How to Create a Privacy Policy (2026 Update)

How to write a privacy policy in Australia comes down to one job: describing, in plain English, what personal information your business actually collects, why you collect it, who you share it with, whether it leaves the country, and how people can access it or complain. Under the Privacy Act 1988 (Cth) and Australian Privacy Principle (APP) 1, it is a legal requirement for most businesses that collect personal information, and from 10 December 2026 it must also disclose certain automated decisions.

Here’s the honest version. Most business owners copy a policy from a competitor, swap the name and hit publish. That shortcut sort of worked in 2018. In 2026 the regulator is auditing privacy policies, penalties rose again on 1 July, and customers can sue you directly. The good news? Getting it right is an afternoon of work, not a month.

What does a privacy policy actually do (and what doesn’t it do)?

A privacy policy is a public notice. It tells customers, users and staff what personal information you handle, what you do with it and what rights they have. Think of it as your business’s promise about data, written down where anyone can check it.

It is not a contract. Your website terms and conditions set the rules for using your site; the privacy policy explains your data handling. It also won’t protect you from a breach. Under APP 11 you still need reasonable technical and organisational security measures behind the words.

One wrong assumption we hear a lot: “customers must agree to my privacy policy.” They don’t. Forcing a tick-box that bundles “I agree to the privacy policy” with your terms doesn’t create valid consent, and consent actually matters for things like sensitive information. Tell people clearly, then ask for consent separately where the law needs it.

Commercially, it’s also a gatekeeper. Apple’s App Store and Google Play won’t list an app without one, ad platforms and payment processors expect one, and enterprise procurement teams check for it before a first meeting.

Who legally needs a privacy policy in Australia?

The Privacy Act applies to “APP entities”, and every APP entity must have a clearly expressed, up-to-date privacy policy under APP 1.3. You are an APP entity if you meet at least one of these tests:

• Annual turnover over $3 million (the famous threshold, but only one of several triggers)
• You provide a health service of any size, including allied health, GPs, dentists, pharmacies, NDIS providers and many fitness and wellness businesses
• You trade in personal information, such as buying or selling mailing lists
• You are a credit reporting body or handle credit information
• You handle personal information under a Commonwealth contract
• You operate a residential tenancy database, or you have voluntarily opted in to the Act
• You are a reporting entity under the AML/CTF Act (new from 1 July 2026, covered below)

The AML/CTF change that caught thousands of small firms

From 1 July 2026, the anti-money laundering regime expanded to real estate professionals, lawyers, conveyancers, accountants, trust and company service providers, and dealers in precious metals and stones. If you provide a designated service in one of those sectors, the small business exemption no longer protects the personal information you handle for AML/CTF purposes.

Plenty of these firms turn over less than $3 million and have never needed a privacy policy. Now they do, at least for that part of the business. If that’s you, write the policy to cover your whole operation rather than trying to ring-fence the AML/CTF bit. It’s simpler and it’s what clients will expect.

What if you really are exempt?

Some small businesses genuinely sit outside the Act. You still want a policy. Three reasons: platforms and payment providers demand one, the statutory tort for serious invasions of privacy applies to you anyway, and the exemption keeps shrinking from different directions. Building APP-compliant habits now costs far less than retrofitting them later.

What changed in Australian privacy law from 2024 to 2026?

The Privacy and Other Legislation Amendment Act 2024 (Cth), known as POLA or Tranche 1, received Royal Assent on 10 December 2024. Its provisions have been switching on in stages ever since. If your policy predates 2025, treat it as out of date.

A statutory tort for serious invasions of privacy (live since 10 June 2025)

Individuals can now sue directly for intrusion upon seclusion or misuse of information, separate from any OAIC complaint. They must show the invasion was intentional or reckless and that they had a reasonable expectation of privacy. No proof of financial loss is needed.

Ordinary carelessness won’t meet the recklessness bar. A known security gap you chose to ignore might. That’s the practical takeaway: a documented, acted-on security plan is now litigation protection as well as compliance.

Three tiers of penalties, now indexed higher

POLA added two lower tiers underneath the existing maximum penalty. The OAIC can now issue infringement notices and compliance notices without going to court. Because Commonwealth penalty units rose from $330 to $364 on 1 July 2026, the dollar figures you’ve seen quoted are already stale.

Tier	What it covers	Maximum (contraventions from 1 July 2026)
Infringement notice	Administrative failures, including a missing or non-compliant privacy policy under APP 1	200 penalty units, now $72,800 (previously $66,000)
Mid-tier civil penalty	Interferences with privacy that aren’t “serious”	10,000 penalty units for a company, now $3.64 million
Serious interference	Serious or repeated interferences with privacy	The greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover

One correction to a common error: the $50 million ceiling arrived in December 2022, not with POLA. And the “$1.7 million maximum” still floating around older articles was out of date even before that.

