If your business is covered by the Privacy Act, you need a clearly expressed, up-to-date privacy policy. Many businesses have one that was copied from a template years ago and never touched again. That is the version most likely to cause trouble.
What the law asks for
Australian Privacy Principle 1 requires a covered business to manage personal information openly and transparently, and to have a privacy policy that is clear and kept current. The policy should be easy to find, and in practice that means a link in your website footer.
What a policy should include
- The kinds of personal information you collect and hold
- How you collect it, for example forms, cookies, email, phone or third parties
- Why you collect, hold, use and disclose it
- How a person can access and correct their information
- How a person can complain, and how you deal with complaints
- Whether you disclose information overseas, and if so to which countries where practicable
What changes on 10 December 2026
From 10 December 2026, businesses that use automated decision-making which significantly affects people also need to say so in their privacy policy. If you use software that decides who gets a quote, a price, an approval or a priority, your policy needs to describe that. Our article on ADM transparency covers this in detail.
Gaps we see most often
- The policy was written before the business started using analytics, advertising pixels or AI tools
- It lists no overseas disclosure even though the business uses overseas software providers
- There is no complaints process, or no contact details to use
- It cannot be found from the homepage
- It has not been reviewed since it was first published
How to check yours
Read your policy against the list above, then compare it with what your website actually does. A free Instant Snapshot runs a quick check of your public pages, and a Deep Scan goes further.
This is general information, not legal advice. For advice on your own obligations, speak with a qualified privacy lawyer.