Quick answer: Most Australian business websites should have a clear privacy policy that explains how form, tracking and marketing data is used; consent and an unsubscribe option for marketing emails under the Spam Act; prices shown in line with Australian Consumer Law; genuine, unedited reviews; and reasonable accessibility under the Disability Discrimination Act. From 10 December 2026, businesses covered by the Privacy Act must also disclose in their privacy policy if they use automated decision-making that could significantly affect people.
Websites collect more personal information than most owners realise: enquiry forms, booking systems, newsletter signups, analytics and advertising pixels. Here is a practical checklist of what to have in place. It is general information, not legal advice.
1. Privacy policy
The Privacy Act 1988 and its Australian Privacy Principles apply to businesses with an annual turnover above $3 million, and to some smaller businesses regardless of size, including health service providers and businesses that trade in personal information. Even if you are exempt, a clear privacy policy is expected by customers, required by Google and Meta for advertising, and simply good practice.
Your policy should explain, in plain English:
- What you collect through your forms, bookings and emails.
- What tracking you use, such as Google Analytics, Google Ads and Meta Pixel.
- Why you collect it and how you use it.
- Who you share it with, such as your CRM, email platform or booking system.
- How people can access or correct their information, and how to complain.
2. New from 10 December 2026: automated decision-making
The Privacy and Other Legislation Amendment Act 2024 added new transparency rules to Australian Privacy Principle 1 that start on 10 December 2026. If your business is covered by the Privacy Act and uses a computer program to make, or substantially help make, decisions using personal information that could significantly affect someone, your privacy policy must say so. That includes the kinds of personal information used and the kinds of decisions involved.
For most small service businesses with a contact form, this will not change much. But if you use software to automatically approve, reject, prioritise or price customers, for example automated credit checks, tenant or applicant screening, or AI tools that decide who gets an offer, review your privacy policy now. The OAIC has been running compliance sweeps of privacy policies in 2026, and it now has powers to issue infringement and compliance notices.
3. Marketing emails and SMS
The Spam Act 2003 applies to every business sending commercial emails or texts. You need consent (ideally a clear opt-in checkbox on your forms), you must identify your business in every message, and every message needs a working unsubscribe. Do not add enquiry form submissions to your newsletter list unless they agreed.
4. Prices and claims
Under Australian Consumer Law, advertised prices to consumers should be the total price including GST and any compulsory fees. Claims like “Sydney’s cheapest” or “guaranteed results” must be true and able to be backed up.
5. Reviews and testimonials
Only publish genuine reviews, never edit them to remove criticism, and disclose any incentives. See trust signals and the ACCC rules.
6. Accessibility
The Disability Discrimination Act applies to websites. Aim for WCAG 2.2 AA. See website accessibility for Australian businesses.
7. Security
Use HTTPS on every page, keep WordPress and plugins updated, use strong passwords and two-factor login, and do not collect more personal information than you need. If you handle sensitive information, a data breach can trigger notification obligations under the Notifiable Data Breaches scheme.
8. Business details
Show your business name and ABN, plus clear contact details. It builds trust and is required on many documents anyway.
Quick checklist
- Privacy policy linked in the footer and next to every form.
- Policy mentions analytics and advertising tracking.
- Automated decision-making reviewed before 10 December 2026, if you are covered.
- Marketing consent checkbox, unsubscribe in every email.
- Prices shown including GST for consumers.
- Only genuine, unedited reviews.
- HTTPS, updates and backups in place.
- Basic accessibility checks done.
Planning a new website?
Next step: fill in the website brief. It takes about 10 minutes, and you get a fixed quote within one business day, then 2 or 3 design concepts to compare before anything is built. See website packages and care plans.
Written by Gregory
20 years building websites and running lead generation, mostly with my own money on the line. Based in Sydney, working with clients worldwide. How I work →