Website privacy policy checklist for Australian businesses (2026)
By the ITLAW Team · General information, not legal advice
In short
- APP entities must have a clearly expressed and up-to-date privacy policy that is freely available, usually on their website.
- The OAIC began a compliance sweep of privacy policies in January 2026 and can issue infringement notices for deficient policies.
- From 10 December 2026, policies must also cover certain automated decision-making.
A privacy policy is often the first thing a regulator, journalist or customer reads when something goes wrong with personal information. Under Australian Privacy Principle 1, businesses covered by the Privacy Act must have one, and it must describe what the business actually does, not what a template says.
What APP 1 requires your policy to cover
- the kinds of personal information you collect and hold
- how you collect and hold it, including through your website, cookies and third-party tools
- the purposes for which you collect, hold, use and disclose it
- how individuals can access and seek correction of their information
- how individuals can complain about a breach of the APPs, and how you will deal with complaints
- whether you are likely to disclose information to overseas recipients and, if practicable, the countries where they are located
- from 10 December 2026, information about certain automated decision-making, see our ADM article
The gaps we see most often
- Out of date: the policy was written years ago and does not mention current systems, apps or marketing tools.
- Generic templates: statements copied from another business, sometimes from another country, that do not match your practices.
- Missing overseas disclosure: no mention of cloud providers, offshore support teams or analytics services located overseas.
- Hidden: the policy is hard to find or not linked from forms that collect personal information.
- No complaints process: no clear contact point or explanation of how complaints are handled.
Privacy policy vs collection notice
A privacy policy is a general document. Under APP 5 you also need to notify people, at or before the time you collect their information, of specific matters such as who you are, why you are collecting it and who you usually disclose it to. A short collection notice next to a form, linking to the full policy, is the usual approach.
A five-step refresh
- Map your data flows, including every form, app and third-party tool.
- Rewrite the policy in plain English to match those flows.
- List overseas recipients by country where practicable.
- Add an automated decision-making section if it applies.
- Link the policy from your footer and every form, and set a review date.
Not sure whether the Privacy Act applies to you? Start with our privacy law guide.
Need advice?
Our guides are general information. For advice on your circumstances, send us an enquiry and an ITLAW lawyer will get back to you, usually within one business day.
Frequently asked questions
Is a privacy policy legally required in Australia?
Yes for APP entities, which include businesses with turnover above $3 million and some smaller businesses. Other businesses may still need one under platform terms or contracts, and it is good practice.
Can I use a privacy policy template?
A template is a starting point only. Your policy must accurately describe your own practices, and an inaccurate policy can create both privacy and consumer law risk.
How often should I update my privacy policy?
Whenever your practices change, and at least annually. The 10 December 2026 automated decision-making changes are a good trigger for a review.
