The OAIC began its first ever privacy compliance sweep in the first week of January 2026, reviewing the privacy policies of around 60 businesses across six sectors: real estate, chemists and pharmacists, licenced venues, car rental companies, car dealerships and pawnbrokers. Each policy is being checked against Australian Privacy Principle (APP) 1.4, and businesses found wanting can face compliance notices, infringement notices and penalties of up to $66,000. Even if your business is not in one of the target sectors, the sweep is a good prompt to pull out your own privacy policy and read it the way a regulator would.
Your privacy policy is not a decoration on your website. Under APP 1 of Schedule 1 of the Privacy Act 1988 (Cth) (the Act), you must have a clearly expressed and up to date policy about how you manage personal information, made available free of charge and in an appropriate form. It is the document that tells customers what you do with their data and how they can exercise their rights, and the OAIC treats it as the foundation of open and transparent information handling. Most businesses with an annual turnover above $3 million are covered by the Act as APP entities. Smaller businesses are generally exempt, but not always: health service providers, businesses that trade in personal information and several other categories are covered regardless of turnover, and any small business can choose to opt in. One thing to get straight before you start drafting: your privacy policy is not a substitute for the collection notice you must give individuals under APP 5 when you collect their information. Both documents have separate jobs. The OAIC updated its APP 1 guidance in October 2025, so the expectations against which your policy will be measured are current and specific.
The clauses your privacy policy needs
APP 1.4 lists the topics a policy must cover, but the law does not dictate the order, the headings or the words. The OAIC's guide to developing an APP privacy policy is the best roadmap. What follows is the anatomy of a policy that would survive its scrutiny.
What the policy covers
Every policy needs a scope clause that says whose information it covers and which of your activities it applies to. For most businesses that is simple: customers, website users and other individuals who deal with you. If different parts of your operation handle information differently, the OAIC suggests you consider more than one policy, or separate sections for different groups such as customers, members and staff. The trap is a policy written for one part of the business that quietly becomes the policy for all of it. The scope clause is also the natural place to name the entity that is responsible, which matters when customers need to know who actually holds their information.
What personal information you collect and how
APP 1.4(a) and (b) require you to say what kinds of personal information you collect and hold, and how you collect and hold it. This is where businesses drift into vagueness. A policy that says "we collect personal information" tells the reader nothing, and it is usually a sign that nobody has actually audited what comes in. Before you draft this clause, walk through each form, checkout, enquiry line and sign-up page your business runs and list what each one collects. The OAIC's guidance is to be specific, particularly about information people are sensitive about, such as dates of birth, health details, financial information and identification documents:
- Name the categories: contact details, payment information, location data, identifiers such as driver's licences or passport numbers.
- Explain the sources: forms you provide, your website, in-person collection, publicly available sources or third parties.
- Address sensitive information: if you handle it, say so. The Act gives sensitive information extra protection, and readers notice when a policy is silent on it.
Why you collect, use and disclose it
APP 1.4(c) requires you to set out the purposes for which you collect, hold, use and disclose personal information. This clause is where the policy meets your actual practices, because you must describe what you genuinely do, not what you wish you did. The OAIC warns against unqualified words like "may": a policy that says you "may" share information in unspecified circumstances creates concern rather than trust. If you sell products, describe fulfilment. If you run a loyalty program, describe it. If you send a newsletter, say so, and explain how someone can stop receiving it.
Who else gets the information, including overseas
Disclosure is the clause readers care about most, and APP 1.4(f) and (g) make it mandatory. You must say whether you are likely to disclose personal information to overseas recipients and, where practicable, name the countries. The common trap is silence about the overseas reality of modern business: cloud storage, payment processors, customer support platforms and marketing tools all hold data, often on servers outside Australia, and your policy should say so. The drafting choice matters because, under s 16C of the Act, the acts of an overseas recipient can be treated as your own, making you accountable for how that recipient handles the information. A related trap is the parent company or group entity: if you share information within your corporate group, that is still a disclosure for the purposes of the policy, and overseas group entities need to be named like any other recipient.
