Websites & online business
What a small business website's privacy policy should cover
Many small business websites have a privacy policy copied from somewhere else, or none at all. A good one is short, accurate and written about what your website actually does. Here's how to work out whether the Privacy Act applies to you, and what a useful policy covers either way.
The short version
The short version
- Many small businesses with turnover of $3 million or less aren't covered by the Privacy Act, but some are, regardless of size.
- A policy should describe what you actually collect and why, not a template's guesses.
- Cover your contact forms, analytics, cookies, email lists and any outside services.
- Review it whenever you add a form, a tool or a new way of collecting information.
Do you have to have one?
The Privacy Act and its Australian Privacy Principles (APPs) apply to many organisations, but not all small businesses. The Office of the Australian Information Commissioner (OAIC) explains that a small business is one with an annual turnover of $3 million or less, and that most small businesses aren't covered.
Some small businesses are covered regardless of turnover. OAIC's small business page lists the situations, which include:
- providing a health service and holding health information
- trading in personal information, such as selling customer lists
- providing services under a Commonwealth contract
- some other prescribed activities, or choosing to opt in
OAIC has a question-by-question checklist to work out whether you're covered. If you are, APP 1 requires a clearly expressed, up-to-date privacy policy about how you manage personal information.
Even if you're exempt, it's worth having
Customers increasingly expect to know what happens to their details. A short, honest policy builds trust, and you'll be ready if your business grows past the threshold or the law changes.
What a useful policy covers
Write it about your business, in plain English. A good structure:
| Section | What to say |
|---|---|
| Who you are | Business name, ABN and how to contact you about privacy |
| What you collect | For example, names, emails and phone numbers from your contact form, and order details from your shop |
| How you collect it | Forms, emails, phone calls, bookings, analytics and cookies |
| Why you collect it | Answering enquiries, delivering orders, sending a newsletter people signed up for |
| Who you share it with | Your website host, email platform, payment provider, booking or CRM system |
| Overseas storage | Whether any of those services store data outside Australia, and where |
| How you protect it | In general terms, such as access controls and secure systems |
| Access and correction | How people can ask to see or correct their information |
| Complaints | How to complain to you, and that they can contact the OAIC |
Check what your website actually does
Before writing anything, list every way the website collects information:
1. Forms. Contact, quote, booking and newsletter forms. Where does each submission go? 2. Analytics. Tools such as Google Analytics, and what they record. 3. Cookies and tracking pixels. Advertising and social media pixels share visit data with those platforms. 4. Embedded services. Maps, videos, chat widgets and booking tools can collect data too. 5. Your shop or payments. Who processes payments, and what you keep. 6. Where enquiries end up. Your inbox, a shared mailbox or a CRM such as NovaSoft One.
If you find a tool nobody uses any more, remove it. Collecting less is simpler to explain and safer to look after.
An example in plain English
Here's the kind of wording that works better than legal boilerplate. Adapt it to what your business really does:
Enquiries
When you use our contact form, we collect your name, email address, phone number and message so we can reply. The form sends your enquiry to our email inbox and our customer system. We keep enquiries for two years unless you become a customer, and we don't use them for marketing unless you ask to join our newsletter.
Notice it says what is collected, why, where it goes and how long it's kept. Write one short paragraph like this for each way you collect information.
Keep it accurate
- Review the policy when you add a form, a plugin, an analytics tool or a new supplier that handles customer data.
- Put a "last updated" date at the top.
- Make it easy to find, usually in the website footer and next to forms.
- Make sure the people who answer enquiries know what it says.
NovaSoft's website and ecommerce service can review what your site collects and keep the policy in step with it. This guide is general information, not legal advice. For your specific obligations, check with the OAIC or a lawyer.
Common questions
Can I copy another business's privacy policy?
It's a common shortcut, but it usually describes tools and practices you don't use, and leaves out ones you do. An inaccurate policy can mislead customers. Use it as a structure at most.
Do I need a cookie banner in Australia?
The Privacy Act doesn't use the same consent-banner model as Europe, but you should still explain cookies and tracking in your policy. If you sell to people in Europe, other rules may apply.
Does a newsletter sign-up count as collecting personal information?
Yes. An email address linked to a person is personal information. Say what you'll send, and make unsubscribing easy.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.