If your online business collects names, email addresses, phone numbers or delivery details from customers, privacy law already has something to say about how you handle that information. And in many cases it requires you to publish a privacy policy. The trigger is not whether you operate online, but whether your business counts as an "APP entity" under the Privacy Act 1988 (Cth) (the Act) and therefore has to comply with the Australian Privacy Principles (APPs).
This article sets out when the obligation applies, what your policy needs to cover, the related duty to give customers a collection notice, and what is at stake if you get it wrong. If it turns out you do not currently fall within the Act, this article also explains why a privacy policy is still worth putting in place.
Who Must Comply With the APPs
The APPs sit in Schedule 1 of the Act and govern how APP entities collect, hold, use and disclose personal information. "Personal information" is information or an opinion about an identified, or reasonably identifiable, individual, such as a customer's name and contact details.
The APPs apply to APP entities, which include organisations (broadly, businesses) that are not "small business operators". The key threshold is annual turnover: the Act sets the small business turnover line at $3 million or less (see s 6D of the Act). In other words, if your business's annual turnover is more than $3 million, you are an APP entity and the APPs apply to you.
Below the $3 million threshold you can still be swept into the Act. Under s 6D(4) of the Act, a business is not a small business operator if it:
- Health services: provides a health service and holds health information outside an employee record, such as a physiotherapist, gym, child care centre or private school;
- Trades in personal information: discloses, or collects, personal information about other individuals for a benefit, service or advantage (for example, selling a customer database);
- Government contracts: is a contracted service provider for a Commonwealth contract;
- Credit reporting: is a credit reporting body;
- Related entities: is related to a body corporate that itself carries on a business that is not a small business.
The Act defines annual turnover broadly. Under s 6DA, it includes the proceeds of sales of goods and services, commission, rent and leasing income, interest, royalties and dividends, and other operating income. When you assess your position, count all income earned in the course of the business, not just profit.
An entity that is not otherwise covered can also elect to be treated as an organisation, and some businesses are brought within the Act by other legislation. If any of these apply to you, the obligation to comply with the APPs, and to have a privacy policy, applies even though you are below the turnover threshold.
A note on reform
Australian privacy law is in the middle of a reform period. The Privacy and Other Legislation Amendment Act 2024 (Cth) already increased penalties and took steps toward stronger protections, including directing the OAIC to develop a Children's Online Privacy Code. The Commonwealth Government's 2023 response to the Privacy Act Review foreshadowed further changes. This means the obligations described in this article are current as at publication but the regime is expected to tighten, particularly for online businesses that attract younger users.
Your Duty to Have a Privacy Policy
If you are an APP entity, APP 1.3 of the Act requires you to have a clearly expressed and up-to-date privacy policy about how you manage personal information.
This is not a choice. Having a privacy policy is an express legal requirement for APP entities, and failing to have one is itself a breach of the Act that can attract a civil penalty (see APP 1.3 and s 13K of the Act).
What your policy must contain
APP 1.4 sets out the minimum contents. Your privacy policy must explain, among other things:
- What you collect: the kinds of personal information you collect and hold;
- How you collect it: how you collect and hold that information;
- Why you collect it: the purposes for which you collect, hold, use and disclose personal information;
- Disclosure and overseas transfers: how a person may complain, and whether you disclose personal information to third parties, including whether any disclosure is made overseas and to which countries;
- Access and correction: how an individual can access their personal information and seek correction if it is inaccurate.
Because APP 1.4 requires the policy to be current, you should review and update it whenever your data practices change, such as adding a new marketing tool, payment provider, overseas supplier, or analytics service.
The privacy policy is not the whole of your obligations. It is the public face of a wider set of duties under the other 12 APPs, which restrict how much personal information you can collect (APP 3), require you to secure it (APP 11), give individuals rights to access and correct their information (APPs 12 and 13), and restrict how you use personal information for direct marketing. A policy that does not match what your business actually does becomes a liability, because the OAIC can treat the gap between your stated practices and your real ones as its own problem.
