Is a privacy policy required by law in Australia?

Yes. If your business has an annual turnover above $3 million, or handles health information, or operates in certain regulated sectors, you must comply with the Australian Privacy Act 1988 and have a compliant privacy policy.

What must an Australian privacy policy include?

Under the Australian Privacy Principles (APPs), your policy must explain what personal information you collect, how you collect it, why you collect it, whether you disclose it to third parties, and how individuals can access or correct their data.

Does the Australian Privacy Act apply to small businesses?

Small businesses with an annual turnover of $3 million or less are generally exempt, but exceptions apply if you trade in personal information, provide health services, or opt in to the APPs voluntarily.

Free Privacy Policy Generator Australia

A Privacy Policy is legally required under the Australian Privacy Act 1988 if your website or app collects any personal data — even just an email address for a newsletter.

Have this ready before you start:

Your business name and website URL
What data you collect — names, emails, payment info, IP addresses, cookies, device info
Why you collect it — processing orders, sending newsletters, running analytics, serving ads
Third-party services you use — Stripe, Google Analytics, Mailchimp, Facebook Pixel, Hotjar, etc.
A contact email for privacy requests and data deletion
Your primary jurisdiction — your Australian state or territory

Do you actually need one? Yes, if you collect any of the following: contact form submissions, newsletter signups, user accounts, payment details, or analytics data via Google Analytics, Facebook Pixel, or similar tools.

Tip: Even if you're using a website builder like Squarespace or Shopify, you still need your own Privacy Policy — their built-in templates only cover their platform's data practices, not yours.

What This Privacy Policy Generator Creates

This tool generates an Australian Privacy Policy compliant with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). Under Australian law, any business or organisation with an annual turnover exceeding $3 million — or that handles health information, trades in personal data, or is a government agency — must have a publicly available Privacy Policy.

Your generated Privacy Policy will cover: what personal information you collect, why you collect it, how it is stored and protected, when and to whom it may be disclosed (including overseas transfers), how individuals can access or correct their information, how to make a complaint, and your use of cookies and third-party analytics (including Google Analytics).

Who needs one? Any Australian website, app, or business that collects names, email addresses, phone numbers, payment details, or any other personal information needs a Privacy Policy. Even businesses below the $3 million threshold benefit from having one to build customer trust and satisfy contractual requirements from payment processors and app stores.

The Office of the Australian Information Commissioner (OAIC) provides enforcement of the Privacy Act and can investigate complaints. A compliant Privacy Policy is your first line of protection. This generator runs entirely in your browser — your business information is never stored or transmitted.