It depends on whether your business is covered by the Privacy Act, but there are other reasons to publish one even if you are not.
If you are covered by the Privacy Act
Yes. A covered business must have a clearly expressed and up-to-date privacy policy and make it available, usually free of charge and in a form people can easily find. See our article on whether your business is covered.
If you think you are exempt
The small business exemption applies to many businesses with annual turnover under $3 million, but several exceptions apply regardless of size, including businesses that provide health services or trade in personal information. If you are not sure, treat that as a warning.
Other reasons to have one
- Google Analytics, Google Ads and other advertising tools require you to disclose how data is collected
- Many app stores, payment providers and email platforms expect a policy link
- Customers and larger business partners often look for one before they trust a site
- If you sell to people overseas, other laws may also apply
What it should say
It should describe what you collect, why, who you share it with, how people can access or correct it and how to complain. It must match reality: if your site runs tracking tools or contact forms, the policy should say so.
Where to put it
Link it from the footer of every page and from any form that collects personal details.
This is general information, not legal advice. For advice on whether a policy is required for your business, speak with a qualified privacy lawyer.