Website Privacy Policy Template (Australia)

Privacy Policy Requirements for Australian Websites

Australian websites need a privacy policy if the business collects personal information, and email addresses count. The Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles set the rules. Australian Privacy Principle 1.3 requires a clearly expressed and up to date privacy policy, available free of charge to anyone who asks.

Do I need a privacy policy on my website in Australia?

Yes, if your website collects personal information. Personal information includes names, email addresses, phone numbers, delivery addresses, IP addresses, and anything else that can reasonably identify someone.

• Contact forms and email signups – collecting a name and an email address is collecting personal information
• Online stores – checkout details, delivery addresses and order history
• Analytics, tracking pixels and chat widgets – IP addresses and behavioural data collected automatically, often without you setting it up deliberately

The Privacy Act currently exempts most businesses turning over less than $3 million a year, but that exemption is narrower than people assume and it is scheduled to be removed. It does not apply if you provide a health service, disclose personal information for a benefit, hold a Commonwealth contract, or are related to a covered company.

In our experience working with over 10,000 Australian businesses, the exemption rarely matters in practice. Shopify, Stripe, PayPal, Meta, Google and the Apple and Google app stores all require a published privacy policy before you can use them, regardless of your turnover.

How do I write a privacy policy for my website?

Start with what your business actually does, not with a template you found. List every tool that touches customer data: your website forms, email platform, payment processor, analytics, chat widget, booking system and cloud storage.

Then write the eight elements above against that list. Say where the data goes, including overseas. Use plain language, because Australian Privacy Principle 1.3 requires the policy to be clearly expressed.

Most business owners get stuck at the overseas disclosure and automated decision sections, because that means auditing tools they never chose deliberately. Our online form asks the questions for you and builds those clauses from your answers.

What a free privacy policy template cannot do

A free template gives you a document. It does not give you the three things that actually protect you.

It cannot keep up with your business. Every free template is a snapshot. The moment you add a booking system, an email list, a payment processor or an AI tool, the document is out of date and nobody tells you.

It cannot keep up with the law. Australian privacy law has moved twice in two years and it is not finished.

The statutory tort for serious invasions of privacy commenced on 10 June 2025. It applies to entities that are not even covered by the Australian Privacy Principles, so the small business exemption is no defence to being sued by a customer directly.

Since 11 December 2024 the Office of the Australian Information Commissioner (OAIC) has been able to issue infringement notices and compliance notices without running a full determination first.

From 10 December 2026, privacy policies must disclose automated decision-making. If any computer program helps decide something about a person, your policy must say what information it uses and what kinds of decisions it makes.

The $3 million small business exemption is still in force, but it is scheduled for removal. When it goes, roughly 2.3 million more Australian businesses come into full obligations.

It cannot show that you took it seriously. In February 2026 the Administrative Review Tribunal handed down its decision on Bunnings and facial recognition technology. Bunnings won the hard question, because the Tribunal accepted it was entitled to use the technology to deal with serious retail crime.

Bunnings lost on the paperwork. The Tribunal found the use was not properly notified to customers and that appropriate policies and procedures were not in place to govern it. A national retailer with a full legal department was right on the substance and still lost on the documents.

What privacy policy is required for a website?

An Australian website privacy policy must set out eight things. Each one comes directly from the Australian Privacy Principles.

Each of the eight elements below comes directly from the Australian Privacy Principles:

• Identity: your business name, ABN or ACN, and contact details
• Collection: what personal information you collect and how you collect it
• Purpose: why you collect it, and how you use and disclose it
• Storage and security: how you protect it from misuse, loss and unauthorised access
• Overseas disclosure: which countries you are likely to send personal information to
• Access and correction: how someone asks to see or fix the information you hold about them
• Complaints: how someone complains about a privacy breach, and how you will handle it
• Automated decisions: what personal information feeds computer programs that make decisions about people, and what kinds of decisions they make. This applies from 10 December 2026.

Miss any of these and your policy is not compliant, even if it reads well. Failing to keep a clearly expressed and up to date policy containing everything required under Australian Privacy Principle 1.4 carries penalties of up to $66,000.

Cross-border disclosure is where most Australian privacy policies fall down. If you use Google Analytics, Mailchimp, Klaviyo, Shopify, Stripe or almost any cloud host, personal information is leaving Australia and Australian Privacy Principle 8 requires you to say so.

Can you provide an example of a website privacy policy?

Yes. The sample above shows page one of the Website Privacy Policy Template as it is generated, so you can see the structure and language before you buy.

Be careful copying a published privacy policy from another website. It describes their business, their tools and their overseas disclosures, not yours. Copying it word for word usually creates the exact problem it was meant to solve, because the document no longer matches what you actually do.

The generated document also gives you the plain-language wording the Australian Privacy Principles require. A policy that is technically complete but unreadable still fails Australian Privacy Principle 1.3.

Which Australian states and territories does it cover?

All of them. Privacy for private sector businesses is governed federally by the Privacy Act 1988 (Cth), so one policy covers New South Wales, Victoria, Queensland, Western Australia, South Australia, Tasmania, the Australian Capital Territory and the Northern Territory.

You do not need a different privacy policy for each state. You do need one written for Australian law, which is why an American or British template will not do the job.

State-based privacy laws do exist, but they apply to state government agencies and their contractors rather than to ordinary private sector businesses. If you run a business website, the Privacy Act 1988 is the law that applies to you.

Where to put your privacy policy on your website

A privacy policy only works if people can actually find it. Australian Privacy Principle 1.5 requires you to make it available free of charge and in an appropriate form.

• Footer Links: Create a separate page for your Privacy Policy and link to it from the footer on every page of your website.
• Contact Forms: Include “By submitting, you agree to our Privacy Policy” with a clickable link.
• Email Signup: Link to your Privacy Policy next to every email capture box.
• Checkout: Link to your Privacy Policy on the checkout page, alongside your Terms and Conditions.
• Cookie Popup: Display a cookie consent pop-up when visitors first arrive if you use tracking tools, and link the Privacy Policy from it.

Review the policy whenever your data handling practices change. That is the step almost everybody skips, and it is the step that turns a compliant policy into a non-compliant one.