Privacy notices for Australian businesses, when you need one and what it must say

Most small businesses collect personal information more often than they realise. A website contact form, an online order, a newsletter sign-up, a client onboarding form, a job application, even the analytics cookies on your site all capture details that can identify a real person. Under the Privacy Act 1988 (Cth) (the Act), the moment you do that you may owe that person a clear explanation of what you are doing with their information.

That explanation is the privacy notice, and in Australian privacy law it comes in two distinct forms. Your privacy policy is the standing document that explains how your business handles personal information overall, required by Australian Privacy Principle (APP) 1. Your collection notice is the short, point-in-time statement you give someone when you collect their information, required by APP 5. The second of these is what most people mean when they say "privacy notice", and it is the part of compliance that small businesses most often skip.

This article covers who is legally required to provide these notices, what each one must say, what happens if you get it wrong, and the practical steps to put a compliant notice in place.

Whether the Privacy Act applies to your business

The first question is coverage. The Act regulates "organisations", and for a business the usual test is annual turnover. Under s 6D of the Act, a business is a small business operator if its annual turnover for the previous financial year was $3,000,000 or less, and small business operators are generally exempt from the APPs. A new business is measured against its current year turnover instead. Turnover is calculated under s 6DA and includes sales, commission, rent, interest and other operating income, and it is measured across related bodies corporate, so a group of companies is assessed together rather than entity by entity.

The exemption disappears, however, if the business falls within one of the exceptions in s 6D(4). A business that is otherwise under the threshold is still bound by the APPs if it:

provides a health service to someone and holds health information (other than in an employee record)
discloses personal information to anyone else for a benefit, service or advantage, or collects personal information in exchange for providing a benefit, service or advantage
is a contracted service provider under a Commonwealth contract
is a credit reporting body.

The health service exception is the one that catches the most businesses by surprise. A physiotherapist, psychologist, naturopath or allied health practice well under the turnover threshold is fully bound by the APPs because it holds health information, which is a category of sensitive information. A business that trades in personal information, such as a data broker or a lead-generation operation, is likewise covered regardless of size. Small business operators can also choose to be treated as organisations under s 6EA, which some do because larger customers expect it.

If your business is covered, the APPs bind every stage of your handling of personal information, and personal information is a broad concept. The OAIC explains that it covers any information or opinion about an identified or reasonably identifiable individual, including a name, email address, phone number, IP address, device identifiers, photographs, location data and biometrics. If a piece of data lets you work out who someone is, treat it as personal information.

Duty 1: keep an up-to-date privacy policy

APP 1.3 requires an APP entity to have a "clearly expressed and up-to-date" privacy policy about how it manages personal information. This is not optional wording. Under APP 1.4 the policy must cover:

the kinds of personal information the business collects and holds
how it collects and holds that information
the purposes for which it collects, holds, uses and discloses it
how an individual can access their information and seek correction
how an individual can complain about a breach of the APPs and how the complaint will be dealt with
whether the business is likely to disclose personal information to overseas recipients, and if so, the countries where those recipients are likely to be located.

Under APP 1.5 the policy must be available free of charge and in an appropriate form, which in practice means a page on your website. APP 1.2 also requires the systems behind the policy: practices, procedures and systems that will actually deliver APP compliance and handle inquiries and complaints.

The privacy policy is not an ornament. APP 1.3 and APP 1.4 are among the specific provisions for which the OAIC can issue infringement notices without going to court, under s 13K of the Act, and a policy that has not been looked at since the business launched is a compliance gap waiting to be noticed.

Duty 2: notify people at the point of collection

APP 5 is the provision that creates the privacy notice itself. Under APP 5.1, at or before the time you collect personal information, or as soon as practicable afterwards if that is not possible, you must take reasonable steps to notify the individual of certain matters, or otherwise ensure they are aware of them.

The matters listed in APP 5.2 are the checklist for any privacy notice:

who you are and how to contact you
the purposes for which you are collecting the information
the main consequences, if any, for the individual if they do not provide some or all of the information
the types of other parties you usually disclose that kind of information to
whether you are likely to disclose the information to overseas recipients and, if it is practicable to say, which countries
that your privacy policy explains how the individual can access and correct their information
that your privacy policy explains how to complain about a breach and how you will deal with it
if you are collecting from someone other than the individual, or the individual may not know you have collected the information, the fact of the collection and its circumstances
if the collection is required or authorised by an Australian law or court order, that fact and the name of the law.

Two points are worth stressing. First, the notice is required at the point of collection, which is why it should sit directly on your contact form, at checkout, beside a newsletter sign-up box or in an onboarding form, rather than living only in a footer link to a policy. Second, the notice should be short. The standard shape is a few sentences covering what you collect, why, who you share it with and where the full policy lives, with the policy doing the heavy lifting. APP 5 is satisfied by reasonable steps and a notice that is proportionate to what you are actually collecting.

Sensitive information gets a higher level of protection. APP 3.3 provides that an organisation must not collect sensitive information unless the individual consents and the collection is reasonably necessary for the organisation's functions or activities. Sensitive information includes health information, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation or practices, criminal records and some biometric information.

The practical consequence is that a form collecting this kind of information needs an express consent mechanism, and the purposes must be spelled out, not buried. This matters for any business in the health and allied health sector, and for any business whose forms happen to capture information about a customer's health, such as a booking form that asks about medical conditions.

