Reading time: 8 minutes

Starting a business comes with many important considerations and decisions to make. But, you must address your privacy obligations from the start. This can save you from needing to make significant structural and operational adjustments at a later time. This article outlines 10 key tips for designing your business with privacy in mind.

1. Develop a Privacy Policy

It is good practice to develop a privacy policy when you are setting up the business. This is because it provides motivation to consider: 

  • what personal information you are collecting;
  • how you are using it; and
  • who you will disclose it to.

A lawyer can help you with considering these points and preparing a privacy policy for your business. Alternatively, if you are tight on funds and your business does not provide a health service or buy or sell personal information, you may wish to start with a template document and update it for your business. You should later have a lawyer review or redraft this template to make sure it is legally right for you.

Once your privacy policy is prepared, you should make it freely and easily accessible. Such as via a link on the footer of your website.

2. Design Your Business to Provide Control Over Privacy

During the design phase of your business, you will make decisions such as: 

  • what personal information you will collect; and
  • how you will collect it. 

Thinking about privacy when you make these decisions can help you build privacy into the structure of your business. 

For example, if you are developing an app, you may choose to have the privacy settings pop up as part of the sign-in process. This will allow users to become familiar with them and make privacy choices before they start using the app.

3. Only Collect the Personal Information You Need

You should only collect personal information which is necessary to a function or activity of your business. 

For example, if you sell t-shirts, you do not need to know the buyer’s date of birth. However, if you decide to offer a birthday discount on your t-shirts, you may need to collect dates of birth, but you should make this feature optional.

You should also delete or de-identify personal information when you no longer need it. 

For instance, if you need to verify someone’s identity and you collect an identification document to do this, such as a drivers licence, you should delete the document once you have verified their identity.

4. Keep Your Customers Informed

When you collect personal information, make sure the person you are collecting information about is aware of your privacy policy.

For example, if you are collecting information through a form on your website, you should have a statement such as the following that hyperlinks to your privacy policy:

‘We collect and handle your personal information in accordance with our privacy policy.’ 

You can alternatively use a collection notice to notify the person about the key details of the collection. A collection notice does not replace a privacy policy. It is an additional short-form document which is helpful to use when notifying individuals that you have their personal information.

A collection notice should refer the reader to your privacy policy for more information and should have a statement similar to that below:

‘See our collection notice for information about how we collect and handle the personal information you input into our webform.’ 

If you update your privacy policy, you should notify customers of this change.

Tip 5: Only Use Personal Information for Permitted Purposes

When using personal information, think about why you collected that personal information. 

For example, if you collected the information to create an account for a customer on your investment software, the customer will not want you to use their information to create a publicly available database of marketing contacts. Therefore, you should not do so unless they consent to this. However, in contrast, they may expect you to disclose their personal information to your payment processor to process their payments for the software. 

If you want to use personal information for a new purpose which is unrelated or would be unexpected, you should obtain the individual’s consent. You can do this by letting them know what you plan to do and asking if they agree to this. 

6. Know What Privacy Rights Individuals Have

Individuals that you collect personal information from may have privacy rights. You should know what: 

  • these rights are; and
  • you have to do if someone asks to exercise a privacy right.

Some of these rights include:

Right to Correction

An individual may ask you to correct the personal information that you hold about them. If someone asks you to update their personal information because it is out of date or incorrect, you should do so. You should not impose a fee to correct personal information.

Right to Access

An individual may ask for access to the personal information that you hold about them. It is acceptable to charge a reasonable fee which reflects the true administrative costs to carry out this request. In some circumstances, you can refuse a request. However, you generally must provide access to the personal information you hold about that person after receiving a request.

Right to Anonymity

You should provide the option for your customers to remain anonymous unless it is impractical for you to do so. 

For example, if you hire out cars, it is impractical for you not to identify that person. In comparison, if you offer an online computer game, you do not need to have identifiable information about your users if they can enter a player name.

7. Use Your Contracts to Manage Privacy

Where you use a third party to assist you in providing your products or services, you need to be aware of how they handle personal information. 

For instance, if you work with a digital marketing company to assist with your marketing campaigns, they might need to access your customer databases. Your contracts with the company should set out that they can only access that information to provide digital marketing services. They also should agree to comply with applicable privacy laws

If you are working with third parties located overseas, it is especially important that you have contracts in place with them regarding correctly handling personal information. This is because you may be responsible for the actions of overseas businesses that handle personal information on your behalf. You may have a legal obligation to take reasonable steps to protect any personal information you share with third parties located outside Australia. 

