In the digital age, transparency is the currency of trust. For Australian small businesses, a Privacy Policy isn't just a 'nice to have'—it is a critical document that tells your visitors how you collect, use, and protect their personal data, ensuring you stay on the right side of the law.
Whether you are capturing email addresses for a newsletter, using Google Analytics to track traffic, or processing sales through an e-commerce store, you are handling personal information. This guide will walk you through creating a professional, compliant Privacy Policy tailored for the Australian market.
Prerequisites: What You’ll Need
Before you begin, gather the following information:- Business Details: Your legal business name, ABN (Australian Business Number), and physical address.
- Data Collection Points: A list of where you collect data (e.g., contact forms, cookies, checkout pages).
- Third-Party Tools: A list of services you use (e.g., Mailchimp, Google Analytics, Facebook Pixel, Stripe).
- Contact Person: The email address or phone number where users can reach you regarding data queries.
---
Step 1: Understand the Australian Privacy Principles (APPs)
Before writing a single word, you need to understand the framework. In Australia, the Privacy Act 1988 and the Australian Privacy Principles (APPs) govern how businesses handle personal information. Even if your turnover is under $3 million (the usual threshold for the Act), many small businesses are still legally required to comply if they provide health services, trade in personal information, or are a service provider to the Commonwealth. Regardless of legal obligation, having one is a best practice for SEO and consumer trust.Step 2: Audit Your Data Collection
Sit down and map out exactly what data you collect. This usually includes:- Identity Data: Names, usernames.
- Contact Data: Email addresses, phone numbers, shipping addresses.
- Technical Data: IP addresses, browser types (collected via cookies).
- Usage Data: How people use your website.
- Marketing Data: Preferences in receiving marketing from you.
Step 3: Identify Your Data Purpose
You must be able to explain why you are collecting this data. Common reasons for Brisbane small businesses include:- To process and deliver orders.
- To manage our relationship with you (e.g., responding to enquiries via a contact form).
- To improve our website through analytics.
- To send you newsletters (with your consent).
Step 4: Choose a Creation Method
You have three main options:- Legal Professional: Best for high-risk industries (health, finance).
- Generator Tools: Services like Termly or Rocket Lawyer (ensure they have Australian-specific templates).
- The OAIC Template: The Office of the Australian Information Commissioner (OAIC) provides excellent resources for small businesses.
Pro Tip: Avoid copying and pasting a policy from another website. Their data practices likely differ from yours, and you could be infringing on copyright or, worse, misrepresenting your own legal obligations.
Step 5: Draft the 'Information Collection' Section
Clearly state what you collect. Use simple language.- Screenshot Description: If using a generator, you will see a series of checkboxes. Tick only the data types you actually collect. Do not tick 'Health Information' unless you are a medical or fitness provider, as this requires much stricter handling.
Step 6: Disclose Third-Party Sharing
Australian law requires you to disclose if you share data with third parties, especially those overseas. If you use an American-based email marketing tool like Mailchimp or a global hosting provider, you must state that data may be transferred outside of Australia.Step 7: Detail Your Cookie Policy
Cookies are small files stored on a user's computer. Your Privacy Policy (or a separate Cookie Policy) must explain:- What cookies you use.
- Why you use them (e.g., keeping items in a shopping cart).
- How users can opt-out.
Step 8: Explain Data Security and Retention
Describe how you protect the data. Mention that you use SSL encryption (the padlock in the browser bar) and secure servers. Also, state how long you keep the data. For example: "We only retain personal data for as long as necessary to fulfil the purposes we collected it for."Step 9: Define User Rights
Under the APPs, Australians have the right to access their personal information and ask for it to be corrected. Include a section explaining how they can do this. Usually, this involves them emailing you directly.Step 10: Create a Dedicated Privacy Page
Now that your text is ready, log into your website CMS (like WordPress or Shopify).- Create a new Page (not a Post).
- Title it "Privacy Policy".
- Paste your content and format it with clear headings for readability.
- Screenshot Description: In the WordPress dashboard, you should see the 'Permalink' settings on the right sidebar. Ensure the URL is
yourdomain.com.au/privacy-policy.
Step 11: Link the Policy in Your Footer
Your Privacy Policy must be accessible from every page of your site. The standard location is the footer.- Go to Appearance > Menus (in WordPress) or Online Store > Navigation (in Shopify).
- Add your new Privacy Policy page to your Footer Menu.
- Save the menu.
Step 12: Update Your Contact Forms
To be fully compliant, add a small disclaimer near your 'Submit' buttons on contact forms.- Example Text: "By submitting this form, you agree to our [Privacy Policy]."
- Linking this text directly to your policy page is a great way to show transparency.
---
Common Mistakes to Avoid
- Using Legalese: You don't need to sound like a 19th-century barrister. The OAIC encourages 'simple, clear, and focused' language.
- Forgetting the Date: Always include an "Effective Date" or "Last Updated" date at the top of the policy.
- Ignoring Updates: If you install a new tracking pixel (like TikTok or Pinterest), you must update your policy to reflect this.
- Hidden Links: Don't make the font size in the footer so small that it's unreadable. This can be seen as 'deceptive' by regulators.
Troubleshooting
- "I don't know what cookies my site uses": Use a free tool like 'CookieServe' or 'BuiltWith' to scan your URL. It will list the cookies active on your site.
- "My generator asks for a DPO": A Data Protection Officer (DPO) is a specific requirement under European GDPR law. For most Australian small businesses, your 'Privacy Officer' is simply the business owner or manager.
- "The policy looks like a wall of text": Use bullet points and bold headers. A readable policy is a compliant policy.
Next Steps
Now that your Privacy Policy is live, your next steps should be:- Create a Terms & Conditions Page: This protects your business logic and intellectual property.
- Set up a Cookie Consent Banner: Especially important if you have international visitors or use heavy tracking.
- Review annually: Set a calendar reminder to check if your data practices have changed.
Need help ensuring your website is fully compliant and professional? Contact the team at Local Marketing Group for a website audit today.