Anja Pich is a commercial lawyer and the Managing Lawyer at Lawpath. She practises across all areas of commercial law and advises businesses of every size, from first-time founders to established companies, on their legal, regulatory and commercial needs.
The core legal documents for an online business in Australia are a privacy policy, website terms and conditions, a returns and refunds policy, a shipping policy, and, if you sell into the EU, a GDPR privacy policy. Together they set out how you collect data, what customers agree to when they buy, and who carries the risk when an order goes wrong.
Here’s the part nobody enjoys. Most online founders sort these out after the problem, not before it. A chargeback lands. A customer quotes their rights back at you. A letter arrives from the regulator. The documents felt like admin you could push to “later”, and later showed up at the worst possible time.
Good news: the list is shorter than it looks, and most of it is a weekend job, not a six-month project. Let’s get your legal documents for your online business sorted properly, in the right order.
- Five documents cover most online businesses. A privacy policy, website terms and conditions, a returns and refunds policy, a shipping policy, and a GDPR privacy policy if you have EU customers.
- Two are effectively required, the rest are strong best practice. A privacy policy is legally required if you collect personal information and meet the Privacy Act thresholds; sale terms are required once you transact online under Australian Consumer Law.
- A shipping policy can’t shift consumer-guarantee liability. You stay responsible for goods arriving in acceptable quality, even when a courier causes the damage.
- “No refunds” wording can get you fined. The ACCC reviewed more than 2,000 retail websites and flagged refund and return terms that undercut consumer rights.
- One privacy change is already dated. From 10 December 2026, affected businesses must disclose automated decision-making in their privacy policy, so a 2022 template is already behind.
Which legal documents does an online business actually need?
Most online businesses need the same core set, plus one or two extras depending on what they sell and where. The table below splits the legal documents for an online business into what the law requires and what is best practice that still saves you grief.
| Document | Who needs it | Required or best practice? |
|---|---|---|
| Privacy policy | Any site that collects personal information (names, emails, payment details) | Required if you meet the Privacy Act thresholds; best practice for everyone else |
| Website terms and conditions | Any site that sells, delivers, or advertises online | Required once you transact online |
| Returns and refunds policy | Anyone selling goods or services | Best practice, and your wording must not undercut consumer guarantees |
| Shipping policy | Anyone shipping physical goods | Best practice |
| GDPR privacy policy | Sites with EU customers or an EU presence | Required if the GDPR applies to you |
| Website development agreement | Anyone building or commissioning a site | Best practice |
| Cyber security policy | Anyone storing customer or payment data | Best practice |
Privacy policy
A privacy policy template tells visitors what data you collect, why, where it goes, and how they can get it corrected or removed. If your business collects personal information and meets the Privacy Act thresholds, you must have one. Below the threshold, you still want one, because customers hand over card details to a stranger and a clear policy is how you earn that.
One trap worth naming early: a privacy clause buried inside your terms does not count. The policy has to be a separate, current document linked from every page, including your checkout. Copy-paste it from another store and it will describe data flows you don’t have and miss the ones you do.
Website terms and conditions
Your website terms and conditions are the contract between you and everyone who uses your site. They set out how customers can use the site, what they can’t do, how orders and payments work, and where your liability stops. Sell online without them and every dispute starts from zero, on the customer’s terms.
Sell overseas and you want a jurisdiction clause too, naming the state whose law governs any dispute. Most Australian stores point to their home state. It’s a single line that decides which courtroom you’d ever be arguing in.
Returns, refunds, and shipping
Returns and shipping policies tell customers what to expect: delivery times, costs, what happens to a lost or damaged parcel, and how a return works. Neither is strictly required by law. Both save you hours of “where is my order” email and head off disputes before they start.
Wording is where businesses get caught. Your refund terms cannot sit above the consumer guarantees in Australian Consumer Law. A blanket “no refunds” line is not just unenforceable. The ACCC treats it as misleading, and it has reviewed more than 2,000 retail websites looking for exactly this kind of language.
GDPR privacy policy
If you sell to customers in the EU, track EU visitors, or have any presence there, the GDPR can reach your Australian business. A GDPR privacy policy sets out the extra rights EU users have and the details the GDPR demands, like your retention periods and how data moves between countries. The penalties for ignoring it are large, so this is one to get right before your first EU sale, not after.
Website development agreement and cyber security policy
Building the site with a developer? A website development agreement pins down specs, price, timeline, and who owns the finished code. That last point matters more than founders expect, and we come back to it below.
A cyber security policy is the one most people skip. It sets the rules for how your team handles customer and payment data. If you ever have a breach, it’s the difference between a planned response and a panicked one.
What laws do online businesses have to follow in 2026?
Your documents exist to keep you on the right side of a handful of laws. Knowing the legal requirements for your online business makes it obvious why each document is there.
Australian Consumer Law
The Competition and Consumer Act 2010 (Cth) gives every customer consumer guarantees you cannot contract out of. Goods must be of acceptable quality and match their description. Services must be delivered with due care and skill. Since 9 November 2023, using unfair terms in a standard-form small-business contract can itself breach the law and attract a penalty, so sloppy terms are now a risk in their own right.
Privacy and data protection
The Privacy Act 1988 (Cth) and the Australian Privacy Principles govern how you handle personal information. Businesses over $3 million in turnover are covered, and plenty of smaller ones are too, through activities like direct marketing or trading in personal data. Here’s the part that dates old policies: from 10 December 2026, affected businesses must disclose any automated decision-making in their privacy policy. A policy written in 2022 is already behind.
Spam and email marketing
Run email or SMS campaigns and the Spam Act applies. You need consent to send, your business identified in the message, and a working unsubscribe. It’s a short list, and it’s the one most new stores quietly breach on their first newsletter.