The OAIC has started auditing privacy policies

In January 2026 the OAIC ran its first-ever privacy compliance sweep. It targeted around 60 organisations across six sectors that collect information face to face: real estate agencies, chemists, licensed venues, car rental businesses, car dealerships, and pawnbrokers and second-hand dealers. The check was simple. Does the privacy policy meet APPs 1.3 and 1.4?

That’s a shift worth noticing. The regulator used to wait for complaints. Now it goes looking, and a boilerplate policy is the easiest thing in the world to spot.

Security uplift under APP 11

POLA spelled out that “reasonable steps” to secure personal information include both technical measures (encryption, access controls, logging) and organisational ones (staff training, access rules, an incident response plan). A firewall and good intentions won’t cut it. A written data breach policy is the cheapest organisational measure you can put in place this week.

Automated decision-making disclosures (from 10 December 2026)

New APPs 1.7 to 1.9 apply when you arrange for a computer program to use personal information to make a decision, or do something substantially and directly related to making one, that could reasonably be expected to significantly affect someone’s rights or interests. “Computer program” is broad. It captures AI tools, but also plain rules-based software.

Where that’s triggered, your policy must describe the kinds of personal information used and the kinds of decisions involved. It applies to decisions made after 10 December, even if you collected the data years ago. That’s about 11 weeks away as we write this.

Most small businesses assume this is a big-tech problem. It isn’t always. Automated credit checks, tenant screening, eligibility filters on a booking platform and fraud rules in your checkout can all be in scope. The OAIC has signalled a broad reading and flagged that you’re responsible for how third-party software makes decisions on your behalf.

Children’s Online Privacy Code (due by 10 December 2026)

The OAIC must register a code setting out how the APPs apply to children online. If under-18s use your product, plan for it now, especially if an adult organisation such as a school or club can see what the child does.

Doxxing offences

The same reform package added Criminal Code offences for menacing or harassing online release of personal data. It sits outside the Privacy Act, but it matters for any platform hosting user content.

Tranche 2 is now a draft Bill

On 31 August 2026 the Attorney-General’s Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, with submissions closing 18 September. It proposes around 40 changes. The headline is a “fair and reasonable” test for handling personal information, plus broader definitions, consent rules for trading personal information and tougher breach duties.

Here’s the surprise for small businesses: the draft does not remove the small business exemption. The commencement dates are also blank. So don’t rewrite your policy around Tranche 2 yet, but do start collecting less data you don’t need. That habit will pay off under any version of the “fair and reasonable” test.

What must a privacy policy include in Australia?

Most guides hand you a long list and call it all mandatory. It isn’t. APP 1.4 sets a specific legal floor, and ADM disclosures join it in December. Everything else is best practice that makes the policy accurate and credible. Knowing the difference tells you where to spend your effort.

What to cover	Legally required?	Source
The kinds of personal information you collect and hold	Yes	APP 1.4(a)
How you collect and hold it	Yes	APP 1.4(b)
The purposes you collect, hold, use and disclose it for	Yes	APP 1.4(c)
How people can access and correct their information	Yes	APP 1.4(d)
How people can complain about a breach of the APPs, and how you’ll handle it	Yes	APP 1.4(e)
Whether you’re likely to disclose information overseas	Yes	APP 1.4(f)
The countries involved, if it’s practicable to list them	Yes	APP 1.4(g)
Kinds of personal information used in automated decisions, and kinds of decisions made	Yes, from 10 December 2026, where triggered	APPs 1.7 to 1.9
Your contact details and a privacy officer	Best practice (and hard to meet 1.4(d) and (e) without it)	Practical necessity
Named third-party providers or clear categories	Best practice	Supports accuracy under APP 1.4(c)
Cookies, pixels and analytics	Best practice	Supports APP 1.4(b)
Security measures and retention periods	Best practice	Reflects APP 11
Direct marketing and how to opt out	Best practice	Reflects APP 7 and the Spam Act 2003
How you respond to data breaches	Best practice	Reflects the Notifiable Data Breaches scheme
How you’ll tell people about policy changes	Best practice	Keeps the policy “up to date” under APP 1.3

Two items deserve more words than most templates give them.

Overseas disclosure first. If you use a US-hosted CRM, email platform, cloud accounting tool or analytics service, personal information is almost certainly leaving Australia. Say so, and name the likely countries. POLA created a mechanism for the government to whitelist countries with similar protections, but until those determinations exist, contractual safeguards under APP 8 still do the heavy lifting.

Then cookies. The Privacy Act doesn’t mandate a cookie banner the way UK and EU law does, but analytics and ad pixels collect identifiers, and the policy needs to describe them. Our guide on why cookies belong in your privacy policy covers the detail.

If you want a deeper dive into each principle before you draft, start with our breakdown of the 13 Australian Privacy Principles.

