Do I need a privacy policy for my business?

Australian Privacy Principle 1 requires every business the Privacy Act covers to have a privacy policy. The Act covers businesses with annual turnover of more than $3 million. If your turnover has been over $3 million in any financial year since 2002, you're covered even if it has dropped since. Turnover means income from all sources, not profit.

Smaller businesses are generally exempt, but the Act applies regardless of turnover if, for example, you:

• provide a health service and hold health information (this includes gyms, physios, naturopaths and similar businesses)
• trade in personal information, such as buying or selling customer data without consent
• provide services under a Commonwealth government contract
• are related to a business the Act covers, or have chosen to opt in

The OAIC's small business page has the full list. A covered business that has no privacy policy, or one missing required content, can be issued an infringement notice by the OAIC.

Not yet. In 2023 the Government agreed in principle to remove the exemption, but only after further consultation and an assessment of the impact on small business.

The first round of reforms, the Privacy and Other Legislation Amendment Act 2024, left the exemption in place. In August 2026 the Attorney-General's Department released a draft bill with a second round of reforms for public consultation. That draft does not remove the exemption, and it has not been passed.

So, as at October 2026, the $3 million threshold still applies. Removal remains a possibility for the future. If it happens, most small businesses would need to comply with all the Australian Privacy Principles, not just publish a policy.

Even if you're exempt, the tools you rely on often require a policy:

• App stores. Apple and Google both require every app to link to a privacy policy.
• Analytics. Google Analytics' terms require you to post a privacy policy that tells users you use cookies.
• Larger customers and partners may ask how you handle data before they sign up with you.

Customers also look for one when you ask for their details at checkout or on a sign-up form. Once you publish a policy, follow it. Telling people you handle their data one way and doing another can be misleading conduct under the Australian Consumer Law.

APP 1 sets out what a policy must cover. It should explain:

• the kinds of personal information you collect and hold
• how you collect it, how you store it and how you keep it secure
• why you collect, use and disclose it
• how people can access their information and ask you to correct it
• how people can complain about a privacy breach, and how you'll handle complaints
• whether you're likely to send information overseas and, if practical, to which countries

Write it in plain English and make it match what you actually do. The OAIC warns against copying another business's policy or simply repeating the wording of the principles. Publish it free on your website and review it regularly.

From 10 December 2026, covered businesses that use computer programs to make decisions about people using their personal information, where those decisions could significantly affect them, must also explain this in their policy.

If you'd like a policy drafted around how your business really works, a Sprintlaw lawyer can prepare one for a fixed fee.