Intellectual property
Brand name, logo, and site content are all assets. Registering a trade mark protects the brand; your terms protect the content from being copied. If a developer built your site, your development agreement is what proves you own it rather than them.
Get a free legal document when you sign up to Lawpath
When should you put each document in place?
You don’t need everything on day one. You need the right document before the moment it has to work. Sequencing your legal documents for an online business this way is far less daunting than facing the whole list at once.
- Before your site goes live: privacy policy and website terms and conditions. The moment a visitor can hand over an email or place an order, both need to be up.
- Before your first sale: returns, refunds, and shipping terms. Settle these before money changes hands, not after your first “where’s my parcel” message.
- Before your first EU customer: a GDPR privacy policy. Don’t wait for the order to arrive and then scramble.
- When you commission or rebuild the site: a website development agreement, signed before work starts.
- As you grow and store more data: a cyber security policy, and a review of everything above at least once a year.
What we see in Lawpath consultations
This is where generic checklists stop and real patterns start. These are the ones our lawyers see land again and again with online sellers.
A shipping clause can’t hand your liability to the courier. A common pattern: a business selling bulky physical goods adds a clause saying risk passes to the customer the moment a courier takes the parcel. The thinking is that transit damage becomes the courier’s problem. It doesn’t. Under consumer guarantees, you remain responsible for goods arriving in acceptable quality, and you can’t contract that away. Optional transit insurance can soften the commercial hit, but it doesn’t remove the legal duty.
Who pays return shipping on a warranty claim catches people out. For a genuine major failure, the cost of getting the item back to you generally sits with you, not the customer. For bulky items that can run into real money. Where sellers get protection is documentation: clear product descriptions, and records that separate a real fault from misuse.
Orders placed off-platform create the messiest disputes. Stores that let customers order by email or phone, especially on credit accounts, see more arguments over what was actually agreed. A secure checkout gives you a record. When orders come in by email, your terms have to do the work the checkout usually does.
Copy-pasted documents are worse than none. A borrowed privacy policy describes someone else’s data handling and promises things you don’t do. In a dispute, that gap is evidence against you. Tailored beats borrowed every time.
The mistakes that cost online businesses the most
- A “no refunds” sign. It can’t override consumer guarantees, and the ACCC reads it as misleading. Say what customers are entitled to, then add any change-of-mind policy on top.
- Treating terms as the privacy policy. They’re two documents doing two jobs. One governs use of your site, the other governs data.
- Letting the developer keep the code. Without an agreement assigning ownership to you, you may not own the site you paid for.
- Set and forget. Laws shift, like the December 2026 privacy change. A document you never revisit slowly stops matching what you actually do.
How to get your legal documents sorted
You’ve got three realistic paths, depending on your budget and how custom your business is.
Start from a template. For most online stores, editable legal document templates cover the core set in an afternoon. You get all your legal documents for your online business in one place, built for Australian law, ready to customise.
Run a Legal Health Check. Not sure what you’re missing? A Legal Health Check reviews your current setup and shows the gaps in minutes, so you fix the right things instead of guessing.
Ask a lawyer. If you sell something unusual, ship internationally, or handle sensitive data, a quick review from a lawyer is worth it. On Lawpath you can get that advice without the traditional wait or hourly-rate shock.
Frequently asked questions
Which legal documents are actually required for an online business?
A privacy policy is required if you collect personal information and meet the Privacy Act thresholds. Website terms and conditions are required once you transact online. The rest, like shipping and returns policies, are strong best practice that protect you in a dispute.
Do I need a privacy policy if my business is small?
Often yes. Businesses over $3 million in turnover are covered by the Privacy Act, but smaller ones can be caught too, through things like direct marketing or trading in personal data. Even when you’re not legally required to have one, a privacy policy builds the trust an online store runs on.
Can I just put a “no refunds” policy on my site?
No. Consumer guarantees under Australian Consumer Law apply no matter what your policy says, and a blanket “no refunds” line is treated as misleading. You can set a change-of-mind policy, but it sits on top of a customer’s statutory rights, never instead of them.
If a courier damages my customer’s order, am I liable?
Usually yes. Under consumer guarantees you’re responsible for goods arriving in acceptable quality, and a clause passing risk to the courier doesn’t remove that duty. Optional transit insurance can cover the commercial cost, but it doesn’t change your legal position.
Does an Australian business need to worry about the GDPR?
Only if you sell to EU customers, track EU visitors, or have a presence there. If any of those apply, a GDPR privacy policy is required and the penalties for skipping it are steep. If you sell only within Australia, the local Privacy Act is your focus.
Can I copy another website’s terms and conditions?
It’s a false economy. Borrowed terms describe another business’s products, risks, and data handling, not yours, and that gap works against you in a dispute. A tailored set built for your store costs little and actually protects you.
How much do online business legal documents cost?
It ranges widely. Editable templates built for Australian law cover the core set affordably, while bespoke drafting from a lawyer costs more and suits unusual or high-risk businesses. Most online stores start with templates and get a lawyer to review anything out of the ordinary.
How often should I update my legal documents?
Review them once a year, and any time the law changes or your business does. The privacy rules shifting on 10 December 2026 are a good example: a policy you set and forgot in 2022 no longer matches what’s required.
Key takeaways
If this felt like one more thing on a pile that’s already too high, that’s normal. Nearly every online founder reaches this point, and almost all of them sort it faster than they feared. You’re not behind. You’re doing the part most people put off.
Start with the two that matter most, a privacy policy and your website terms, then work down the list as your store grows. Get your legal documents for your online business in one place today with Lawpath’s editable templates.
