In almost every case, yes. If your website collects personal information through a contact form, a quote request, a newsletter signup or even basic analytics, your visitors are entitled to know what you collect and what you do with it. For many Australian businesses a privacy policy is a legal requirement, and for the rest it is good practice and often a condition set by advertisers and payment providers.
So the question “does my business website need a privacy policy?” comes down to how the Privacy Act applies to you, and to what a useful policy actually says. Here is the practical picture.
When Australian privacy law requires one
The Privacy Act 1988 and the Australian Privacy Principles generally apply to businesses with an annual turnover above $3 million. If your business sits above that line, a compliant privacy policy is part of the deal whenever you collect personal information, which on a website means almost any form, account or mailing list.
Smaller businesses often fall under the small business exemption, but that exemption has limits. It can drop away if you trade in personal information, provide a health service, or handle personal information under a Commonwealth contract, among other situations. This article is general information, not legal advice: treat the guidance published by the Office of the Australian Information Commissioner (OAIC) as the reference, and get proper advice for your own circumstances.
Why have one even if you are exempt
Plenty of businesses that could legally skip a privacy policy still publish one, for good reasons. Advertising platforms such as Google and Meta commonly require one before you can run campaigns that send people to your site. Payment providers and larger clients running supplier checks often ask the same question. And a policy that plainly states what you do with people’s information is a small trust signal to the customers reading it.
What a privacy policy needs to cover
A useful policy answers, in plain English, the questions a reasonable visitor would ask:
- What personal information you collect, such as names, phone numbers, email addresses and enquiry details.
- Why you collect it and what you do with it.
- Who you share it with, including the tools and processors that help run your site.
- How you store and protect it.
- How someone can access the information you hold about them or ask for it to be corrected.
- How someone can complain, and how you can be contacted.
Accuracy beats length. A short policy that describes what your site actually does is worth more than five dense pages describing things you do not do.
Where the policy should live on your site
Link it from the footer so it is reachable from every page, and place a note or checkbox near any form that collects an email address. Visitors rarely go looking for a privacy policy, but the ones who check expect to find it in the usual place.
Cookies, analytics and overseas visitors
If your site uses analytics or advertising cookies, say so in the policy and name the general categories of tools involved. Overseas rules such as the European GDPR can reach Australian websites that attract European visitors, so some businesses also add a short cookie notice. Neither step needs to be complicated; both need to be true.
Keep it accurate as your tools change
A privacy policy describes a moving target. When you add a booking tool, a live chat widget or a new email platform, the data you handle changes too. Review the policy whenever your website’s toolset changes, not on an annual guilt-driven schedule.
Frequently asked questions
Can I write the privacy policy myself?
Yes, if you keep it honest and specific. Describe what your site genuinely collects and what you genuinely do with it. Templates can help you remember the headings, but the content has to match your business.
Can I copy another business’s privacy policy?
No. A copied policy describes someone else’s data handling, which makes it misleading the moment it is published. If a complaint ever arrives, an inaccurate policy is worse than a short one you actually follow.
Does the policy need to mention cookies and analytics?
Yes, if you use them, which most sites do. Name the categories of tools, what they collect and why. You do not need to list every script individually, but the description has to be recognisable to a visitor.
What if my site only collects enquiries through one form?
You are still collecting personal information, so the answer stays yes. Your policy will simply be short: what the form collects, why you hold it, who sees it and how long you keep it.
Build the policy in from the start
A privacy policy is one of the small details that separates a finished business website from a launched one. Our website design and development service covers it as part of the build, or book a discovery call to talk through your site’s obligations.
