Help centre
Guide to creating a Privacy Policy
About 25 minutes to work through. Australian Privacy Principles. Last updated August 2026.
Before we start
Savira gives your business a solid, well structured starting point, not a guarantee of compliance. You know your operations and we don't. You're responsible for making sure your policy reflects what your business actually does, and for getting legal advice where your situation is unusual or high risk.
The template handles the structure and the legal scaffolding. What it can't know is what your business collects, why you collect it, and who you pass it to. That's what the setup wizard asks you, and it's what this guide helps you answer well.
Work through Part one first. Those three decisions shape everything else. Then use Part two as you move through the wizard, because each card matches a field in Policy Templates > Privacy Policy.
Part one
Three decisions to make first
These three cut across every section of the policy. Sort them out now and the rest of the wizard is mostly typing.
1. What your policy needs to cover
Most policies describe the website and stop there. Yours needs to cover every way your business touches someone's personal information, online or not.
Walk through this list and tick off what applies to you.
- Every trading name and entity. If you trade under three names from one ABN, list all three. If you're one of several related companies, say which entities the policy covers.
- Every collection channel. Website forms, cookies and analytics, phone calls, in person sign ins, paper forms, email, social media messages, your app, a booking platform, a third party lead form.
- Recordings and surveillance. CCTV on your premises, recorded phone calls, vehicle tracking, workplace monitoring. All of it is personal information, and all of it gets left out regularly.
- Job applicants, contractors and volunteers. The employee records exemption only covers records about current and former employees where the act relates directly to that employment relationship. It does not stretch to job applicants, contractors or volunteers, so recruitment data belongs in your policy.
- Everything you send to someone else. Your CRM, email platform, payment processor, bookkeeper, cloud storage, advertising pixels. If data leaves your business, it belongs in the policy.
A quick way to test it
Picture the last five people who gave you information. A customer, a supplier's contact, someone who filled in a form, someone who rang up, someone who applied for a job. Can each of them find themselves in your policy? If not, you've got a gap.
2. Which laws apply to you
This is the one that trips people up, so here's the short version. State and territory privacy laws don't replace the federal Privacy Act. They sit alongside it. The Privacy Act is written so that state and territory laws can keep operating at the same time, which means you can easily be covered by both at once.
The federal layer
The Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles apply to you if your annual turnover is more than $3 million. They also apply regardless of your size if you fall into one of the exceptions to the small business exemption. The ones that catch most businesses are: you provide a health service and hold health information, you disclose personal information about someone for a benefit or service, you pay to collect personal information about someone from a third party, you're a credit provider or a credit reporting body, you provide services under a Commonwealth contract, or you're related to a body corporate that isn't a small business. You can also opt in voluntarily.
From 1 July 2026, businesses that become reporting entities under the AML/CTF reforms, which includes many real estate agencies, accounting practices and law firms, are treated as organisations under the Privacy Act in relation to their designated services. If that's you, the APPs apply no matter what your turnover is.
Two other federal laws govern your marketing rather than your policy. The Spam Act 2003 covers commercial email and SMS, and the Do Not Call Register Act 2006 covers telemarketing.
The state and territory layer
Most of these apply to government agencies and their contractors, but there are important exceptions for private businesses.
| If you | Then also consider |
|---|---|
| Provide a health service in NSW, Victoria or the ACT | State health records legislation applies to private sector health providers on top of the APPs. That's the Health Records and Information Privacy Act in NSW, the Health Records Act in Victoria, and the Health Records (Privacy and Access) Act in the ACT. Health service is defined broadly and can reach allied health, personal trainers and complementary therapists, so check rather than assume. |
| Hold a contract with a state or territory government agency | Your contract may bind you to that jurisdiction's privacy regime. The relevant statutes are the PPIP Act in NSW, the Privacy and Data Protection Act in Victoria, the Information Privacy Act in Queensland (which now applies the Queensland Privacy Principles), the Personal Information Protection Act in Tasmania, the Information Act in the Northern Territory, and the Privacy and Responsible Information Sharing Act being phased in across Western Australia. South Australia has no privacy statute and binds its agencies through an administrative instruction instead. Read the contract, not just the statute. |
| Run CCTV, record calls or monitor staff devices | State surveillance devices and workplace surveillance laws. These carry their own notice and consent requirements, separate from the APPs and often stricter. |
| Have customers in New Zealand | The NZ Privacy Act 2020, which has its own breach notification rules and its own regulator. |
The practical rule
Where two sets of rules cover the same thing, write your policy to the stricter one and comply once. Then name the regimes you follow in your "who we are" section, so anyone reading knows which rules you're holding yourself to.
