Your website probably collects more information than you realise
Does your website have a contact form?
Newsletter signup?
Online bookings?
Customer accounts?
An online shop?
Analytics?
If so, information is moving through your website — and as the business owner, you should understand what you’re collecting, why you’re collecting it and what happens to it afterwards.
That’s where privacy comes in.
First: does every Australian small business legally need a Privacy Policy?
Not necessarily.
This is an area where you’ll often see overly broad advice online.
The Australian Privacy Act covers organisations with annual turnover above $3 million, but it also covers some smaller businesses regardless of turnover — including certain health service providers and businesses that trade in personal information, among other exceptions.
So don’t assume:
“I’m a small business, so the Privacy Act doesn’t apply to me.”
Equally, don’t assume every small Australian business has exactly the same legal obligations.
If you’re unsure whether the Privacy Act applies to your business, the Office of the Australian Information Commissioner (OAIC) provides information specifically for small businesses.
OAIC Small Business Privacy Information
And if your circumstances are unusual or you collect sensitive information, professional advice may be appropriate.
What is a Privacy Policy?
In simple terms, a Privacy Policy explains how your business handles people’s personal information.
For businesses covered by the Australian Privacy Principles, the OAIC requires the policy to be clearly expressed and up to date. It should explain things such as the kinds of personal information collected, how it is collected and held, why it is used or disclosed, how someone can access or correct their information, how privacy complaints are handled and whether information is likely to be disclosed overseas.
But even before you start writing a policy, there’s a more useful question:
What information does my business actually collect?
Walk through your own website
Pretend you’re a visitor and look at every place you’re asked to provide information.
You might find:
- Contact and enquiry forms
- Newsletter signup forms
- Booking forms
- Account registration
- Checkout and payment pages
- Membership applications
- Competition entries
- Downloads that require an email address
- Analytics and other website tools
Then look behind the website.
Where does that information go?
Perhaps an enquiry is emailed to you.
A newsletter address might be sent to an email marketing service.
A booking might be processed by another platform.
Payments may be handled by a payment provider.
Customer information could be stored in your website, CRM or accounting system.
You don’t need to become a technical expert. You do need to understand the basic journey someone’s information takes through your business.
Don’t collect information just because you can
This is something we touched on with Contact pages too.
If all you need to answer an enquiry is someone’s name, email address and question, think carefully before asking for their date of birth, home address or other unnecessary information.
Every extra piece of information you collect becomes another piece of information you’re responsible for handling appropriately.
Ask yourself:
Do I genuinely need this information to do what the person is asking me to do?
If you can’t explain why you’re asking for it, perhaps you don’t need to ask.
Your Privacy Policy needs to describe YOUR business
This is why copying another website’s Privacy Policy is a bad idea.
Their business isn’t your business.
They may use different:
- Website tools
- Payment providers
- Email marketing systems
- Booking platforms
- Analytics services
- Hosting providers
- Customer databases
- Overseas service providers
Their policy may describe things you don’t do — and completely miss things you do.
The OAIC itself recommends making a privacy policy specific to the organisation rather than simply repeating generic legal wording. It also recommends plain language rather than unnecessary legal jargon.
Put it somewhere people can actually find it
A Privacy Policy shouldn’t be hidden in some forgotten corner of your website.
For businesses covered by the Australian Privacy Principles, the policy must be available free of charge and in an appropriate form, and the OAIC says it will usually be published on the organisation’s website.
On a small business website, the footer is usually a sensible place for a permanent Privacy Policy link because it can then be reached from every page.
Don’t write it once and forget about it
Businesses change.
Perhaps you start using a new newsletter platform.
You add online payments.
You introduce memberships.
You change your booking system.
You start collecting information you didn’t previously collect.
Your Privacy Policy should change when the way you handle personal information changes. The OAIC recommends regularly reviewing policies so they remain accurate and up to date.
A simple Last updated date on the policy can also help you keep track.
A useful privacy check for today
You don’t need to write a legal document this afternoon.
Start by answering these questions:
What personal information does my website collect?
Why am I collecting it?
Where does it go?
Who has access to it?
Which outside services receive it?
Do I actually need everything I’m asking for?
Does my current Privacy Policy describe what my business really does?
If you can’t answer some of those yet, that’s useful information in itself.
You’ve found something worth investigating.
Privacy isn’t about putting a page on your website simply so you can tick a box.
It’s about understanding the information people trust you with — and being clear about what you do with it.
