Anja Pich is a commercial lawyer and the Managing Lawyer at Lawpath. She practises across all areas of commercial law and advises businesses of every size, from first-time founders to established companies, on their legal, regulatory and commercial needs.
Table of Contents
The legal documents for an online business in Australia come down to a short list: a privacy policy, website terms and conditions, and a returns and refunds policy, plus a shipping policy, a website development agreement and a cyber security policy depending on what you sell. Some are required by law. Others just save you from a bad day later.
Here’s the part nobody enjoys. The legal side of an online store feels like homework you keep pushing to next week, because you’re busy building the actual business. So the documents sit on the to-do list. Then a customer disputes a refund, or a regulator sends a letter, and suddenly they matter a lot.
- Four documents cover most online businesses. A privacy policy, website terms and conditions, a returns and refunds policy, and a shipping policy handle the bulk of your legal exposure.
- A privacy policy is a legal requirement for many stores, not just big ones. If your business trades in personal information, you likely need one even under the $3 million turnover threshold.
- A blanket “no refund” term can break the law. The ACCC’s 2025 sweep of more than 2,000 retail websites found returns policies that stripped away consumer guarantee rights.
- A privacy rule change lands on 10 December 2026. Businesses that use automated decision-making will have to disclose it in their privacy policy.
- Templates beat a blank page. A vetted template gets a compliant document live in minutes, not days.
What legal documents do you need for an online business in Australia?
Start with what you sell and how you collect information. Most Australian online businesses need the same core set, then add a few more based on their model. The table below sorts the main online business documents by whether the law requires them or they’re simply smart to have.
| Document | What it does | Required by law? |
|---|---|---|
| Privacy policy | Explains how you collect, use and store personal information | Yes, if you’re an APP entity or trade in personal information |
| Website terms and conditions | Sets the rules for buying and browsing, including liability and consumer guarantee terms | Not named in one Act, but the terms must meet the ACL |
| Returns and refunds policy | Tells customers how faulty or unwanted goods are handled | Not mandated, but it cannot override consumer guarantees |
| Shipping policy | Sets delivery timeframes, costs, risk and lost-parcel handling | No, but strongly advised |
| Website development agreement | Covers who owns the site, plus costs, timelines and IP | No, but it protects you against your developer |
| Cyber security policy | Sets out how you protect data and respond to a breach | No, but increasingly expected |
| GDPR privacy policy | Meets EU data protection rules | Only if you handle EU customers’ data |
If you only do three things this week, sort the first three rows. They carry the real legal risk. The rest protect your time and your margins, which matters too, just not in the same way as a regulator’s letter.
Which online business documents are required by law?
Three documents do the heavy lifting on compliance. Get these right and you’ve covered most of what a regulator or an unhappy customer could come at you for.
Privacy policy
A privacy policy is a legal document that explains how your business collects, uses, stores and shares personal information. Under the Privacy Act 1988 (Cth), any organisation classed as an APP entity has to have one and make it easy to find on the website.
Here’s where most small online sellers slip up. They assume the $3 million turnover threshold lets them off the hook. It often doesn’t. A business under that figure still has to comply if it trades in personal information, which covers buying or selling customer data. If that describes your model, the exemption is off the table.
One more change is coming. From 10 December 2026, businesses that use automated decision-making, think algorithms that set pricing, approvals or eligibility, will need to spell that out in their privacy policy. That obligation arrived with the Privacy and Other Legislation Amendment Act 2024 (Cth). If any part of your store runs on automated decisions, put a reminder in the diary now.
Get a free Privacy Policy when you sign up to Lawpath today.
Website terms and conditions
Your website terms and conditions set the rules customers agree to when they browse or buy. No single law says “you must publish terms”. But the terms you do publish have to meet the Australian Consumer Law under the Competition and Consumer Act 2010 (Cth).
Good terms cover order acceptance, pricing, delivery, disclaimers, dispute resolution, and the consumer guarantees every buyer gets by law. Get them wrong and they do more than fail to protect you. They can mislead customers, and that’s a breach in its own right.
Returns and refunds policy
Your returns and refunds policy tells customers what happens when something arrives faulty, late or not as described. The policy itself isn’t legally mandatory. What you can’t do is use it to cancel the consumer guarantees every Australian buyer is entitled to.
This is exactly where the regulator is looking. In early 2025, the ACCC’s sweep of more than 2,000 retail websites found returns policies that quietly stripped those rights away. It flagged lines like “sale items cannot be returned”, “opened items cannot be refunded”, and restocking fees charged on faulty goods. One furniture retailer paid $56,340 in penalties for claiming remedy rights lasted just 72 hours.
The fix is easy. State your change-of-mind policy, then make clear it sits on top of the consumer guarantees, not instead of them. A customer with a faulty product keeps their statutory rights no matter what your policy says, so pretending otherwise only invites trouble.