8. Securely Store All Personal Information

Data breaches are a common risk which could bring significant reputational damage to your company. You should make sure that you have stored all personal information securely and safely send it to others when necessary. You can do this by: 

  • using encryption;
  • installing anti-virus software;
  • regularly updating all online tools which handle personal information;  
  • requiring password protection for all business files; or
  • requiring two-factor authentication.

If your business does suffer a data breach, you should act quickly to stop the breach and mitigate any damage. You should also seek legal advice about whether there are further actions you need to take.

9. Train Your Staff on How to Handle Personal Information

Many data breaches are caused by human error, such as sending an email to the wrong address. You can reduce the risk of these types of data breaches occurring by running privacy training for staff. You should hold training at the beginning of their engagement then hold refreshers throughout their employment.

Training should focus on:

  • the appropriate ways to handle personal information;
  • the requirement to inform individuals of personal information collection; and
  • how to respond to requests by customers to exercise their privacy rights.  

You may also wish to put a privacy manual in place to educate staff on privacy practices. This is a useful resource for staff to read as part of onboarding and refer back to when necessary. It also demonstrates that you are taking steps to consider privacy within your business.

10. Regularly Review Your Privacy Practices

The information you collect and the activities of your business will constantly be evolving. It is therefore crucial to: 

  • regularly reflect on privacy; 
  • receive up to date legal advice; and 
  • review all privacy documents at least once every 12 months.

You should carry out a privacy impact assessment if you embark on a new activity which involves: 

  • innovative technology;
  • collecting personal information in large quantities; or 
  • collecting sensitive information such as ethnicity, religion, sexual preference or health information.

A privacy impact assessment is a formal written review of: 

  • your plans;
  • any privacy risks; and 
  • the way you plan to mitigate or avoid any risks. 

Key Takeaways

Setting up your business with privacy in mind allows you to get on top of your privacy requirements early on. This means that you will have less need to make structural changes in the future to account for privacy. It also shows your customers that you care about privacy. The 10 tips outlined above touch on some of the core principles of privacy compliance in Australia. If you have any questions about your privacy requirements as a startup, contact LegalVision’s privacy lawyers on 1300 544 755 or fill out the form on this page. 


How Franchisors Can Avoid Misleading and Deceptive Conduct

Wednesday 18 May | 11:00 - 11:45am

Ensure your franchise is not accused of misleading and deceptive conduct. Register for our free webinar today.
Register Now

New Kid on the Blockchain: Understanding the Proposed Laws for Crypto, NFT and Blockchain Projects

Wednesday 25 May | 10:00 - 10:45am

If you operate in the crypto space, ensure you understand the Federal Government’s proposed licensing and regulation changes. Register today for our free webinar.
Register Now

How to Expand Your Business Into a Franchise

Thursday 26 May | 11:00 - 11:45am

Drive rapid growth in your business by turning it into a franchise. To learn how, join our free webinar. Register today.
Register Now

Day in Court: What Happens When Your Business Goes to Court

Thursday 2 June | 11:00 - 11:45am

If your business is going to court, then you need to understand the process. Our free webinar will explain.
Register Now

How to Manage a Construction Dispute

Thursday 9 June | 11:00 - 11:45am

Protect your construction firm from disputes. To understand how, join our free webinar.
Register Now

Startup Financing: Venture Debt 101

Thursday 23 June | 11:00 - 11:45am

Learn how venture debt can help take your startup to the next level. Register for our free webinar today.
Register Now

About LegalVision: LegalVision is a commercial law firm that provides businesses with affordable and ongoing legal assistance through our industry-first membership.

By becoming a member, you'll have an experienced legal team ready to answer your questions, draft and review your contracts, and resolve your disputes. All the legal assistance your business needs, for a low monthly fee.

Learn more about our membership

Need Legal Help? Submit an Enquiry

If you would like to get in touch with our team and learn more about how our membership can help your business, fill out the form below.

Our Awards

  • 2020 Innovation Award 2020 Excellence in Technology & Innovation Finalist – Australasian Law Awards
  • 2020 Employer of Choice Award 2020 Employer of Choice Winner – Australasian Lawyer
  • 2020 Financial Times Award 2021 Fastest Growing Law Firm - Financial Times APAC 500
  • 2020 AFR Fast 100 List - Australian Financial Review
  • 2021 Law Firm of the Year Award 2021 Law Firm of the Year - Australasian Law Awards
  • 2019 Most Innovative Firm - Australasian Lawyer