3. Who handles privacy enquiries
Your policy has to tell people how to reach you about their information, whether that's to ask for access, to correct something, or to complain. The last two are mandatory inclusions under APP 1.4, not nice to haves.
Decide this now and use the same details consistently throughout the policy.
- Use a role, not a person. Privacy Officer and
privacy@yourbusiness.com.ausurvive staff turnover. A named person's inbox doesn't. - Give more than one channel. An email address and a postal address at minimum, plus a phone number if you have one. Not everyone can or will use email.
- Make sure someone reads it. An unwatched privacy inbox turns a small complaint into a regulator complaint.
- State your timeframes. You generally have 30 days to respond to access and correction requests. Saying so sets expectations and shows you know the rules.
- Include the escalation path. Your policy has to explain how someone complains to you. Naming the OAIC as the next step is good practice and heads off surprises.
On charging for access
You can't charge someone for making an access request. If you charge for actually giving them the information, the fee can't be excessive. Most small businesses find it isn't worth charging at all. Corrections must always be free.
Part two
Section by section walkthrough
Each card below matches a field in the Savira wizard. Open the wizard in another tab and work down the list.
- APP 1.3
Who we are and what this covers
In the wizard:
Business detailsIn short
Name every legal entity and trading name the policy covers, plus your ABN. If you trade under more than one name, list them all, or customers can't tell whether the policy applies to them.
What this section must cover
- Your legal entity name and ABN
- Every trading name the policy covers
- Any related entities that share your systems or your data
- The privacy rules you comply with: the Privacy Act and the APPs, plus any state or health legislation you identified in decision 2
How to write it
Write it as though the reader has only ever seen your trading name. They need to connect the business they dealt with to the entity named in the policy. If a related company can get into the same customer database, name it here rather than pretending there's a wall.
Worked example
Riverbend Holdings Pty Ltd (ABN 00 000 000 000), trading as Riverbend Property and Riverbend Rentals. As a NSW real estate agency we comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
- APP 1.4(a)
What personal information we collect
In the wizard:
Information collectedIn short
List the kinds of information you actually hold, such as names, phone numbers, identity documents, payment details and IP addresses. Group them into categories. "Personal details" is too vague to satisfy APP 1.4(a).
What this section must cover
- The kinds of personal information you collect and hold
- Any sensitive information, which includes health information, biometrics, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record and union membership
- Information you collect automatically, such as IP addresses, device data and location
- Information about people who never became customers, including enquiries, applicants and unsuccessful leads
How to write it
Go through your systems and write down what's actually sitting in the fields. Then group it into categories a person would recognise, like contact details, identity documents and financial information. If you don't know what you hold, that's a finding in itself. Collecting more than you need is exactly what the OAIC looks for.
Worked example
We collect contact details such as your name, email, phone and postal address. We collect identity information such as your driver licence number. We collect financial information such as bank account details, payslips and rental ledgers. We also collect technical information such as your IP address, browser type and the pages you visit.
Watch outSensitive information has a higher bar. You generally need the person's consent to collect it, and it has to be reasonably necessary for what your business does. If you're collecting it, say so plainly and be ready to explain why you need it.
- APP 1.4(b), APP 3, APP 5
How we collect it
In the wizard:
Collection methodsIn short
Describe every channel: website forms, phone, in person, paper, CCTV, third parties. If you collect information about someone from anyone other than them, you have to say so here.
What this section must cover
- Direct collection through forms, phone, email, in person and on paper
- Automatic collection through cookies, analytics and server logs
- Indirect collection, meaning anything you learn about a person from someone else
- Recordings, including CCTV, call recording and workplace monitoring
How to write it
Indirect collection is the point most policies miss, and it's the one that surprises people most. If you buy lists, take referrals, run tenancy or credit checks, or ring a referee, that belongs here. Where it's reasonable and practicable to do so, you should also be collecting from the person directly in the first place.
Worked example
We collect information directly from you when you enquire, apply or sign up. We also collect it from third parties including tenancy databases, referees you nominate, your previous agent and credit reporting bodies. Our premises are under CCTV surveillance and calls to our office are recorded for training purposes.
- APP 1.4(c), APP 6
Why we collect it
In the wizard:
Purposes of collectionIn short
State the specific purposes you collect information for. This sets the boundary on what you can use it for later, so be honest and reasonably broad, but don't write "business purposes".
What this section must cover
- Each purpose you collect, hold, use and disclose personal information for
- Any secondary uses a person might not expect
- Whether giving you the information is optional, and what happens if they don't
How to write it
This section does more work than it looks like. You can generally only use information for the purpose you collected it for, or for a related purpose the person would reasonably expect. Anything you leave out here, you can't do later without going back for consent. So be thorough, but resist writing a catch all, because a purpose so broad it means nothing won't hold up.
