Do I need a privacy policy on my business website?
Written by Jack Harrington and Gabriel Pozo, the founders of Urban Media, Melbourne. Updated .
If your website has an enquiry form, a newsletter box or analytics, you are collecting personal information. Whether the Privacy Act applies to you depends mostly on your turnover.
General information, not legal advice, checked against the OAIC on 11 October 2026. If you are unsure, ask a lawyer.
The small business rule
The OAIC says a small business is one with an annual turnover of $3 million or less, and that small businesses are generally exempt from the Privacy Act. Turnover counts all income from all sources.
When a small business is still covered
- Health service providers that hold health information.
- Businesses that sell or buy personal information.
- Businesses related to a business that is covered by the Act.
- Businesses that have opted in to the Privacy Act.
- Some reporting entities under the AML/CTF Act, for those activities.
Why most sites publish one anyway
Even when you are exempt, the OAIC recommends protecting the personal information you hold and says opting in can build customer trust. Ad platforms, analytics tools and forms also commonly expect a privacy policy page, so most business sites publish one.
What it should say, plainly
- What you collect: name, email, phone, what they typed in the form.
- Why you collect it and who sees it.
- Which tools see it: analytics, ad pixels, your email provider.
- How long you keep it and how someone asks to see or delete it.
- How to contact you.
Where Urban Launch fits
Urban Launch builds the website with a privacy page that matches the tools actually installed. Have a lawyer check it if you hold sensitive information.
Official sources
This guide was checked against these official pages on 11 October 2026. Rules change, so confirm on the source before you rely on a detail.
More guides for new businesses
- Logo or website first for a new business
- What to do after registering an ABN
- New business launch checklist, Melbourne
- How to name a business in Australia
- Business name vs company name in Australia
- Do I need a website for a small business
- What is a brand identity for a small business
- Brand guidelines for a small business
- How to get your first customers as a new business
- Google Business Profile for a new business
- How much a new business should spend on ads
- Website checklist before you launch a small business site
- What photos a new business needs
- Landing page or website for ads
- Social media profiles for a new business
- How to start a business in Melbourne
- How to start a clothing brand in Australia
- How to register a brand name in Australia
- Do I need an ABN to start a business in Australia
- Sole trader or company in Australia
- Do I need to register for GST
- How to choose a .com.au domain name
- How to get a logo for a new business
- Business email for a new business
- What to post on social media when you start a business
- Setting up a business in Victoria
All of them are on the guides page.
Who is behind this
Urban Launch is built and run by Urban Media (ABN 28 169 446 902), a Melbourne studio founded by Jack Harrington and Gabriel Pozo. Urban Media makes video, design and websites for clients including Box Hill United, Brighton Grammar and Porsche Club Victoria.
If you want to talk to the people doing the work, call 0456 785 904. More about who we are, and how to check us, is on the About page.
Common questions
- Does a small business need a privacy policy in Australia?
- Small businesses with an annual turnover of $3 million or less are generally exempt from the Privacy Act, but there are exceptions, and many still publish a policy as good practice.
- What is the small business threshold under the Privacy Act?
- $3 million annual turnover, counting all income from all sources, according to the OAIC.
- Which small businesses are still covered by the Privacy Act?
- Examples include health service providers, businesses that sell or buy personal information, and businesses that have opted in.
- What should a website privacy policy include?
- What you collect, why, who sees it, which tools process it, how long you keep it, and how to contact you or ask for deletion.
Start with a Launch Call
Live and generating enquiries within 45 days, or we keep working at no extra cost until you are. The Launch Call is where we check it is the right fit before we book anything in. For a real example, read the Airwize case study (12 conversions, meaning leads that became sales, in the first month of Google Ads from $70 of ad spend, our figures). You can also read how a launch package compares with hiring separately, or go to the packages and prices on the homepage.
More: Brand and website package, Melbourne, Startup package for a new business, Melbourne, Branding, website and photography package, Melbourne.