How to write a privacy policy in 7 steps

For most small businesses, writing a privacy policy from a blank page is slow and risky. A good template plus a lawyer’s eye is faster and more accurate. Here’s the order that works.

1. Map your data before you touch a template

List every place personal information enters, sits in or leaves your business. Skip this and the policy can’t be accurate, however well it’s worded. Copy this checklist and fill it in:

• Collection points: contact forms, checkout, account sign-up, booking tools, phone and email enquiries, in-person forms, CCTV
• Tools: website platform, CRM, email marketing, payment gateway, analytics, ad pixels, chat widgets, cloud storage, accounting software
• Location: where each tool stores data, and which countries its support teams access it from
• People: which staff and contractors can see what
• Deletion: how long you keep each type of data, and what happens after that
• Automation: any tool that scores, screens, approves or rejects people

2. Work out which rules catch you

Run through the tests above. Then check the extras: do you have EU customers or track EU visitors (GDPR)? Do you send marketing emails or SMS (Spam Act)? Do you collect health information, which is sensitive information needing consent? Each one changes what your policy has to say.

3. Build from an Australian template, not a generic one

Lawpath’s Privacy Policy template is built around the APPs and walks you through each required section with questions about your business. If you deal with people in the EU, the GDPR Privacy Policy covers both regimes in one document.

What about asking an AI chatbot to write it? You’ll get something that reads well and says very little that’s true about you. The model doesn’t know your vendors, where your data sits or what you plan to do with it, and those are exactly the parts the OAIC checks.

4. Fill it in honestly, not aspirationally

Describe what you do today. If you share data with your payment processor, name it. If your analytics vendor is in the US, say so. If you might sell aggregated insights one day, flag it now (more on why below).

5. Add collection notices where you collect data

The privacy policy is the full story. APP 5 also expects a short notice at the moment you collect information, telling people who you are, why you’re collecting it and where to find the full policy. A Privacy Collection Notice under your sign-up or enquiry form handles this in a few lines.

6. Get a lawyer to review it

A template catches what’s in it. A lawyer catches what’s missing from your business. With Lawpath’s Legal Advice Plan you can book unlimited 30-minute calls and upload the draft for review, which costs a fraction of bespoke drafting.

7. Publish it everywhere and diarise a review

Link it from your footer, sign-up flow, checkout, email opt-in forms and app store listing. Then set a 12-month reminder, plus a trigger to revisit it whenever you add a tool, launch a feature or enter a new country.

What should your website privacy policy cover for your type of business?

The seven legal items stay the same. What changes is where the risk sits. Here’s what to add or emphasise depending on how your business runs.

Business type	What your privacy policy needs to get right
Ecommerce store	Payment processors, shipping partners, ad pixels and retargeting, and overseas hosting of your store platform
Service business with online booking	The booking tool as a third party, reminder SMS and emails, and how long you keep appointment history
App or SaaS product	Device identifiers, location data, voice or camera access, crash reporting tools, and any automated decisions about users
Health, fitness or wellness	Sensitive information handling, consent for health questions, symptom or screening data, and community or forum posts
Email and SMS marketing	Consent, unsubscribe mechanics, and whether you use lists from third parties
Products used by under-18s	Who sees the child’s activity (parents, schools, coaches), parental consent, and the incoming Children’s Online Privacy Code
AML/CTF reporting entities	Identity verification records, what you must retain by law, and reporting to AUSTRAC

Launching a new site? Our checklist of legal documents you need for your website shows how the privacy policy fits alongside your terms and refund policy.

What we see in Lawpath consultations

Privacy policies come across our lawyers’ desks every week, usually bundled with website terms right before launch. The same six patterns keep showing up.

The policy is treated as the last step before launch

A familiar brief: the platform is built, integrations are live, and the founder plans to commercialise user data later. The only thing left is “the legal bit”. That order is backwards. The policy shapes what you can collect, how long you can keep it and what you can sell, so drafting it after the build means either the policy bends to fit the product or the product gets rebuilt.

AI-drafted policies arriving for review

More founders now arrive with a privacy policy and terms generated by an AI tool, asking for a quick check. In practice, many need a proper redraft rather than a tidy-up. The prose is fine. The gaps are the parts only you know: which vendors you use, where data sits, who sees it and what you plan to do with it next.

Everyday software creates overseas disclosures nobody noticed

A wholesaler using cloud accounting, inventory software and a credit-check service is disclosing personal information offshore and handling credit information. Most owners in that position don’t think of themselves as “sending data overseas”. The policy has to say it anyway, because APP 8 and APP 1.4(f) don’t care whether it felt like a decision.

Wellness apps don’t realise they’re handling health information

Fitness, nutrition and wellbeing apps increasingly collect screening questions, symptom logs and community posts about health. That’s sensitive information. It needs consent, tighter handling and a policy that names it plainly. A generic “we collect your name and email” template misses the most important thing the app does.

