitive information to Meta or Google. The OAIC says this generally needs express opt-in consent, and avoiding the pixels may be the better choice.
5. Forms explain themselves
Each form says who you are, why you're asking, where the answers go, and links to the privacy policy. Ask only for what you need.
6. Form answers are stored safely
Know where submissions end up, such as an inbox, a plugin table or a CRM, who can see them, and when old ones are deleted. The ASD's small business handbook says to collect only what you need and delete what you no longer use.
7. Newsletter sign-ups follow the Spam Act
People opt in, every marketing email says who sent it, and every one has a working unsubscribe that's acted on within five working days.
8. Prices and claims are straight
Advertised prices show the total, including taxes and any unavoidable fees, and claims like 'free' or 'guaranteed' are true. A ban on hidden fees and subscription traps starts on 1 July 2027.
9. People with disability can use it
Text alternatives on images, enough colour contrast, forms that work with a keyboard and screen reader. The Human Rights Commission points to WCAG 2.2 Level AA as the guide.
10. Automated decisions are disclosed
From 10 December 2026, businesses covered by the Privacy Act must explain in their privacy policy any significant decisions software makes about people, such as some quote tools, booking systems or chatbots.
11. The basics of security
HTTPS on every page, the platform and plugins kept up to date, multi-factor sign-in on the admin, hosting and domain accounts, and backups kept away from the site. These come from the ASD's guide to securing your website.
12. A plan for a data breach
Who decides whether a breach is serious, who tells the OAIC and affected people if the Privacy Act covers you, and who your web and hosting people are.
Who this checklist is for
- Owners who look after their own website and want to know what to check.
- Businesses with online forms, bookings, a shop or a newsletter.
- Health, legal, accounting and real estate businesses, which the Privacy Act can cover whatever their size.
- Anyone about to brief a web developer on a new site or a refresh.
How to work through it
- Start with what the site collects. Open every form, sign-up and booking page and write down what each one asks for and where it goes.
- Then check what runs in the background. Your web person can list the tracking tags, chat tools and plugins. Each one should be in the privacy policy.
- Compare the policy with what you found. Anything the site collects or sends that the policy doesn't mention is a gap to fix.
- Finish with security and accessibility. These take a closer look, and free scanners only catch part of the picture. Our guide on whether your website is safe explains what to check.
Want us to check it for you?
- Our website security and compliance audit works through this list, plus the security checks, and gives you a red, amber and green scorecard.
- The quick check is $290 ex GST, and the full audit with a fixed price for each fix is $890 ex GST.
- We're not lawyers. Where something needs a legal view, we'll say so and you can take the report to your lawyer.
Website compliance questions
Is there a law that says my website must be audited?
No. No Australian law requires a small business to audit its website. The rules on this page apply to what the website does, and the government's cyber security agencies recommend checking it regularly.
Do I need a cookie banner in Australia?
Australia has no cookie law like Europe's, so a banner isn't legally required. Tracking tags still need to be explained in your privacy policy, and if you do use a banner, its reject button should actually stop the tags.
We're under $3 million. Do we still need a privacy policy?
If the Privacy Act doesn't cover you, it isn't a legal requirement. It's still worth having one. Customers expect it, and the right to sue for a serious invasion of privacy isn't limited to businesses the Privacy Act covers. Our guide on whether your website needs a privacy policy covers this in more detail.
Can a free online scanner tell me if my site is compliant?
Only partly. Scanners can check things like HTTPS, security settings and some accessibility problems. They can't read your privacy policy against what your forms collect, or tell whether your newsletter sign-up follows the Spam Act.
Do the new online safety laws apply to my website?
Not yet. The Online Safety Amendment (Digital Duty of Care) Bill 2026 was introduced to Parliament on 15 October 2026 and hasn't passed. It would require online service providers to take reasonable steps to keep Australian users safe. As drafted it has no revenue, staff or user threshold, and COSBOA, the small business council, has asked for ordinary low-risk business websites to be exempt. We'll update this page when the law is settled.
How WaTo can help with this
Guides on this topic
- The privacy policy change coming on 10 December 2026
- Does my website need a privacy policy?
- Is my website safe?
- Website accessibility for small businesses in Australia
Sources & references
- OAIC: Privacy for small business
- OAIC: APP Guidelines, Chapter 1 (updated September 2026)
- OAIC: Tracking pixels and privacy obligations
- OAIC: Statutory tort for serious invasions of privacy
- ACMA: Avoid sending spam
- ACCC: Displaying prices
- Australian Signals Directorate: Secure your website
- Australian Signals Directorate: Small business cyber security handbook, protecting business and customer data
- Australian Human Rights Commission: Guidelines on equal access to digital goods and services
- Department of Infrastructure: Digital Duty of Care
- COSBOA: New online safety laws could create new hurdles for small business
WaTo Consulting. Last reviewed 2026-11-07. Review every six months, and after 10 December 2026 and 1 July 2027.
Rather have someone go through it with you?
Send us your web address and we'll book a fixed-price website check, with a scorecard you can act on.
Mon to Fri, 8:30am to 5pm
