Your privacy policy sits in the footer of your website. A collection notice sits right next to the place where someone types in their name and email. They do different jobs, and covered businesses are expected to have both.
What a collection notice is
Under Australian Privacy Principle 5, if you collect personal information you must take reasonable steps to let the person know certain things, at or before the time you collect it (or as soon as practicable afterwards). On a website that usually means a short notice beside the form, linked to the full policy.
What it should cover
- Who you are and how to contact you
- What you are collecting and how
- Why you are collecting it, in plain words
- Who you usually share it with, such as payment, email or software providers
- Whether the information may go overseas, and to which countries if practical
- What happens if the person chooses not to provide it
- Where to find your privacy policy, including how to ask for access, correct details or make a complaint
Keep it short and visible
A collection notice is not a wall of legal text. Two or three plain sentences and a link to the full policy is a good pattern. Put it next to the submit button, not on a page nobody visits.
A simple example
"We collect your name and email so we can send your report and reply to your questions. We share it with our email provider to do this. Some of our providers are overseas. See our privacy policy to learn how to access or correct your details or make a complaint."
What to do this week
- List every form on your site: contact, sign-up, checkout, booking, quote
- Add a short notice beside each one that links to your privacy policy
- Check the notice matches what you actually do with the data
This is general information, not legal advice. If you are unsure how this applies to your business, speak with a qualified privacy lawyer and see the OAIC guidance.