Duty 4: tell people about overseas disclosures

Most Australian businesses use cloud tools, and that frequently means personal information is stored or accessed outside Australia. APP 5.2 requires your notice to state whether you are likely to disclose information to overseas recipients and, where practicable, the countries involved.

There is a matching substantive obligation. Under APP 8.1, before disclosing personal information to an overseas recipient you must take reasonable steps to ensure the recipient does not breach the APPs. There are exceptions, including where the recipient is subject to a law or binding scheme that provides substantially similar protection with enforcement mechanisms, or where the individual has been expressly informed that APP 8.1 will not apply and consents anyway. Under s 16C of the Act, if an overseas recipient breaches the APPs, the disclosing business is treated as having breached them itself.

The notice point is simple: if your CRM, email platform, booking system or support team operates offshore, your notice should say so. A notice that promises "your data never leaves Australia" while your software vendor syncs data overseas is both inaccurate and a liability.

The obligations that sit around the notice

A privacy notice does not operate in isolation. Two neighbouring regimes matter in practice:

Marketing: If you send marketing emails or SMS, the Spam Act 2003 (Cth) applies separately from the privacy regime. Under s 16 of that Act, unsolicited commercial electronic messages must not be sent without consent, and under s 18 every commercial message must contain a functional unsubscribe facility. Your privacy notice should describe your marketing practices consistently with these rules, and your sign-up forms should not bundle marketing consent into consent to process the order itself.
Data breaches: Part IIIC of the Act contains the Notifiable Data Breaches scheme. If your business experiences a data breach that is likely to result in serious harm to any affected individual, you must notify the individuals and the OAIC as soon as practicable, with a statement describing the breach, the kinds of information involved and recommended steps. A privacy notice that tells people how you handle their data should sit alongside an internal process for recognising and reporting a breach, because the two documents must tell the same story.

What happens if you get it wrong

The enforcement picture has sharpened considerably. The OAIC can investigate complaints, conduct assessments, accept enforceable undertakings and seek civil penalties in the Federal Court. The headline figures are in s 13G of the Act. For a serious or repeated interference with privacy, an individual faces a maximum penalty of $2,500,000, and a body corporate faces the greatest of $50,000,000, three times the value of the benefit obtained from the conduct, or 30% of adjusted turnover during the breach period. Less serious interferences under s 13H attract penalties capped at 2,000 penalty units, and the infringement notice power in s 13K reaches 200 penalty units for specified breaches, which include failing to have a proper privacy policy under APP 1.3 and APP 1.4.

There is also a newer exposure. As part of the 2024 reform package, the Act now contains a statutory tort for serious invasions of privacy. An individual can sue where their privacy was invaded by intrusion upon seclusion or misuse of information, where they had a reasonable expectation of privacy, where the invasion was intentional or reckless and serious, and where the public interest in privacy outweighs any countervailing interest. The action can be brought without proof of damage. That means mishandled personal information can now end in private litigation against your business, not just a regulator's attention.

The same reform package requires the OAIC to develop a Children's Online Privacy Code covering how the APPs apply to children's online privacy, and the government has said further reform proposals are still being developed. Requirements in this area have a habit of moving, so the current position should be checked before documents are finalised.

A compliance checklist for your business

Run through these steps to put your privacy notices on a compliant footing:

Confirm whether the Act applies to you, including the exceptions for health services and trading in personal information.
Map every point where you collect personal information: forms, checkout, sign-ups, bookings, job applications, cookies.
Give each collection point a short collection notice that matches what happens there.
Check each notice against the APP 5.2 list, especially the consequences of not providing the information.
Keep a full, current privacy policy that covers the APP 1.4 items and is available free on your website.
Identify overseas recipients and name the countries in your notices and policy.
Add express consent mechanisms wherever you collect sensitive information.
Make sure marketing emails and SMS carry a working unsubscribe and match what your notices say.
Put a breach response process in place so a notifiable data breach gets reported to the OAIC and affected individuals.

When to get professional help

The underlying questions here are factual, not just legal: what data flows through your systems, which third parties touch it, and where it ends up. A privacy lawyer can work through those facts with you, confirm whether your business is caught by the Act despite a low turnover, draft a privacy policy and collection notices that match your actual operations, review the contracts with your software vendors and processors, and build the internal procedures that make the documents true. Where a breach has already occurred or a complaint has been made to the OAIC, early advice about your notification obligations and your response can materially change the outcome.

The part of the notice that is most often missing

If there is one line that separates a compliant notice from a decorative one, it is APP 5.2(e): the main consequences for the customer if they do not provide the information. Most template notices say what is collected and why, and stop. They never tell the customer that without a delivery address their order cannot ship, or that without an email address no receipt can be sent. That omission is a direct gap against the statutory checklist, and it is the clearest sign that a notice was copied rather than written for the business in front of you.

Start this week by mapping your collection points and checking each one against the list in APP 5.2. If your business is under the turnover threshold but provides a health service or trades in personal information, treat yourself as covered until a lawyer has confirmed otherwise. The notice that matches what your business actually does, and tells people what happens if they decline to share, is the one that keeps a regulator's attention off your front door.