When your startup must have a privacy policy under the Privacy Act

Most startups collect personal information from their first day of trading, whether that is an enquiry form on a website, a newsletter list, or an online checkout. Under the Privacy Act 1988 (Cth) (the Act), a business that is covered by the Act must have a clearly expressed and up-to-date privacy policy, and that policy must say specific things about how personal information is collected, used and protected (Australian Privacy Principles 1.3 and 1.4).

The catch is that many founders do not know whether the Act covers them at all. The Act exempts most businesses with annual turnover of $3 million or less, but the exemption has a long list of exceptions, and the government has proposed removing it. This article sets out when the obligation applies, what the privacy policy must contain, the supporting duties that sit behind it, what it costs to get it wrong, and the steps you can take this week.

Who must comply: the turnover test and its exceptions

The starting point is the small business exemption in s 6D of the Act. A business is a "small business" if its annual turnover for the previous financial year was $3,000,000 or less, and a small business operator (an individual, company, partnership, association or trust that only carries on small businesses) is generally exempt from the Act. Turnover is worked out under s 6DA and includes proceeds of sales, commission income, rent and leasing income, interest, royalties and dividends, and other operating income.

The exemption stops applying if the business:

• Provides health services: a business that provides a health service to another individual and holds health information is covered regardless of turnover (s 6D(4)(b)).
• Trades in personal information: a business that discloses personal information about another individual for a benefit, service or advantage is covered regardless of turnover (s 6D(4)(c)).
• Collects personal information for a benefit: a business that provides a benefit, service or advantage in order to collect personal information from someone else is covered (s 6D(4)(d)).
• Works for government: a contracted service provider for a Commonwealth contract is covered (s 6D(4)(e)).
• Is a credit reporting body: these are covered regardless of turnover (s 6D(4)(f)).
• Belongs to a larger group: a body corporate related to a company that is not a small business operator is covered, even if its own turnover is under $3 million (s 6D(9)).

A small business that is exempt can choose to opt in to the Act by giving the Information Commissioner a written choice under s 6EA. Some businesses do this for credibility with investors, insurers and enterprise customers who expect APP-level handling of their data.

Even where the Act does not apply, most startups will still need a privacy policy. App stores, payment gateways, advertising platforms and B2B contracts routinely require one, and a website that collects personal information without explaining what happens to it creates trust and consumer-law risk. The practical answer for a founder is simple: if your site has a contact form, a newsletter signup or a checkout, you should have a privacy policy even if the Act does not strictly require one.

One forward-looking point: the government has proposed removing the small business exemption in the next tranche of privacy reform. As at the time of writing it remains in force, but do not build your compliance on the assumption that it will last. If the exemption goes, most startups will become covered entities overnight.

The core duty: a clearly expressed, up-to-date privacy policy

If you are covered by the Act, Australian Privacy Principle 1.3 requires you to have a privacy policy that is clearly expressed and up to date. Principle 1.4 sets out what it must contain:

• Kinds of information: the kinds of personal information the business collects and holds.
• How it is collected and held: the methods of collection and the systems that hold the information.
• Purposes: the purposes for which the business collects, holds, uses and discloses personal information.
• Access and correction: how an individual can access their personal information and seek correction of it.
• Complaints: how an individual can complain about a breach of the Australian Privacy Principles or an APP code, and how the business will deal with the complaint.
• Overseas disclosure: whether the business is likely to disclose personal information to overseas recipients and, where practicable, the countries where they are likely to be located.

"Clearly expressed" is doing real work in Principle 1.3. A policy written in dense legalese, or one that describes an idealised version of the business rather than the way it actually operates, satisfies neither the letter nor the spirit of the principle. The policy also needs to stay up to date: every time the business adds a tool, changes a process or starts marketing differently, the policy should be checked against it.

The duties behind the policy

A privacy policy is a description of how the business actually operates, so the principles that govern collection, use, disclosure and storage are the substance behind the document. Four of them matter most to a startup.

Collect only what you need

Australian Privacy Principle 3 says an organisation must not collect personal information unless it is reasonably necessary for one or more of its functions or activities. Sensitive information (racial or ethnic origin, political opinions, religious beliefs or affiliations, sexual orientation or practices, criminal record, health information and similar categories defined in s 6 of the Act) can only be collected with the individual's consent (Principle 3.3). For a startup this usually means cutting fields out of forms rather than adding them, and thinking twice before asking for anything beyond what the product actually needs.

Be careful with overseas recipients

Most startups run on cloud tools, and many of those tools store or process data offshore. Australian Privacy Principle 8.1 requires that before disclosing personal information to an overseas recipient, the business takes such steps as are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles in relation to the information. Section 16C then makes the business accountable: an act done by the overseas recipient is treated, for the purposes of the Act, as an act done by the business itself. That is why Principle 1.4 requires the policy to say whether information is likely to be sent overseas and where. A policy that says "we never share data overseas" while the email marketing platform stores data in the United States is not just inaccurate; it is a mismatch that the regulator and customers can point to if something goes wrong.

Keep information secure

Australian Privacy Principle 11 requires an APP entity to take such steps as are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. It also requires the business to destroy or de-identify information it no longer needs. The standard is reasonableness, not perfection: a startup is not expected to publish its security architecture, but it is expected to have access controls, sensible storage practices and a process for deleting what it no longer needs.