Which online business documents are best practice but not mandatory?
These four aren’t required by law. Skip them and it still costs you, usually at the worst possible moment.
Shipping policy
A shipping policy spells out your delivery timeframes, where you ship, what it costs, and what happens when a parcel is damaged or goes missing. No law forces you to publish one.
Here’s the practical payoff. Every question a shipping policy answers upfront is a support email you don’t have to write at 9pm. It also sets expectations, which heads off a good share of delivery disputes before they ever reach your inbox.
Website development agreement
If you’re paying someone to build your site, a website development agreement is the contract between you and the developer. It covers specifications, cost, timeline, confidentiality, maintenance, and the big one, who owns the finished site.
The IP clause is where founders get burned. Without it, your developer can walk away owning the code your business runs on. A common trap is paying the final invoice and assuming ownership transferred with it. It doesn’t, unless the agreement says so in writing.
Cyber security policy
A cyber security policy sets out how you protect your systems and customer data, and what you do if there’s a breach. It works as a guide for you and anyone else who touches your site.
As data-breach rules tighten, a written policy is shifting from nice-to-have to expected. It also gives your team one clear set of steps when something goes wrong, instead of improvising at the exact moment you can least afford to.
GDPR privacy policy
If you have customers in the European Union, a GDPR privacy policy may be on your list too. GDPR is the EU’s data protection law, and it reaches any business handling EU residents’ data, wherever that business sits.
GDPR policies look like an Australian privacy policy but carry extra mandatory content: your data protection officer’s details, why you process data, retention periods, transfer safeguards, and each person’s data rights. The fines for getting it wrong are steep, so take this on only if you genuinely serve EU customers.
What online businesses get wrong with their legal documents
Several mistakes show up again and again with online sellers. Each one is easy to avoid once you know to look for it.
- Copying another site’s documents. It’s tempting. But you inherit their business model, their jurisdiction, and sometimes their mistakes. A borrowed refund clause that breaches the ACL is still your breach.
- Treating documents as set-and-forget. The law shifted in 2024 and shifts again in December 2026. A privacy policy written three years ago may already be out of date.
- Hiding the policies. Bury your privacy policy or terms where no one can find them and you undercut the whole point. They need a link on every page.
- Assuming small means exempt. The $3 million privacy threshold has carve-outs, and the Australian Consumer Law applies to businesses of every size.
How to get your online business legal documents sorted
You don’t need a lawyer on retainer or a spare weekend to do this properly. Work in order of risk. Privacy policy first, then website terms, then your returns and shipping policies. Add the website development agreement next time you hire a developer, and the GDPR policy only if you sell into Europe.
Staring at a blank page? You’re not behind. Most online businesses get these documents in place after they launch, not before, and sorting them now puts you ahead of the retailers the ACCC is busy writing to. A vetted template handles the structure and the legal language, so you fill in your details and publish.
Browse Lawpath’s online business document templates and get your privacy policy and website terms live today.
Frequently asked questions
What legal documents do I need for an online business in Australia?
At a minimum, a privacy policy, website terms and conditions, and a returns and refunds policy. Depending on what you sell, add a shipping policy, a website development agreement, a cyber security policy, and a GDPR privacy policy if you have EU customers.
Is a privacy policy legally required for a small online business?
Often, yes. If your business is an APP entity or trades in personal information, you need one even under the $3 million turnover threshold. Even when you’re exempt, a privacy policy builds trust and is what most customers now expect to see.
Do I legally need website terms and conditions?
No single law says you must publish them. But any terms you do publish have to meet the Australian Consumer Law. Clear terms protect you by setting out order acceptance, delivery, disclaimers, and the consumer guarantees buyers are entitled to.
Can I put “no refunds” on my online store?
No. A blanket “no refunds” line can breach the Australian Consumer Law, because consumer guarantees can’t be cancelled by your policy. The ACCC’s 2025 website sweep targeted exactly this. You can set a change-of-mind policy, as long as it sits on top of those guarantees.
What is changing for privacy policies in December 2026?
From 10 December 2026, businesses that use automated decision-making must disclose it in their privacy policy, including the kinds of information used and decisions made. The rule came in with the Privacy and Other Legislation Amendment Act 2024. Review your policy well before then.
Do I need a GDPR privacy policy in Australia?
Only if you handle the personal data of people in the European Union. If you do, GDPR applies no matter where your business is based, and your policy needs extra details Australian law doesn’t require. If all your customers are in Australia, you can skip it.
How much do online business legal documents cost?
It runs from free templates to several thousand dollars for bespoke legal drafting. A vetted template covers most standard online businesses for a small fraction of lawyer fees, and you can have one live in minutes rather than weeks.
Who owns my website if a developer builds it?
Not you, unless your website development agreement says so. Paying the final invoice doesn’t transfer ownership of the code or design on its own. The agreement should assign the intellectual property to your business on final payment, in writing.
