The Short Answer: Yes, Almost Certainly
If your website collects personal information, and most sites do, you need a privacy policy. It is more than legal fine print. It is a practical necessity for any business operating online today.
Personal information includes more than you might think. It covers obvious things like a person's name, email address, and phone number, but also less obvious data like IP addresses and cookie data stored in a visitor's browser.
Here are some of the most common ways small business websites collect personal information without their owners realising it:
- Contact forms: every time someone fills in their name and email to get in touch
- Email newsletter signups: collecting names and email addresses for your mailing list
- Google Analytics: tracks IP addresses, browser type, location, and browsing behaviour
- Facebook Pixel: records visitor behaviour and links it to Facebook profiles for ad targeting
- Other social media pixels: LinkedIn, TikTok, Pinterest, and others work the same way
If your website has any of these, and most small business websites have at least two or three, you are already collecting personal data. A privacy policy tells your visitors what you're doing with it.
Legal Requirements in Australia
In Australia, the primary legislation governing privacy is the Privacy Act 1988, which is administered by the Office of the Australian Information Commissioner (OAIC). The Act sets out 13 Australian Privacy Principles (APPs) that regulate how organisations collect, use, store, and disclose personal information.
The small business exemption
Businesses with an annual turnover of less than $3 million are generally exempt from the Privacy Act. If that sounds like good news, read on, because there are important exceptions.
You are not exempt if your business:
- Provides a health service (including allied health, gyms, and wellness providers)
- Trades in personal information, for example selling or buying customer lists
- Has opted in to coverage voluntarily (some businesses do this to build credibility)
Even if you are technically exempt, having a privacy policy is still strongly advisable. It builds trust with your customers and protects you if someone raises a complaint about how you handled their data.
What about the GDPR?
The EU General Data Protection Regulation (GDPR) applies to any business that collects data from people located in the European Union, regardless of where the business itself is based. If your website is publicly accessible on the internet, EU residents can visit it, which means the GDPR is practically relevant to you. The GDPR has strict requirements and significant penalties, so it's worth understanding even as an Australian business.
Why You Should Have One Even If Not Legally Required
Even if your business falls within the small business exemption, there are compelling practical reasons to have a privacy policy in place.
- It builds visitor trust. Customers are increasingly privacy-conscious. A clear, honest privacy policy signals that you take their data seriously, and that you're a legitimate, professional business.
- Advertising and analytics platforms require it. Google Analytics, Facebook Pixel, and most other advertising platforms make a privacy policy a condition of use. If you use these tools without one, you are technically in breach of their terms of service.
- Your web host and app stores may require it too. Many web hosting providers and app marketplaces (including the Apple App Store and Google Play) require that any service collecting user data has a published privacy policy.
- It protects you if a complaint is raised. If a customer ever questions how you handled their personal information, a well-written privacy policy gives you a clear, documented position to refer to. Without one, you have no baseline to stand on.
What Your Privacy Policy Must Cover
A good privacy policy doesn't need to be long, but it does need to cover the right ground. Here are the six key elements to include:
(a) What personal information you collect and how
Be specific. List the types of data you collect (names, email addresses, phone numbers, IP addresses, cookie data) and explain how you collect it: through contact forms, newsletter signups, analytics tools, or cookies.
(b) Why you collect it
Explain your purpose. Common reasons include responding to customer enquiries, improving the website experience, and sending marketing communications. Be honest and specific. Vague language erodes trust.
(c) How you store and protect it
Describe the measures you take to keep personal data secure. This might include password-protected systems, encrypted storage, or using reputable third-party platforms with their own security standards.
(d) Who you share it with
List any third parties that receive personal data as part of your operations. This typically includes:
- Email marketing platforms (e.g. Mailchimp, Klaviyo)
- Analytics providers (e.g. Google Analytics)
- Payment processors (e.g. Stripe, PayPal)
- Any other tools or services that process customer data on your behalf
(e) How people can access or delete their data
Individuals have the right to request access to the personal information you hold about them, and in many cases to request its deletion. Your privacy policy should explain how they can make that request and how you will respond.
(f) Your contact details for privacy enquiries
Include a name (or role), email address, and/or postal address so that people know who to contact with privacy-related questions or concerns.
Practical Advice: Getting Started
You don't need to write your privacy policy from scratch. There are several good starting points available:
- Termly: a popular privacy policy generator that covers Australian and GDPR requirements
- iubenda: another well-regarded generator with a free tier
- The OAIC template: the Office of the Australian Information Commissioner provides a free privacy policy template designed specifically for Australian businesses
These tools will get you most of the way there. However, if your business handles sensitive data (such as health information, financial records, or data relating to children), it's worth having a solicitor review your policy before you publish it. The cost of a short legal review is far less than the cost of getting it wrong.
Once your policy is ready:
- Link to it from your website footer: this is the standard location visitors expect to find it
- Link to it from any form that collects personal data: contact forms, newsletter signups, booking forms, and checkout pages should all reference your privacy policy
Keep It Updated
A privacy policy is not a set-and-forget document. It should be reviewed and updated whenever you add a new tool or service that collects personal data: a live chat widget, a new email marketing platform, a Facebook ad pixel, or a booking system.
An outdated privacy policy can actually be worse than having none at all. If your policy says you only collect names and emails, but you've since added Google Analytics and a Facebook Pixel, that discrepancy can create legal liability and undermine customer trust.
Set a reminder to review your privacy policy at least once a year, and any time you make a significant change to how your website operates.
When I handle ongoing website care for a business, I check the privacy policy against the tracking and form tools actually running on the site, so the two stay in step.
Getting your privacy policy in order is one of those tasks that feels daunting but is very manageable once you start. Use a generator, tailor it to your business, get it reviewed if needed, and publish it. Your customers will notice, and so will the platforms you rely on to run your business.
Privacy compliance is easier when the forms, analytics, and footer links on your site are set up deliberately. Send the project brief with details of your current setup and the tools you run.
