Getting a website ready for the Australian Privacy Principles
How the Australian Privacy Principles apply to a business website: who they cover, what your privacy policy and collection notices should say, forms, analytics, overseas providers, security and data breaches.
Most business websites collect personal information: enquiry forms, newsletter sign-ups, online orders, chat, analytics and advertising tags. In Australia, the Privacy Act 1988 and its Australian Privacy Principles (APPs) set the rules for how many organisations handle that information. This guide explains what the APPs mean for a website, based on guidance from the Office of the Australian Information Commissioner (OAIC). It is general information, not legal advice; for advice about your organisation, see the OAIC's resources or a privacy lawyer.
Do the Australian Privacy Principles apply to your business?
The APPs apply to "APP entities": Australian Government agencies and organisations covered by the Privacy Act. Many small businesses are exempt, because the Act sets an annual turnover threshold. Some small businesses are covered whatever their turnover, for example private sector health service providers, businesses that sell or buy personal information, and contracted service providers to the Australian Government. The OAIC website lists the current threshold and the full list of exceptions, and has a tool to help you check.
Even if your business is exempt, the APPs are a useful benchmark. Customers increasingly expect clear privacy practices, and your business could become covered as it grows.
What are the thirteen principles?
The APPs are set out in Schedule 1 of the Privacy Act. They cover the whole life of personal information. The ones that matter most for a website are:
- APP 1: open and transparent management of personal information, including a clearly expressed and up-to-date privacy policy.
- APP 3: collect only the personal information that is reasonably necessary for your functions or activities, with extra conditions for sensitive information.
- APP 5: tell people about certain matters when you collect their personal information.
- APP 6: use or disclose personal information only for the purpose it was collected for, unless an exception applies.
- APP 7: rules for using personal information for direct marketing, including an easy way to opt out.
- APP 8: steps to take before disclosing personal information to someone overseas.
- APP 11: take reasonable steps to keep personal information secure, and destroy or de-identify it when it is no longer needed.
- APP 12 and APP 13: give people access to their personal information and correct it when asked.
What should your privacy policy say?
Under APP 1, your privacy policy must be available free of charge and in an appropriate form, which for most businesses means a page linked from every page of the website. The OAIC's guidelines say it must include, among other things:
- the kinds of personal information you collect and hold;
- how you collect and hold it;
- the purposes for which you collect, hold, use and disclose it;
- how people can access their information and ask for it to be corrected;
- how people can complain about a breach of the APPs, and how you will deal with the complaint;
- whether you are likely to disclose information to overseas recipients and, if practicable, the countries they are in.
The Privacy and Other Legislation Amendment Act 2024 added new requirements about automated decisions: from 10 December 2026, privacy policies must explain certain uses of computer programs that make, or substantially help make, decisions using personal information. If your website or business uses automated decision-making, check the OAIC's guidance on these changes.
What should your forms and collection notices do?
APP 5 requires you to take reasonable steps to tell people certain things at or before the time you collect their information, or as soon as practicable afterwards. On a website, this is usually a short collection notice next to the form, with a link to the full privacy policy. It should cover who you are and how to contact you, why you are collecting the information, what happens if they do not provide it, who you usually disclose it to and whether it is likely to go overseas.
Good form design helps you meet APP 3 as well:
- ask only for the fields you need; make optional fields clearly optional;
- do not collect sensitive information, such as health details, unless you need it and have consent;
- keep marketing consent separate from the enquiry itself;
- send form submissions to a secure inbox or system, not to a shared personal email account.
Do analytics, cookies and pixels count?
Information is personal information if it is about an identified individual or an individual who is reasonably identifiable. Analytics data, advertising pixels and chat transcripts can fall into that category, particularly when they are combined with other data such as an email address or an account. List every tool on your website that collects data about visitors, what each one collects and who receives it, and describe them in your privacy policy. Remove tags you no longer use. For marketing emails and messages, the Spam Act 2003, regulated by the Australian Communications and Media Authority, also applies.
What if your website provider is overseas?
Many websites rely on providers in other countries: hosting, email, form tools, chat platforms and development teams. APP 8 says that before disclosing personal information to an overseas recipient, an APP entity must generally take reasonable steps to ensure the recipient does not breach the APPs, and in most cases the Australian entity remains accountable for what the recipient does. The OAIC's APP guidelines explain when providing information to an overseas provider counts as a disclosure and what reasonable steps can look like, such as contract terms. Ask every provider where data is stored and who can access it, and record the answers.
How should you keep website data secure?
APP 11 requires reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. For a website, reasonable steps usually include:
- HTTPS on every page and form;
- individual logins with strong passwords and two-factor authentication for the admin area;
- prompt updates to the platform, themes and plugins;
- limiting who can see form submissions, orders and chat logs;
- regular backups, stored securely;
- deleting or de-identifying data you no longer need, on a schedule.
Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act must notify affected individuals and the OAIC when a data breach is likely to result in serious harm. Decide now who would assess a breach and how you would contact people.
If you are building or rebuilding a website, these points are easiest to handle in the design: our website development and ecommerce development pages show how we work, and you can contact us to plan the privacy features of your site.
Sources
Questions we hear often.
Does every Australian business have to follow the APPs?
No. Many small businesses are exempt because of the Privacy Act's annual turnover threshold, but some are covered whatever their size, such as private sector health service providers. The OAIC website explains who is covered.
Where should a privacy policy appear on a website?
APP 1 requires the policy to be available free of charge and in an appropriate form. On a website that usually means a clearly labelled link in the footer of every page, plus links next to forms that collect personal information.
Is website analytics data personal information?
It can be. Information is personal information if it is about an identified or reasonably identifiable individual. Analytics and advertising data can meet that test, especially when combined with other details such as an email address.
Can I use a web developer or host outside Australia?
Yes, but APP 8 applies when personal information is disclosed overseas. You generally need to take reasonable steps, such as contract terms, to ensure the overseas recipient handles it in line with the APPs.
More guides.
How to choose a Shopify developer
What to check before you hire someone to build or change your Shopify store: the skills that matter, the questions to ask, how access should work and the warning signs to look out for.
Read the guide →Guide · GlobalAI chatbot checklist for small businesses
A checklist for planning an AI chatbot for your website or messaging channels: the goal, the content it answers from, hand-off to people, privacy, testing and the numbers to watch after launch.
Read the guide →Guide · GlobalWhat affects mobile app development timelines
Why some apps take much longer to build than others: scope, platforms, design, the backend, integrations, testing, app store review and the decisions you make along the way.
Read the guide →