Yes, most Australian websites need a privacy policy, and the requirement comes straight from the Privacy Act 1988. If your business is covered by the Australian Privacy Principles, APP 1 says you must have a clearly expressed, up-to-date privacy policy, and the Office of the Australian Information Commissioner (OAIC) is the authority that sets out exactly what it must say and where it must sit on your site.
TL;DR:
- Most Australian businesses must have a clear privacy policy if they collect personal data or offer goods and services locally, regardless of turnover.
- Privacy policies must detail the types of personal information collected, how it’s stored, the purpose, third-party sharing, and overseas data transfers.
- Placement and accessibility are crucial; the policy should be linked in footers and forms, with records kept of its publication and updates.
- Policies should be regularly reviewed for changes in data collection tools or processes, especially when integrating new analytics or moving data offshore.
Table of Contents
- What must an APP privacy policy include?
- Who actually needs a privacy policy in Australia?
- How to publish your privacy policy so it’s actually accessible
- How to describe cookies, analytics and overseas data transfers
- Keeping your policy current: a practitioner’s checklist
- How CantyDigital fits privacy policies into real websites
- Want your privacy policy built into your website properly?
- Where to go for the official rules and a ready-made template
- Sources
What must an APP privacy policy include?
A privacy policy that meets APP 1.3 and 1.4 isn’t a vague paragraph bolted onto your footer. It has to spell out specific things, in plain language, so a visitor genuinely understands what happens to their data.
Run your draft against this list before you publish anything:
- Kinds of personal information you collect and hold, including names, emails, payment details, and behavioural data from analytics tools.
- How it’s collected and held, covering contact forms, checkout pages, cookies, and any third-party tracking scripts running on your site.
- Why you collect it and what you use it for, plus who you might disclose it to and for what purpose.
- Access and correction procedures, with a real contact point (name, email, or role) people can use to ask what you hold on them.
- Complaint handling, explaining how someone lodges a complaint and what happens to it internally.
- Overseas disclosures, stating whether data is likely to go offshore and, where practical, naming the countries.
Most small businesses get the first four right and skip the last two entirely, which is exactly where a generic template falls over.
A smart way to structure all this is the layered approach OAIC recommends: a short summary at the top for people who just want the gist, the full detailed policy underneath, and separate collection notices on forms where you’re gathering something sensitive, like a health questionnaire or a job application. It’s more work upfront, but it stops your policy reading like a wall of legal text nobody will ever finish.
Who actually needs a privacy policy in Australia?
Not every website operator is legally on the hook, but the exceptions are narrower than most people assume. The $3 million annual turnover threshold catches most established businesses, but certain organisations are covered no matter what they turn over: health service providers, businesses that trade in personal information (think data brokers or list sellers), and a handful of other specified categories.
Turnover aside, three practical signals suggest you’re covered: you have an Australian business link, you collect information from people physically in Australia, or you offer goods and services to Australian customers even if you’re based elsewhere. If you’re near the turnover line, handle health or sensitive data, or you’re unsure how the threshold applies to your structure, that’s the point to get proper legal advice rather than guess.
How to publish your privacy policy so it’s actually accessible
Having a well-written policy means nothing if nobody can find it. APP 1.5 requires you to take reasonable steps to make the policy available free of charge, and for most websites that means publishing it online in an obvious spot, not burying it three clicks deep.
Practical placement checklist:
- Link it in your site footer on every page, ideally with a labelled “Privacy Policy” link rather than a generic icon.
- Add a direct link on sign-up forms, checkout pages, and anywhere you collect an email address.
- Structure it in layers: a plain-language summary, the full policy, and specific collection notices where relevant.
- Keep a record of the steps you’ve taken to make it available. If someone requests the policy in a different format, APP 1.6 requires you to provide it on reasonable request, whether that’s a printed copy, a plain-text email, or an accessible PDF for screen readers.
Pro Tip: Keep a simple log, even just a spreadsheet, noting when the policy was published, updated, and where it’s linked from. If a complaint ever lands on your desk, that record shows you took the accessibility requirement seriously.
Don’t forget non-English speakers either. If a meaningful chunk of your customers read a language other than English, a translated summary goes a long way toward genuine transparency, even if the full legal text stays in English.
How to describe cookies, analytics and overseas data transfers
This is the section where most DIY privacy policies fall apart, because it requires you to actually understand what your website is doing behind the scenes.
Cookies themselves aren’t automatically “personal information,” but the data they help collect (device IDs tied to a browsing profile, for instance) often is. So rather than a one-line “we use cookies” disclaimer, describe what they’re actually for:
- Analytics tools (Google Analytics and similar) that track visitor behaviour, and whether that data is aggregated or identifiable.
- Marketing pixels from platforms like Meta or LinkedIn that follow visitors for ad targeting.
- Third-party plugins, like live chat widgets or booking systems, that might send data to their own servers.
If any of these tools store or process data outside Australia, the APP guidelines require you to disclose that overseas transfer and name the countries involved where it’s practical to do so. Most analytics and hosting providers publish where their servers sit, so check their documentation rather than guessing.
Keeping your policy current: a practitioner’s checklist
A privacy policy isn’t a set-and-forget document. It needs a trigger-based review, not just an annual glance.
- Set review triggers. Update the policy whenever you add a new analytics provider, integrate an AI chatbot, move data offshore, or bring on a new marketing automation platform.
- Skip the copy-paste template. OAIC guidance is blunt about this: a generic policy that doesn’t reflect your actual data flows can be misleading, which defeats the purpose of having one.
- Document your accessibility steps. Note where the policy is linked, when it was last updated, and how you’d respond to a format request.
- Know your breach obligations. If personal information is compromised, Business.
Pro Tip: Put a recurring calendar reminder every time you sign up for a new tool that touches customer data. That five-minute check is cheaper than a retrofit six months later.
How CantyDigital fits privacy policies into real websites
Drafting the words is only half the job. CantyDigital’s website builds map out where personal data actually flows through a site, then structure the policy copy in layers, wire up cookie consent, and check the whole thing against accessibility standards before launch. When wording needs genuine legal certainty, that gets handed to a qualified lawyer. As a Wix Partner working across Australian small business sites for over a decade, CantyDigital treats the policy as part of the site build, not an afterthought bolted on at the end.
Want your privacy policy built into your website properly?
CantyDigital is an alternative to hiring a law firm just to get your privacy policy live and working. You still need a lawyer for the legal wording if your situation is complex, but the placement, the cookie consent banner, the layered structure, the footer links, the accessible formats. All of that is implementation work, and it’s exactly what falls through the cracks when a template gets emailed to you and nobody sets it up properly.
CantyDigital can audit your current site, flag where your privacy policy is missing, hard to find, or disconnected from your actual cookie setup, and fix the technical side while you or your lawyer handle the legal wording. If you’re rebuilding or launching a site anyway, this gets baked in from day one rather than patched in later. Check out CantyDigital’s website design services or reach out through the main site to get a straightforward audit started.
Where to go for the official rules and a ready-made template
Start with the OAIC’s Australian Privacy Principles for the legal detail, the APP 1 guidelines for drafting notes, Business for small business steps, and the Business Victoria template for a downloadable starting draft.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
- Read the Australian Privacy Principles | OAIC
- Chapter 1: APP 1 — Open and transparent management of personal information (APP guidelines)
- Business
- Privacy policy template — Business Victoria