Products for teenagers need more than a standard policy

We regularly see platforms where under-18s complete activities and an adult organisation, such as a school or club, sees the results. These need consent documents for minors, clear rules on who sees what, and a policy written with the Children’s Online Privacy Code in mind. Starting from an adult-focused template here creates rework later.

The data commercialisation clause goes in too late

If you might sell aggregated insights, partner with advertisers or train models on user content, say so from day one. Adding it later means prominently notifying users or seeking fresh consent, and some of them will leave. “Future commercialisation of de-identified or aggregated data” is a legitimate inclusion if it’s a genuine plan.

What are the most common privacy policy mistakes?

• Copying a competitor’s policy. You inherit their vendors, their data flows and their risk profile. None of it describes you.
• Promising “we never share your data”. If you use hosting, email or analytics tools, that sentence is false on day one.
• Vague “trusted partners” language. Name categories at minimum, and specific providers where you can.
• Silence on overseas disclosure. APP 1.4(f) makes this a legal requirement, not a nice-to-have.
• A contact email but no complaint process. APP 1.4(e) asks how you’ll deal with a complaint, not just where to send it.
• Ignoring automated decisions. If software screens, scores or approves people, you need ADM wording by 10 December 2026.
• Bundling the privacy policy into an “I agree” checkbox and calling it consent.
• Burying the link. A footer link is the minimum; sign-up, checkout and opt-in forms need it too.
• Set and forget. Every new tool or feature is a reason to reopen the document.

Frequently asked questions

Do I legally need a privacy policy in Australia?

Yes, if you’re covered by the Privacy Act. That includes businesses turning over more than $3 million, health service providers, businesses trading in personal information, credit providers, Commonwealth contractors and, since 1 July 2026, AML/CTF reporting entities. Even if you’re exempt, app stores, payment providers and business customers will usually expect one.

How do I write a privacy policy for my website?

Map what personal information you collect and which tools touch it, then build from an Australian template that covers the seven APP 1.4 items. Add collection notices on your forms, get a lawyer to review the draft, and link the finished policy from your footer, sign-up and checkout pages.

Can I use AI to write a privacy policy?

You can use it for a first draft, but don’t publish it unchecked. AI tools don’t know your vendors, data locations or future plans, which are the details the OAIC checks. Lawpath lawyers regularly redraft AI-generated policies because they read well but don’t describe the business accurately.

How much does a privacy policy cost?

With Lawpath, your first document is free when you sign up, and unlimited documents are available on a paid plan. A lawyer review through the Legal Advice Plan adds expert checking without hourly fees. Bespoke drafting by a privacy lawyer costs considerably more, especially for apps or health data.

What happens if I don’t have a privacy policy?

If you’re required to have one, the OAIC can issue an infringement notice (200 penalty units, now $72,800), a compliance notice, or pursue civil penalties in court. Serious or repeated breaches can reach $50 million, three times the benefit, or 30% of turnover. Individuals can also sue under the statutory tort.

Can I just copy another business’s privacy policy?

No. A copied policy describes someone else’s data practices. If your tools, vendors or data locations differ, your policy is inaccurate from day one. The OAIC and any plaintiff will compare what you do against what you wrote, and copying may also infringe the other business’s copyright.

How often should I update my privacy policy?

At least every 12 months, and whenever your data practices change: a new tool, feature, marketing channel or country. Right now there’s a hard deadline too. If you use automated decision-making, update your policy before 10 December 2026.

What’s the difference between a privacy policy and a collection notice?

A privacy policy is the full public document required by APP 1. A collection notice is a short statement shown when you collect information, required by APP 5, explaining who’s collecting it, why, and where to read the full policy. Most businesses need both.

Do I need a GDPR privacy policy as well as an Australian one?

If you offer goods or services to people in the EU, or monitor their behaviour through analytics cookies, the GDPR applies wherever your business is based. A dual-compliant policy, such as Lawpath’s GDPR Privacy Policy, covers both regimes in one document.

Does the statutory privacy tort apply to small businesses?

Yes. The tort for serious invasions of privacy, live since 10 June 2025, applies regardless of turnover or the small business exemption. A claimant must show the invasion was intentional or reckless. Ignoring a known security weakness is the kind of conduct that creates that risk.

You don’t need a perfect policy. You need a current one.

If your privacy policy has been sitting in the “important but not urgent” pile, you’re in good company. Most businesses we speak with are in the same spot. The fix is small: a policy that matches what you actually do, checked against the current Act, and reopened when your tools change.

Lawpath keeps it in one place. Over 650,000 Australian businesses use our 550+ legal templates and on-demand lawyers to get this kind of admin done and get back to work. Start with the template, get it reviewed, publish it, and put a reminder in your calendar for next year.