Privacy Policy for a Small Business Website in Australia
Published:
Reading time:
Category:
Content
Many Australian small businesses with annual turnover of $3 million or less are not covered by the Privacy Act, but some are covered regardless of size, including health service providers. If you are covered, you must have a clearly expressed privacy policy, usually published on your website. Even if you are not, a short privacy policy is a good idea whenever your website collects names, phone numbers or emails, or uses tools such as analytics and ad tracking.
Does the Privacy Act apply to my small business?
The OAIC says a small business for Privacy Act purposes has annual turnover of $3 million or less, and these businesses are generally not covered (OAIC). Some are covered regardless of turnover:
| Covered regardless of turnover | Examples |
|---|---|
| Health service providers | Physios, chiropractors, psychologists, pharmacists, complementary therapists, child care centres |
| Businesses that trade in personal information | Buying or selling customer lists |
| Commonwealth contractors | Businesses providing services under a federal government contract |
| Related to a covered business | A small company owned by a larger covered company |
| Businesses that opt in | Small businesses that choose to be covered |
The OAIC lists several other categories too, such as credit reporting bodies and residential tenancy database operators (OAIC). If you are unsure, use the OAIC's small business checklist on that page.
What must a privacy policy include?
If you are covered, Australian Privacy Principle 1 says your privacy policy must cover (OAIC):
- The kinds of personal information you collect and hold
- How you collect and hold it
- Why you collect, hold, use and disclose it
- How people can access their information and ask you to correct it
- How people can complain about a breach, and how you will deal with the complaint
- Whether you are likely to send personal information overseas
- If so, which countries, where it is practical to say
The policy must be available free of charge and in an appropriate form. The OAIC says this is usually done by publishing it on your website (OAIC).
Why have one even if you are exempt?
- Your contact and quote forms collect names, phone numbers, emails and sometimes photos of a customer's home.
- Analytics, Meta Pixel and Google Ads tags collect data about visitors, and these tools expect you to tell visitors you use them.
- Customers, larger clients and councils increasingly ask how you handle data before they work with you.
- If you grow past $3 million turnover, or start offering a service that brings you under the Act, the policy is already in place.
What does a plain-English small business privacy policy look like?
An outline to adapt (not a template to copy without checking):
| Section | What to write |
|---|---|
| Who we are | Business name, ABN, contact email and phone |
| What we collect | Name, phone, email, address and job details from forms and calls; website usage data from analytics |
| Why | To reply to enquiries, quote, do the work, send invoices and improve the website |
| Who we share it with | Software we use (email, accounting, booking, hosting), and nobody else unless the law requires it |
| Overseas | Whether any of those providers store data outside Australia, and where |
| Cookies and tracking | Which tools you use, such as Google Analytics or Meta Pixel |
| Access and correction | How to ask for a copy of your information or fix it |
| Complaints | Who to contact, how fast you respond, and that people can contact the OAIC if unhappy |
| Updates | The date the policy was last updated |
Where should the privacy policy go on your website?
- A link in the footer of every page
- A short note under every form: "We'll only use your details to reply to your enquiry. See our privacy policy."
- A link in any email sign-up or SMS consent wording. For marketing messages, see email and SMS marketing rules.
What about health and NDIS businesses?
Health service providers are covered by the Privacy Act regardless of turnover (OAIC). Health information is also sensitive information, so the rules on collecting and using it are stricter. If you run a clinic, allied health practice or support service, get your privacy policy checked properly. See NDIS provider websites and Ahpra advertising rules for websites.
What should you avoid?
- Copying a large company's privacy policy that describes data you don't collect
- Saying you never share data if your email, booking and accounting tools are cloud services
- Hiding the link where nobody can find it
- Never updating it after adding new tools or forms
General information, not legal advice. If you handle health, financial or children's information, speak to a lawyer.
What changes on 10 December 2026?
From 10 December 2026, businesses covered by the Privacy Act that use personal information in automated decision-making with the potential to affect people's rights or interests must explain this in their privacy policy, including the kinds of personal information used and the kinds of decisions involved (OAIC).
For most tradies and local service businesses, this won't change much. Booking a job or sending an automatic reminder isn't the kind of decision the new rule is aimed at. It's more likely to matter if software automatically decides things like:
- Whether a customer qualifies for finance or a payment plan
- Whether to accept or reject a booking, membership or application
- Pricing for an individual customer based on their personal details
If you're covered and use tools like these, check the OAIC's guidance and update your policy before that date. If you're not sure, ask your lawyer or software provider. This section is time-sensitive; recheck it when you publish.
What happens if customer data is lost or hacked?
Businesses covered by the Privacy Act are also covered by the Notifiable Data Breaches scheme. If you suspect a data breach, such as a hacked email account full of customer quotes or a lost laptop, you need to assess it quickly; the OAIC's guidance works to a 30-day limit for that assessment. Eligible data breaches must be reported to the OAIC and to the people affected (OAIC).
Even if you're exempt, a breach can hurt your reputation badly. Simple steps help:
- Turn on two-step verification for email, website, accounting and booking logins
- Don't keep customer details in places you don't need them, such as old spreadsheets on personal laptops
- Delete old quote photos and form enquiries you no longer need
- Make sure ex-staff lose access to shared inboxes and accounts on their last day
What should you say about cookies and tracking?
Most small business websites use at least one tracking tool, often without the owner knowing. Before writing this part of your policy, list what your site actually uses:
| Tool | What it does | What to say in your policy |
|---|---|---|
| Google Analytics | Counts visits and what people do on the site | That you use it to understand how the site is used, and that it uses cookies |
| Google Ads or Meta Pixel | Measures ad results and builds ad audiences | That you use advertising tools that may track visits for ads |
| Embedded maps or videos | Load content from Google or YouTube | That third-party content may set its own cookies |
| Chat or booking widgets | Collect messages and booking details | Which provider handles them and where data may be stored |
Ask your web developer for a list of every script on your site. For setting up analytics properly, see Google Analytics 4 for business owners.
How do you keep the policy up to date?
A privacy policy goes stale quickly when you add new tools. Build a simple review into your routine:
| When | What to check |
|---|---|
| You add a new form, app or website tool | Does it collect new information or send data overseas? Update the policy |
| You change booking, email or accounting software | Update the list of providers and where data is stored |
| Once a year | Read the policy end to end and change the "last updated" date |
| When the law changes | Check the OAIC website, especially around the 10 December 2026 changes |
Keep a copy of each old version with its date. If anyone ever questions what your policy said at a certain time, you'll have the answer.
Next step
Morphic builds small business websites with a privacy policy page, form consent notes and footer links included. Get a free quote, or book a 30-minute call.
Related service. website design.
Related reading: What Must an Australian Business Website Show?, Website Accessibility in Australia and Who Owns Your Website?.
Title 13 to Title 15 and Main Content 13 to Main Content 15: leave empty.
Related reading. contact form best practices.
Key Takeaways
Many small businesses with turnover of $3 million or less are exempt from the Privacy Act.
Health service providers and some other businesses are covered regardless of turnover.
A covered business's privacy policy must explain what it collects, why, sharing, access, complaints and overseas transfers.
Even exempt businesses benefit from a short, honest privacy policy linked in the footer and under forms.
Update the policy whenever you add new forms or tracking tools.
Emon Datta
Founder, Morphic Agency
Morphic Agency is a Melbourne-based UX design agency. We've shipped 50+ products across 15+ countries.
