Australian Privacy Policy Template

How the Australian Privacy Act applies to smaller businesses

The Privacy Act 1988 and the 13 Australian Privacy Principles apply to APP entities — broadly, agencies and organisations with turnover above the small-business threshold, plus specific categories regardless of size, such as health service providers and businesses that trade in personal information. Many small operators fall outside the Act but choose to comply voluntarily, and platforms and enterprise customers increasingly expect it.

APP 1 requires a clearly expressed and up-to-date policy that is available free of charge, which is why the document is usually the first thing a reviewer looks for.

• What you collect and why (APP 3 and APP 5 notice)
• Overseas disclosure — name the countries where your providers process data (APP 8)
• Access and correction process (APP 12 and 13)
• Complaint handling, including escalation to the OAIC
• Direct marketing and opt-out (APP 7)

Notifiable data breaches and complaints

Entities covered by the Act must assess suspected eligible data breaches and notify affected individuals and the OAIC where serious harm is likely. Your policy is the right place to publish the contact point that handles privacy complaints, and to explain that unresolved complaints can be taken to the OAIC. Australian privacy law has been under active reform, so review the wording periodically rather than treating it as final.