Collection notice template for Australian businesses

A collection notice is the short message you give people when you ask for their personal information, telling them who you are, why you want it and what happens to it next. If the Privacy Act 1988 (Cth) covers your business, Australian Privacy Principle 5 (APP 5) expects one at every point you collect. The collection notice template below gives you a starting point.

Think of every web form, intake sheet, rental application and phone booking your business runs. Each one is a moment where someone decides whether to hand over their details, and APP 5 is about making sure they can make that call with the facts in front of them.

What is a collection notice?

A collection notice tells someone about one specific collection, at the moment it happens. Your privacy policy is different: it describes how your business handles information in general, and it sits on your website for anyone to read.

The two work as a pair. A collection notice can point to your privacy policy for the longer detail, but the OAIC warns that a privacy policy may only describe your general practices, so check it actually covers the collection in question. If your policy needs work first, start with our guide to privacy policy requirements in Australia.

Some businesses call it a privacy notice or a collection statement. Same job, different name.

What does APP 5 require a collection notice to cover?

APP 5 requires you to take reasonable steps to tell people a set list of things, or to make sure they already know them. In plain English, that list is:

• Who you are. Your business name and how to contact you about privacy.

• How you got the information. This matters when it came from someone else, or when the person may not realise you are collecting it, for example through cookies or other tracking software.

• Whether a law requires it. If an Australian law or a court or tribunal order requires or authorises the collection, name it.

• Why you are collecting it. The main purpose, plus any other purposes the person should know about.

• What happens if they say no. The main consequences of not providing the information, such as not being able to process an application.

• Who you usually share it with. Name the organisations, or describe the types of organisations if the list is long.

• Where your privacy policy is. And that it explains how to access or correct their information and how to complain.

• Whether it goes overseas. Whether you are likely to disclose it to overseas recipients and, if practicable, which countries.

“Reasonable steps” depends on the situation. The OAIC expects more care when the information is sensitive (health information, for example), when the consequences for the person could be serious, or when the person may not easily understand English. Being inconvenient or costly is not, on its own, a reason to skip a step.

You do not always need every item. If your business name is printed across the top of the form, you do not need to spell it out again. The OAIC also accepts that sometimes no notice is reasonable, such as when someone already knows all of this, but it is up to you to be able to justify that call.

APP 5 is one of the 13 Australian Privacy Principles, and it works hand in hand with APP 1, which covers your privacy policy.

When and how do you give a collection notice?

You give a collection notice at or before the moment you collect the information. If that genuinely is not practicable, you give it as soon as practicable afterwards.

The OAIC suggests building notices into the way you collect, rather than bolting them on later:

• Forms and online tools. Show the notice clearly on the form, or include a prominent link to it, before the person hits submit.

• Phone calls. Cover the key points at the start of the call, using a short script. If that is not practicable, follow up in writing or point them to the notice on your website.

• Layers. A short notice on the form or a sign, backed up by a fuller notice online or in a brochure.

• Staff. Anyone who collects details at the counter or on the phone should know what the notice says.

• Other people collecting for you. If a partner or supplier collects information you then receive, make sure they tell the person on your behalf.

If you collect information through tools on your website, such as analytics or advertising pixels, it is worth checking whether you need a cookie banner as well.

Collection notice template

Copy the template below and replace everything in capitals in brackets. Delete any line that does not apply to the collection you are writing for.

Collection notice

(BUSINESS NAME) collects your (KINDS OF INFORMATION, FOR EXAMPLE NAME, EMAIL AND PHONE NUMBER) so we can (MAIN PURPOSE). We may also use it to (ANY OTHER PURPOSE).

If you do not provide (THE INFORMATION), we may not be able to (MAIN CONSEQUENCE).

(ONLY IF IT APPLIES) We collect this information because (NAME OF THE LAW) requires or allows us to.

(ONLY IF IT APPLIES) We also collect information about you from (WHO OR WHAT, FOR EXAMPLE YOUR REFEREES, OR COOKIES ON OUR WEBSITE).

We usually share this information with (NAMED ORGANISATIONS OR TYPES OF ORGANISATIONS).

We (ARE / ARE NOT) likely to send this information overseas. (IF YES) The recipients are likely to be in (COUNTRIES).

Our privacy policy at (LINK) explains how you can access and correct your information, how to make a privacy complaint and how we will handle it. Questions? Contact us at (GENERIC PRIVACY EMAIL) or (PHONE).

A generic contact like privacy@yourbusiness.com.au is a good idea, because it keeps working when staff change.

Collection notice examples for common forms

These worked examples show how the template changes with the setting. Swap in your own details, providers and countries.

Website enquiry form

A short notice sits directly under the submit button, with a link to the full version.

We collect your name, email and phone number to reply to your enquiry. If you leave them out, we cannot get back to you. Our website and email providers store this information for us, and some of them are based in (COUNTRIES). Our privacy policy explains how to access or correct your information and how to complain.

Clinic intake form

Health information is sensitive information under the Privacy Act, so the notice goes on the intake form itself, in plain words, and covers who else sees the information.

We collect your contact details, Medicare details and health history so we can provide safe and appropriate care. Without this information we may not be able to treat you. We usually share relevant information with other practitioners involved in your care, pathology and imaging providers, and our practice software provider. Our privacy policy explains how to access your records and how to make a complaint.

If you run a practice, the medical practice privacy risk scorecard and our page on health website privacy compliance cover the wider picture.

Tenancy application

Rental applications collect a lot, including identity documents and information from other people, so the notice needs to say where else information comes from.

We collect your contact details, identity documents, rental history and income details to assess your application for the landlord. We will also contact your referees, previous landlords and employer. If you do not provide this information, we may not be able to process your application. We share your application with the landlord and (TENANCY DATABASE, IF YOU CHECK ONE). We keep a copy of your identity documents for (PERIOD) and then (WHAT HAPPENS TO THEM).

More for agencies on our real estate privacy compliance page.

How to make the template fit your business

A collection notice only works if it describes what you really do. Work through these steps:

1. List every collection point. Web forms, booking tools, phone, counter, email and any scripts running on your website. A website privacy scanner can show tools collecting information you may not know about.

2. Write one notice per collection point. A clinic intake form and a newsletter sign-up need different notices.

3. Check it against your privacy policy. The two should agree on what you collect, who you share it with and whether it goes overseas.

4. Put it where people see it. Before the submit button or signature line, not buried in a footer.

5. Brief your team. Give front desk and phone staff a short script.

6. Review it when anything changes. A new supplier, a new form or a new tool is a reason to update the notice.

Not sure whether the Privacy Act applies to you at all? Start with does the Privacy Act apply to my small business.

Source: Chapter 5: APP 5 Notification of the collection of personal information, Office of the Australian Information Commissioner, published 22 July 2019.

This is general information, not legal advice. Every business handles information a bit differently, so if you’re not sure how this applies to yours, it’s worth checking with a lawyer or privacy adviser.