What Privacy Policy Do I Need for My Website?

In Short

• Many Australian businesses must have a privacy policy if they are covered by the Australian Privacy Principles.
• A privacy policy must clearly explain what personal information you collect, why, and how you handle it.
• Using generic or outdated policies can create compliance risks.

Tips for Businesses

Check if your business is an APP entity and assume privacy obligations may expand. Write a policy that matches your real practices, not a copied template. Be clear about what you collect and why. Keep it updated as your business changes and make it easy to find on your website.

Summary

This article explains privacy policy requirements for business owners operating websites in Australia and outlines what the law expects. It is prepared by LegalVision’s business lawyers, and LegalVision, a commercial law firm, specialises in advising clients on privacy and data protection law.

Summarise with:

ChatGPT Gemini Perplexity Microsoft Copilot

Open now

---

Table of Contents

• Do I Need a Privacy Policy?
• What Should My Privacy Policy Include?
• Common Mistakes to Avoid
• Key Takeaways
• Frequently Asked Questions

If you are running a business, you are probably collecting personal information. You might be gathering names, email addresses, payment details or tracking website visits. This article will explain whether you need a privacy policy, and if so, what information you should include.

Do I Need a Privacy Policy?

If your business is an APP entity, you are legally required to have a privacy policy. This means you must comply with Australian Privacy Principles (APPs). You are an APP entity if your business generates over $3 million in annual turnover, or if you earn less than $3 million in annual turnover, but you:

• provide health services and hold health information (like medical centres and gyms);
• buy or sell information; or
• are a service provider for the Australian government.

Regardless, it is best practice to set your business up to comply with the principles before you need to. A privacy policy builds trust with your customers, as it shows you take their privacy seriously.

Notifiable Data Breach Factsheet

This factsheet explains what a data breach is and when one is serious, your reporting obligations, and limiting an NDB’s impact.

Download Now

What Should My Privacy Policy Include?

The APPs set out specific information that your privacy policy must include. Your policy needs to be clear, up-to-date, and written in plain English so that your customers can easily understand it. 

The Six Essential Elements

Your privacy policy must cover six key topics:

1. what information do you collect? (like names, addresses, payment details, or health information);
2. how do you get it? (directly from customers, through your website, or from third parties);
3. why do you need it? (such as processing orders or customer service);
4. can customers see and fix their information? (how they can access their personal information and ask you to correct it);
5. what if something goes wrong? (how someone can make a complaint if you breach the APPs and how you will handle it); and
6. do you send information overseas? (whether you disclose personal information to overseas recipients and, if so, which countries).

Make it Clear and Specific

Your privacy policy should reflect how your business actually operates. Do not use vague terms like ‘we may collect information’. Be specific about what information you collect and why you need it. 

Information Your Customers Want to Know

Think about what your customers care about, such as:

• what information are you collecting about them and why; and
• are you sharing it with anyone else, especially overseas companies? 

If you use contractors or service providers who access customer information, say so. Give customers a general overview of how you protect their information.

Make it Easy to Find

The standard practice is to put a link to your privacy policy in the footer of your website, where it is easy to find on every page.

You also need to make your policy available in different formats if someone asks for it. 

Common Mistakes to Avoid

Common mistakes include:

• copying a template privacy policy;
• saying ‘we may collect information’ when you do collect it; and
• not keeping your policy up to date.

Key Takeaways

If your business is an APP entity, you must have a privacy policy. Even if you are not legally required to have one, it is best practice to create one to build customer trust and prepare for business growth.

Your privacy policy must cover six essential elements: 

• what information do you collect; 
• how you collect it; 
• why you use it;
• how customers can access and correct their information; 
• how to make complaints; and 
• whether you disclose information overseas.

LegalVision provides ongoing legal support for Australian businesses through our fixed-fee legal membership. Our experienced lawyers help businesses manage contracts, employment law, disputes, intellectual property and more, with unlimited access to specialist lawyers for a fixed monthly fee. To learn more about LegalVision’s legal membership, call 1300 544 755 or visit our membership page.

Frequently Asked Questions