How you store and protect it
There is no clause in APP 1.4 about security, but you cannot describe how you hold personal information without saying something about how you protect it, and the OAIC expects a genuine account of your security measures. Under APP 11 you must take reasonable steps to protect the information you hold from misuse, interference, loss and unauthorised access. You should also say how long you keep information and what happens to it afterwards; APP 11.2 requires you to destroy or de-identify information you no longer need. Businesses that collect information in person should pay particular attention here. It was exactly this kind of collection, of identity documents and contact details at open houses, pharmacies and rental counters, that the OAIC flagged as risky when it announced the sweep. You should also say what happens if things go wrong: where a data breach is likely to result in serious harm to individuals, the Notifiable Data Breaches scheme in the Act requires you to notify them and the OAIC, so a policy that promises a response to incidents is describing a real obligation.
How customers access and correct their information
APP 1.4(d) requires you to explain how an individual can access the personal information you hold about them and seek its correction. This is the clause most often reduced to a sentence, yet it is one of the few places in the policy where you set out a right the Act actually gives individuals, under APP 12 for access and APP 13 for correction. You should name the channel, such as an email address or a form, say what you will do with the request, and commit to responding within the timeframes the APPs set out. The drafting choice that matters here is to make the process real. A request that disappears into an inbox is a breach of APP 12, not just a customer service failure.
How to complain
APP 1.4(e) requires you to explain how an individual can complain about a breach of the APPs, or of a registered APP code that binds you, and how you will deal with the complaint. This is the clause the OAIC has repeatedly found businesses bury or fudge. Your complaints clause should name a contact, describe what happens after a complaint is made and be honest about timeframes. It should also tell people they can take an unresolved complaint to the OAIC, which can investigate and make determinations. The practical point: if your complaints process is not something you can actually run, drafting a clause that promises it is the first problem to fix.
Optional clauses worth adding
Beyond the APP 1.4 minimums, a handful of clauses earn their place when your business does certain things:
- Direct marketing: if you send marketing by email, SMS or other channels, explain how customers can opt out. APP 7 requires a simple means of doing so.
- Online tracking: if your website uses analytics, advertising pixels or cookies that identify visitors, say so. The OAIC singles out tracking as something readers often do not expect and want explained.
- Retention and destruction: setting out how long you keep particular records and when you destroy or de-identify them answers the question customers most often ask after a breach.
- Employee information: if your policy covers staff records, decide whether to include them or handle them separately. The Act contains an exemption for employee records, but it does not cover every situation.
- Voluntary coverage: if you are a small business under the turnover threshold, you can choose to be treated as an APP entity. Opting in can be worthwhile if you deal with larger customers who require it, or if you want to signal that you take privacy seriously.
When a privacy lawyer should review your policy
A privacy policy is one of those documents where the drafting is quick and the analysis is slow. An Artificer Legal practitioner would start by mapping your actual information handling practices, because a policy that does not describe what your business really does is worse than no policy at all. We would then check each APP 1.4 requirement against your draft, review the clauses that interact with other obligations such as APP 5 collection notices, APP 7 direct marketing and APP 8 overseas disclosure, and test whether your access, correction and complaints processes would work if someone actually used them. For businesses that handle health information, credit information or children's data, the review is more involved again. The usual output is a layered package: a short plain-language summary for your website and a fuller policy behind it, both consistent with each other and with how the business operates.
Start your rewrite with the disclosure clause
If your policy needs work, begin with the disclosure clause. It is the section readers actually read, the one the OAIC's guidance says to be most specific about, and the one where businesses most often write something aspirational, such as "we may share with trusted partners", that does not match what happens in practice. A vague disclosure clause does double damage. It fails the "clearly expressed" test in APP 1.3, and it creates a document that contradicts how your business actually operates. Write down who really receives personal information, including overseas service providers, and make the policy match the practice. The rest of the policy can be polished later.
The checklist for the whole document is short. Your policy must be clearly expressed and up to date, cover each APP 1.4 topic, be available free of charge and describe what you actually do. The OAIC wants plain language, a layered structure and a policy written for your customers, not a recital of the statute. With its first compliance sweep under way, there has never been a better moment to review yours, and a privacy lawyer can help you do it properly.