Worked example
We use your information to assess your tenancy application, manage your tenancy, meet our obligations to the landlord, comply with residential tenancy and AML/CTF law, respond to your enquiries, and, where you've opted in, send you property alerts.
Watch outIf you want to use customer information for marketing, that purpose has to be stated here as well as handled in the marketing section. Quietly adding a customer list to your mailing list is a common breach, and an enforceable one.
- APP 1.4(c), APP 6
Who we share it with
In the wizard:
DisclosureIn short
Name the categories of organisation you disclose to, not just "third parties". Include service providers, professional advisers and disclosures required by law. This is the section most often found wanting.
What this section must cover
- The types of organisation you disclose personal information to
- Why each type receives it
- Disclosures you're required or authorised to make by law
- Anything you disclose to a related entity
How to write it
The standard here is a meaningful description, not a token gesture. Writing that you "may share your information with third parties" tells the reader nothing and won't satisfy APP 1.4. Name the categories, and say what each one does with the information. Naming the actual providers is better again, but categories are the minimum.
Worked example
Categories worth checking against your own operations: cloud hosting and file storage, your CRM, your email marketing platform, payment processors, your accountant or bookkeeper, delivery and courier services, tradespeople and contractors attending a property, insurers and brokers, debt collectors, tenancy databases and credit reporting bodies, advertising and analytics platforms, professional advisers such as lawyers, and any disclosure you're required or authorised to make by law, such as a court order, a subpoena, a police request, or a regulator like the ATO or AUSTRAC.
Watch outAdvertising pixels and analytics tags count. If you run a Meta pixel, a Google Ads tag or anything similar, the information going to those platforms needs to be covered here as well as in your cookie section.
- APP 1.4(f) and (g), APP 8
Sending information overseas
In the wizard:
Overseas disclosureIn short
You have to state whether you're likely to disclose information overseas and, where practicable, which countries. Most cloud tools store data offshore, so check before you tick "no".
What this section must cover
- Whether you're likely to disclose personal information to overseas recipients
- Which countries those recipients are likely to be in, where it's practicable to say
- The steps you take to protect the information once it's offshore
How to write it
Almost every small business answers no to this, and almost every one of them is wrong. Check the data residency of each tool you use: your email platform, CRM, helpdesk, cloud storage, backups and analytics. A lot of them default to the United States or Ireland. The provider's trust or security page usually tells you.
Worked example
We disclose personal information to service providers located in the United States, being our email platform and CRM, and in Singapore, being our cloud hosting. Before we engage an overseas provider we take reasonable steps to make sure they handle personal information consistently with the Australian Privacy Principles.
Watch outUnder APP 8 you generally stay accountable for what an overseas recipient does with the information. Disclosing it doesn't hand off the responsibility, so taking reasonable steps means actually reading the provider's contractual terms rather than assuming.
- APP 7, Spam Act 2003
Marketing and consent
In the wizard:
Direct marketingIn short
Explain what marketing you send, how people opted in and how they opt out. Every commercial email and SMS also needs consent, accurate sender details and a working unsubscribe under the Spam Act.
What this section must cover
- What marketing you send and through which channels
- How someone opts out, and that it's free and easy to do
- That you'll action an opt out promptly
- Where you got a list, if you use information from a third party for marketing
How to write it
Two sets of rules apply at once. APP 7 governs using personal information for direct marketing. The Spam Act separately governs commercial email and SMS, and it requires consent, accurate sender details, and an unsubscribe facility you action within five business days. Your policy should reflect both.
Worked example
Where you've consented, we send property alerts and market updates by email. You can unsubscribe at any time using the link in any message, or by emailing privacy@example.com.au. We'll action your request within five business days and it won't affect the services we provide you.
Watch outNever use a consent request email to ask people who haven't opted in for permission. A message asking for consent to market is itself a commercial message under the Spam Act, so sending it to a cold list is the breach, not the fix. Savira's consent email is for reconfirming consent from people you already have a reasonable basis to believe opted in.
- APP 11
How we keep it safe and how long we keep it
In the wizard:
Security and retentionIn short
Describe the security measures you actually have, and how long you keep information. You have to destroy or de-identify personal information once you no longer need it.
