Privacy Act Basics for Australian Business Websites

Almost every business website collects personal information, through contact forms, bookings, online orders, newsletters and analytics. Customers increasingly care how their data is handled, and privacy laws continue to strengthen.

This article is general information, not legal advice. Speak to a legal professional about your specific obligations.

Does the Privacy Act apply to my business?

The Privacy Act 1988 and the Australian Privacy Principles (APPs) apply to businesses with an annual turnover of more than $3 million, and to some smaller businesses, such as health service providers and businesses that trade in personal information. Even if you're exempt, following the APPs is good practice and builds trust. Check the Office of the Australian Information Commissioner (OAIC) website for current rules.

Website essentials

• A clear privacy policy explaining what you collect, why, who you share it with and how people can access or correct it.
• Collect only what you need. Don't ask for date of birth on a contact form if you don't need it.
• Secure your website with HTTPS, strong passwords, multi-factor authentication and regular updates.
• Know where your data goes. Many tools store data overseas; your privacy policy should say so.
• Get consent for marketing emails and include an unsubscribe link, as required by the Spam Act 2003.

If something goes wrong

Under the Notifiable Data Breaches scheme, businesses covered by the Privacy Act must notify affected people and the OAIC when a data breach is likely to cause serious harm. Have a simple plan ready: who to call, how to contain the breach and how to assess the risk.

Quick checklist

1. Review every form on your website and remove unnecessary fields.
2. Publish or update your privacy policy.
3. Check which third-party tools collect data and where they store it.
4. Turn on multi-factor authentication for website and email admin accounts.
5. Write a short data breach response plan.

We build websites and systems with security and privacy in mind from day one. Talk to us about reviewing your website.