This is general information rather than legal advice, and if you handle sensitive data you should speak to a lawyer. That said, most Australian small business owners have the same question and can get a reasonable picture without one.
Who the Privacy Act applies to
The Privacy Act 1988 applies to most organisations with annual turnover above three million dollars, plus certain others regardless of size — including businesses handling health information, trading in personal information, or providing certain services. Many small businesses fall outside it.
Why smaller businesses usually publish one anyway
Being outside the Act does not mean a policy is pointless. Several practical pressures push in the same direction.
- Google Ads and Analytics terms require disclosure of data collection
- Payment processors and many platforms require one to onboard
- Customers increasingly look for it, and its absence reads as careless
- If you grow past the threshold you will need one regardless
- Overseas visitors may bring other jurisdictions into play
Cookie consent in Australia
Australia has no direct equivalent of the EU cookie consent regime, which is why many Australian sites do not show consent banners. If you have European visitors, GDPR may apply to how you handle their data. Most Australian small businesses serving Australian customers are not required to run the banner style common on European sites.
What a policy should actually cover
Plain language beats legal boilerplate copied from another site — particularly boilerplate referencing legislation that does not apply here. Cover what you collect, why, how it is stored, who it is shared with, how long you keep it, and how someone can request or correct their data.
Frequently asked questions
Do I legally need a privacy policy in Australia?
It depends on turnover and what data you handle. Many small businesses are outside the Privacy Act, but platform requirements and customer expectations mean most publish one anyway.
Do I need a cookie policy on my website in Australia?
Australia has no direct equivalent to the EU cookie consent rules. If you have European visitors, GDPR considerations may apply to their data.
Can I copy a privacy policy from another website?
It is common and it is risky — most copied policies reference the wrong jurisdiction or describe data practices that are not yours. At minimum it should reflect what you actually do.
Does Google Analytics require a privacy policy?
Google’s terms require you to disclose your use of analytics and data collection to visitors, which in practice means a policy.
Related reading
Get in touch
If you want an honest view on your own situation, tell us what your website is meant to do and what it is doing instead. We will come back within one business day.