The short answer: if your website collects any personal information — names, email addresses, phone numbers, enquiry details, payment information — you almost certainly need a privacy policy. In Australia, the Privacy Act 1988 (as amended by the Privacy Amendment (Notifiable Data Breaches) Act 2017) governs how businesses collect, use, store, and disclose personal information. Businesses with an annual turnover above $3 million are automatically covered. Smaller businesses may also be covered depending on the nature of the information collected or their business activities.
Beyond the legal requirement, a visible, accessible privacy policy builds visitor trust — particularly important for any website that collects contact form submissions, booking information, or payment details. Visitors who can’t find a privacy policy on a website they’re being asked to submit personal information to are more likely to abandon the form than visitors who can see it easily.
What a Privacy Policy Must Cover for an Australian Website
The Office of the Australian Information Commissioner (OAIC) provides guidance on what a compliant privacy policy should include. For a typical small business website, the key elements are:
What personal information you collect. Be specific — names, email addresses, phone numbers, IP addresses (collected automatically by analytics tools), payment details (if applicable).
How you collect it. Contact forms, enquiry forms, booking forms, cookies and analytics, direct conversations.
Why you collect it and how you use it. To respond to enquiries, to send marketing communications (only with consent), to process bookings or orders, to improve the website.
Whether you share it with third parties. If you use a CRM, an email marketing platform, a booking system, payment processing, or analytics tools — all of these involve sharing data with third parties. Your privacy policy should name the categories of third parties and, where reasonable, the specific services used.
How you store and protect it. What measures you take to protect personal information from unauthorised access or disclosure.
How individuals can access or correct their information. The Privacy Act gives individuals the right to access and correct personal information held about them — your policy should explain how to exercise this right.
Contact details for privacy enquiries. A specific email address or phone number for privacy-related questions or complaints.
Practical Considerations for Small Peninsula Businesses
For a small Peninsula service business with a simple contact form and Google Analytics, a privacy policy doesn’t need to be a lengthy legal document. A clear, plain-English document of four to six paragraphs that covers the above elements is more useful to visitors (and more likely to be read) than a twelve-page legal tome. Tools like the OAIC’s privacy policy generator, or templates from Australian business associations, provide a starting point that can be customised to your specific data practices.
If you use Google Analytics on your website (which we recommend for all clients), your privacy policy should specifically reference this and provide a link to Google’s privacy policy and the opt-out mechanism for Google Analytics tracking. This is a specific requirement of Google Analytics’ terms of service, not just Australian privacy law.
Every website built by Click Websites includes a privacy policy page — correctly linked in the footer and accessible from every page. We can also review the data practices of your specific website and ensure the policy accurately reflects what’s actually collected and how it’s used. Get in touch to discuss your website’s compliance requirements.
Frequently Asked Questions
Does my small business really need a privacy policy if I’m under the $3 million threshold?
Possibly — several categories of business are covered by the Privacy Act regardless of turnover, including health service providers (any allied health practice, pharmacy, or healthcare business), businesses that share personal information across state borders, and businesses that opt in to Privacy Act coverage. Additionally, if you collect sensitive information (health information, financial details), or if you’re required to meet privacy standards by a third-party platform (many payment processors and CRMs require privacy policy compliance), the threshold becomes less relevant. When in doubt, having a privacy policy is always the safer position.
Can I copy someone else’s privacy policy for my website?
Technically you can use a template, but copying another business’s privacy policy verbatim is problematic for two reasons: it may not accurately describe your actual data practices (which creates its own compliance problem), and it may contain incorrect claims about your business’s data handling. The most appropriate approach is to use a reputable template (OAIC, ACCI, or a law firm template) as a starting point, then customise it to accurately reflect your specific website’s data collection and handling practices.
Where should my privacy policy appear on my website?
The privacy policy should be linked in the footer of every page on your website (the industry standard location where users expect to find it), on any page with a form that collects personal information (with a “by submitting this form, you agree to our privacy policy” statement with a link), and in any email marketing you send (required under the Australian Spam Act for commercial communications). It should be a standalone page — not embedded in the terms and conditions document, where it’s harder to find.
Do I need a separate cookie policy?
Australian law doesn’t currently require a separate cookie policy or a cookie consent banner (unlike GDPR in Europe, which does). However, if you use analytics tools like Google Analytics, Facebook Pixel, or advertising cookies, your privacy policy should disclose this and explain how users can opt out. If you serve European users, or if your website platform requires cookie consent under its terms, a cookie consent mechanism may be required regardless of Australian law.
What’s the difference between a privacy policy and terms and conditions?
A privacy policy governs how you collect, use, store, and disclose personal information — it’s primarily about data protection rights. Terms and conditions (or terms of service) govern the legal relationship between your business and its clients — payment terms, service scope, intellectual property, dispute resolution, and other contractual matters. Both are different documents serving different purposes. For a small service business with a simple website, a privacy policy is a more urgent priority; terms and conditions become increasingly important as transaction value and complexity increase.
How often should I update my privacy policy?
Review your privacy policy whenever your data practices change: if you add a new form, integrate a new third-party service (a booking system, email marketing platform, CRM), or change how you store or use customer data. At minimum, an annual review ensures the policy remains accurate. The OAIC recommends dating your privacy policy and updating the date whenever substantive changes are made — allowing users to identify the current version. Significant changes should be communicated to existing contacts whose data you hold.