The Duty to Give a Collection Notice
A privacy policy is one document, but APP 5 of the Act imposes a separate, ongoing obligation when you collect personal information. At or before the time you collect an individual's personal information, you must take reasonable steps to notify them of certain matters, commonly delivered as a "privacy collection notice".
Under APP 5.2, that notice should cover:
- Your identity and contact details;
- The fact and circumstances of collection: including where you collect the information from someone other than the individual;
- Whether collection is required or authorised by law;
- The purposes for which you collect the information;
- The main consequences of not providing the information;
- Any third-party disclosures: whether the information is likely to be disclosed overseas and to which countries;
- Access, correction and complaints: how the individual can access or correct their personal information, and how to complain about a breach.
In practice, most online businesses meet this by placing a short collection notice at the point where a form captures data, such as a sign-up, checkout or newsletter form, and linking to the fuller privacy policy.
What Happens if You Breach the Act
The consequences of breaching the APPs are serious and have increased significantly in recent years.
For a serious or repeated interference with privacy, s 13G of the Act provides for a maximum civil penalty of:
- $2.5 million for an individual; or
- for a body corporate, the greater of $50 million, three times the value of any benefit obtained and reasonably attributable to the breach, or 30% of the corporation's adjusted turnover during the breach turnover period.
In deciding whether an interference is serious, a court may weigh factors including the kind and sensitivity of the information, how many individuals were affected, whether children or vulnerable people were involved, and whether the entity had failed to implement proper privacy practices and systems.
The Office of the Australian Information Commissioner (OAIC) is the regulator, and it investigates complaints, can make determinations, and can seek civil penalties in court. Because the Act also carries a separate, lower civil penalty for breaches that are not serious, even a single lapse in your policy or notice obligations can expose you to liability.
Why Smaller Businesses Should Have One Anyway
If you fall below the turnover threshold and do not fit any of the exceptions, the Act does not currently require you to have a privacy policy. Even so, there are strong reasons to have one:
- Customer expectations: consumers increasingly check for a privacy policy before transacting, particularly after well-publicised data breaches;
- Platform and partner requirements: payment processors, app stores, advertising platforms and overseas marketplaces often require you to have a privacy policy as a condition of using their services;
- Trust and credibility: a clear policy signals that you handle personal information responsibly;
- Future-proofing: if your turnover crosses the $3 million line, or the Act is expanded to cover you, you will already be compliant rather than scrambling to catch up.
A Compliance Checklist for Online Businesses
If you decide your business is within the Act, work through this checklist:
- Confirm your status: assess your turnover against the $3 million threshold and check whether any of the exceptions in s 6D(4) apply;
- Draft a full privacy policy: covering each item in APP 1.4;
- Keep it current: update the policy whenever your data practices, providers or overseas transfers change;
- Add collection notices: at each point where you gather personal information;
- Review your practices: against the other APPs, including how you secure data, handle access and correction requests, and when you disclose information to third parties;
- Train your team: so that collection, storage and disclosure are handled consistently with what your policy promises;
- Plan for complaints: decide how you will receive and respond to privacy complaints.
When to Get a Lawyer Involved
A template privacy policy copied from another website is risky, because the law requires the policy to reflect what your business actually does. A commercial lawyer who works with privacy law can:
- Confirm whether you are an APP entity: where the tricky threshold questions fall;
- Draft a policy specific to your business: covering the data you collect, the tools you use and any overseas disclosures;
- Write your collection notices: to match your policy;
- Review your compliance arrangements: against the APPs and flag gaps; and
- Advise on a response: if the OAIC investigates a complaint or a data breach occurs.
The cost of advice is modest compared with a serious-interference penalty, and it protects you if your business grows into the Act.
The Threshold That Catches Online Businesses by Surprise
The duty most often missed is not the policy itself but the separate collection notice required under APP 5. A business can have a polished privacy policy and still breach the Act by collecting customer details through an online form without the required notice. The second trap is the $3 million turnover line: once your revenue crosses it, you become an APP entity and the full weight of the APPs applies. If you are close to that line, or if your online store ships customer data through overseas processors, have a privacy policy and collection notices in place now, and review them at least every time your data practices change. That is the action that costs the least today and protects you the most later.