Use this as a starting point before 10 December 2026. It is not a full audit, but it covers the points where we most often find gaps.

The checklist

  1. Work out if you are covered. Check turnover and the exceptions, including health services and trading in personal information.
  2. Find your privacy policy. Is it linked from every page, and is it dated within the last year?
  3. Match it to reality. List the tools on your site, such as analytics, ad pixels, chat widgets and forms, and check the policy mentions what they collect.
  4. Check overseas disclosure. Many common tools send data overseas. Your policy should say so.
  5. Look for automated decisions. If software decides prices, approvals, rankings or who gets contacted, note it. This is the change taking effect on 10 December 2026.
  6. Add a clear way to contact you about access, corrections and complaints.
  7. Have a breach plan. Know who decides and how you would notify the OAIC and affected people.
  8. Set a review date. Put a reminder in your calendar to check the policy every six months.

If you are short on time

Do items 2, 3 and 5 first. Those are the ones that most often lead to a non-compliant policy.

Where we can help

A free Instant Snapshot checks the public side of your website in about 30 seconds, and a Deep Scan checks it in detail and tells you exactly what to change.

This is general information, not legal advice. For advice on your own obligations, speak with a qualified privacy lawyer.