What this section must cover
- The reasonable steps you take to protect personal information
- How long you keep each kind of information, and why
- What you do with it once you no longer need it
- That you have a data breach response plan
How to write it
Describe controls you genuinely have, such as access restrictions, encryption in transit, multi factor authentication, staff training and locked filing cabinets. Overstating your security is a risk in itself. On retention, tie each period to a reason: a legal retention obligation, a limitation period, or an operational need. Writing "as long as necessary" with nothing after it isn't good enough.
Worked example
We keep tenancy records for seven years after the tenancy ends to meet our obligations under residential tenancy legislation. Unsuccessful applications are destroyed after six months. Marketing contact details are kept until you unsubscribe.
Watch outUnder the Notifiable Data Breaches scheme, if you suspect an eligible data breach you must take all reasonable steps to complete an assessment within 30 days. If you then have reasonable grounds to believe there's been an eligible breach, you notify the OAIC and affected individuals as soon as practicable. There's no 72 hour rule in Australia. That's the EU.
- APP 1.4(d), APP 12, APP 13
Access and correction
In the wizard:
Access and correctionIn short
Explain how someone asks for their information, and how they ask you to fix it. This is a mandatory inclusion, so the policy has to set out the process, not just the right.
What this section must cover
- How to make an access request, and who to send it to
- How to request a correction
- How long you'll take to respond
- Any charge for giving access, and the circumstances where you might refuse
- That you'll give written reasons if you refuse, and explain how to complain about that refusal
How to write it
Set out a process someone can actually follow: who to contact, what to include, and what happens next. You generally have 30 days to respond. You can refuse access in limited circumstances, but you have to give written reasons and tell the person how to complain about the refusal.
Worked example
To request access, email privacy@example.com.au with the details you're after and proof of identity. We'll respond within 30 days. If we can't give you access, we'll explain why in writing and tell you how to complain.
Watch outYou can't charge someone for making a request, and any charge for giving access must not be excessive. Corrections are always free.
- APP 1.4(e)
Complaints
In the wizard:
ComplaintsIn short
Your policy has to explain how someone complains about a privacy breach and how you'll handle it. Include the OAIC as the escalation path.
What this section must cover
- How to lodge a complaint with you
- How you'll handle it, and how long you'll take
- How to escalate to the OAIC if they're not satisfied
- The OAIC's contact details
How to write it
This is an explicit APP 1.4 requirement, and it's the one small businesses most often leave out. Give a clear internal process first. Most complaints get resolved at that stage, and the OAIC will usually expect a person to raise it with you before it steps in. Commit to a timeframe and then stick to it.
Worked example
OAIC contact details for your policy: oaic.gov.au, 1300 363 992, GPO Box 5218, Sydney NSW 2001.
- APP 1.4(d) and (e), APP 1.5
Contact details and changes
In the wizard:
Contact detailsIn short
Give a monitored privacy contact, meaning a role based email plus a postal address at minimum, and state the effective date. Your policy has to be available free of charge.
What this section must cover
- A privacy contact point that uses a role, not a person's name
- At least two ways to reach you
- The effective date or version of the policy
- How you'll let people know about material changes
How to write it
Use the details you settled on in decision 3, and make sure they're identical everywhere they appear in the policy. Add an effective date at the top. It's how a reader knows the policy is current, and how you'll later prove which version was in force.
Watch outYour policy has to be free and easy to get hold of, which normally means a page on your website rather than a PDF someone has to request. If someone asks for it in a particular format, take reasonable steps to provide it that way.
Part three
Before you publish
One last pass before you hit Save & Publish. The first four are the ones that cause real problems if you skip them.
Final checks
0 of 8 done
Keep your old versions
If someone questions how you handled their information back in March, the policy that matters is the one that was live in March, not today's. Keep a dated copy of every version you publish, along with the dates it was in force. Savira stores your published versions automatically. If you're also pasting the policy onto your website, keep your own archive of those pages too.
What should trigger a review
Diarise an annual review, and update straight away if any of these happen.
- You start collecting something new, or collecting it a new way
- You add a tool that touches customer data, such as a new CRM, email platform, chatbot or analytics tool
- A supplier moves your data offshore, or you start using a new overseas service
- You expand into a new state, into New Zealand, or into a regulated activity like health services
- Your turnover passes $3 million, or a reform brings you into scope
- Your privacy contact details change
Then link it properly
Publishing isn't finished until people can find it. Put the policy in your website footer so it's reachable from every page, and link it from every form that collects personal information, right next to the submit button rather than buried in the fine print. The getting started guide covers adding it to your WordPress menu.
Take it with you
Download the guide
The whole walkthrough in one printable document, including the final checks page. Handy if you are filling in your policy away from the screen, or passing it to whoever looks after privacy in your business.
PDF, 18 pages, 300 KB