Honour access, correction and complaints

Individuals have rights to request access to personal information held about them and to seek correction, and Principle 1.4 requires the policy to explain how they exercise those rights. A startup that is covered by the Act needs an internal process for receiving and responding to those requests, and a complaints pathway that does not end in a dead mailbox. This is also where a data breach response plan belongs, because the notification obligations below are time-sensitive.

Data breaches: the notification duties

If you are covered by the Act, the Notifiable Data Breaches scheme in Part IIIC of the Act applies. An eligible data breach is broadly an unauthorised access, disclosure or loss of personal information that is likely to result in serious harm to affected individuals.

The scheme works in stages. If you become aware that there are reasonable grounds to suspect an eligible data breach, you must carry out a reasonable and expeditious assessment of whether there are reasonable grounds to believe a breach has occurred, and take all reasonable steps to complete that assessment within 30 days (s 26WH). If the assessment concludes there are reasonable grounds to believe an eligible data breach has happened, you must prepare a statement describing the breach and the kinds of information involved and give it to the Office of the Australian Information Commissioner (OAIC) as soon as practicable (s 26WK). You must then notify the affected individuals, or publish the statement on your website if it is not practicable to notify them individually (s 26WL). The Information Commissioner can also direct an entity to notify if it has not done so (s 26WR).

For a startup, the practical point is to know what you hold and where, so that when an incident happens (a lost laptop, a compromised staff account, a misconfigured database) you can assess it quickly. The 30-day clock starts running from awareness, not from when you get around to it.

What it costs to get it wrong

The OAIC investigates complaints and can seek civil penalties in the Federal Court. Since the Privacy and Other Legislation Amendment Act 2024 (Cth) raised the penalty framework:

• Serious interference with privacy: up to $2,500,000 for an individual, and for a body corporate the greatest of $50,000,000, three times the value of the benefit obtained, or 30% of adjusted turnover during the breach turnover period (s 13G of the Act).
• Other interferences with privacy: up to 2,000 penalty units per contravention (s 13H).
• Infringement notices: the Commissioner can issue infringement notices for a breach of the privacy policy requirements themselves, because Principles 1.3 and 1.4 are listed among the provisions for which notices can be issued (s 13K). Failing to have a compliant privacy policy is therefore not a paperwork-only problem.

Since 10 June 2025, individuals have also been able to sue directly for serious invasions of privacy under the new statutory tort in Schedule 2 of the Act, which covers intrusion upon seclusion and misuse of information where the invasion was intentional or reckless and serious. The first decision applying the tort, Kurraba Group Pty Ltd v Williams [2025] NSWDC 396, was handed down late that year.

There is also a consumer-law dimension. Statements in a privacy policy are made in trade or commerce, and s 18 of the Australian Consumer Law (Schedule 2 of the Competition and Consumer Act 2010 (Cth)) prohibits conduct that is misleading or deceptive or likely to mislead or deceive. A policy that promises standards the business does not follow is not only a privacy problem; it is a representation that customers and the regulator can hold the business to.

A practical compliance checklist

Work through these steps in order, and keep a record of each one so the policy can withstand scrutiny:

• Confirm whether the Act applies: run the turnover test and the exceptions each year end, and keep an eye on the proposed removal of the exemption.
• Draft the policy against the Principle 1.4 list: use plain language, not legalese.
• Audit every third-party tool: hosting, CRM, email marketing, analytics, payment processing and support platforms all receive personal information. Know what each one gets and where it stores it.
• Make the overseas disclosure statement true: keep the list of countries practicable.
• Put collection notices on forms and checkouts: make sure the policy lines up with your terms of use and refund statements.
• Set up internal processes: access, correction and complaints, and a data breach response plan.
• Review the policy at least annually: every time you add a tool, change a marketing channel or start collecting a new category of information.

When a lawyer should be involved

A privacy lawyer's first job is scoping: working out whether the Act applies to you, including the exceptions that founders routinely miss. The two that catch startups by surprise are the health services exception (fitness, wellness, counselling and allied health apps collect health information even when they do not think of themselves as health providers) and the trading-in-personal-information exception (lead generation and data-driven businesses are caught even at low turnover).

A lawyer then drafts the policy to the Principle 1.4 contents, checks it against your actual data flows, reviews your supplier arrangements against Principle 8.1, and can put collection notices, complaints processes and a data breach response plan in place. If you deal with enterprise clients, a data processing agreement with your suppliers is often a condition of winning the work.

Check the two assumptions most startups get wrong

The first assumption is that you are exempt because you are small. If you provide health services, trade in personal information or belong to a larger group, the exemption never applied to you, and the government has proposed removing it altogether.

The second assumption is that the policy only needs to look right. The regulator, your customers and now the courts look at what the policy says against what the business actually does, and the gap usually sits in overseas disclosure and third-party tools. The most useful thing you can do this week is open your billing and marketing tool lists, find where each one stores its data, and fix the overseas disclosure statement in your policy so it matches reality. That single correction makes the policy accurate, and accuracy is what the Act actually requires.