Privacy policy template for Australian small businesses

A privacy policy template gives you a head start on the one document customers, clients and the regulator can all check. This is a free Australian privacy policy template built around the Australian Privacy Principles (APPs), with a note under each section on what to change so it describes your business, not someone else’s.

You’re free to use and adapt it for your own business. The real work is making every section true for you: what you collect, why you collect it, who you share it with and where it goes.

Who this privacy policy template suits

This template suits small Australian businesses with fairly simple information handling: a website, a contact or booking form, an email list and a handful of suppliers.

It’s a starting point, not a finished policy. If you collect health information, sight identity documents, use automated decisions or send information overseas, you’ll need the extra sections further down. If you’re not sure whether the Privacy Act 1988 (Cth) covers you, read does the Privacy Act apply to my small business first. Even where it doesn’t, customers and larger clients often ask to see a policy before they’ll deal with you.

How to use this template

Copy the sample below, replace every placeholder in square brackets, then delete anything that isn’t true for your business.

1. List what you actually collect. Go through every form, tool and supplier that touches customer details. A free website privacy scan can help you spot the cookies and tracking scripts your site loads, which belong under “What we collect”.

2. Work through each section. Read the “Adapt this” note under each one and rewrite the wording to match what you do.

3. Add any extra sections that apply. Automated decisions, identity documents and how long you keep information are the common ones.

4. Check it against your real practices. Use the checklist near the end of this page.

5. Publish it. Put it on a clearly linked page on your website, with the date it was last updated.

The Australian privacy policy template

The template has nine sections, the same nine you start with in Savira’s privacy policy editor. Text in square brackets is a placeholder, and each section is followed by a note on what to change.

[Business Name] Privacy Policy

Last updated: [date]

1. What this policy covers

This policy explains how [Business Name] collects, uses, stores and shares your personal information. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Adapt this: if the Privacy Act doesn’t cover your business, don’t say you’re bound by it. You can say you follow the Australian Privacy Principles as good practice instead.

2. What we collect

We collect personal information that you give us or that we need to provide our services, including:

• your name, email address, phone number and postal address

• details of your enquiries, bookings and purchases

• payment details, which are processed by our payment provider

• information about how you use our website, such as your IP address, browser type and the pages you visit, collected through cookies and similar technologies

Adapt this: list what you actually collect, in plain categories. If you collect sensitive information, such as health information, list it separately. Remove anything you don’t collect.

3. Why we collect it

We collect, hold, use and disclose your personal information to:

• provide the products and services you ask for

• respond to your enquiries

• process payments and manage your account

• send you updates or marketing you’ve agreed to receive, which you can opt out of at any time

• improve our website and services

• meet our legal obligations

Adapt this: every purpose should match something you actually do. Routine internal tasks such as billing and auditing don’t need their own line.

4. How we collect data

We collect personal information directly from you when you fill in a form, contact us, make a booking or buy from us. We also collect some information automatically when you use our website, through cookies and similar technologies. Sometimes we receive information about you from third parties, such as [describe them, for example referrers or booking platforms].

Adapt this: name your real channels, including phone, in person and any platforms that pass details to you. If your website uses cookies or tracking pixels, say so here and link your cookie policy.

5. How we store and protect it

We store personal information [in our business systems and with service providers such as our booking, email and accounting platforms]. We take reasonable steps to protect it from misuse, interference, loss and unauthorised access, modification or disclosure, including [access controls, strong passwords and two-factor authentication]. When we no longer need it, we take reasonable steps to destroy or de-identify it.

Adapt this: describe where information lives and the protections you actually use. Keep it general enough that it doesn’t help someone get around your security.

6. Who we share it with

We share personal information only where it’s needed for the purposes in this policy, or where the law requires or allows it. This includes sharing with [our IT, hosting and email providers, our payment processor, professional advisers such as our accountant, and government agencies where required by law]. We do not sell your personal information.

Adapt this: list the kinds of suppliers that receive personal information. Only keep “We do not sell your personal information” if it’s true.

7. Cross-border disclosure

Some of our service providers are located overseas, so your personal information is likely to be disclosed to recipients in [list countries, for example the United States and New Zealand].

Adapt this: check where each supplier stores data, because cloud email, booking and marketing tools are often overseas. Name the countries if it’s practicable. If you genuinely don’t disclose personal information overseas, replace this section with: “We do not disclose personal information to overseas recipients.”

8. Your rights

You can ask for access to the personal information we hold about you, and ask us to correct it if it’s inaccurate, out of date, incomplete or misleading. Contact us using the details below and we’ll respond within a reasonable time.

If you think we’ve mishandled your personal information, please complain to us in writing first using the details below. We’ll [acknowledge your complaint and aim to respond within 30 days]. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC).

Adapt this: your policy has to explain access, correction and how someone can complain, plus how you’ll handle a complaint. Some businesses give complaints their own section, which is fine as long as it’s there.

9. Contact us

For privacy questions, access or correction requests, or complaints, contact our [Privacy Officer]:

• Email: [privacy@yourbusiness.com.au]

• Phone: [phone number]

• Post: [postal address]

If you’d like a copy of this policy in another format, ask us and we’ll do what we reasonably can.

Adapt this: use a role-based email address that doesn’t change when staff do, and make sure someone actually checks it.

Extra sections you might need to add

Add a section for anything the nine standard sections don’t cover, such as automated decisions, identity documents or how long you keep information. In Savira, you add these with Add new section in the policy editor.

Automated decisions

From 10 December 2026, your policy has to say so if a computer program uses personal information to make, or substantially and directly help make, decisions that could significantly affect someone’s rights or interests. Our guide to the automated decision-making privacy policy rules explains when it applies.

We use [describe the program, for example automated application software] to [describe the kinds of decisions, for example approve or decline applications]. It uses [kinds of personal information]. [Say which kinds of decisions are made by the program alone and which are made by a person using its output.]

Identity documents

When you [rent a property or hire equipment], we ask to see [a driver licence or passport] to [reason]. We [record the document number and expiry date, or do not keep a copy] and keep it for [period].

How long we keep information

We keep personal information for as long as we need it for the purposes in this policy or as required by law, then destroy or de-identify it. [Add specific periods for each type of record.]

Notes for health and real estate businesses

Health and real estate businesses usually need more detail than the base template, because they handle sensitive information or identity documents as a matter of course.

Health practices

Health service providers are generally covered by the Privacy Act regardless of turnover. List health information separately as sensitive information, explain how patient records are held, and name who you share them with, such as other practitioners or pathology providers. Check your booking and appointment pages for tracking pixels too. Our guide to tracking pixels on health websites and the healthcare privacy compliance page cover both.

Real estate agencies

Explain what you collect for tenancy applications, sales and property management, including identity documents and references. Say who you share it with, such as landlords, referees and any tenancy database you use, and how long you keep applications from unsuccessful applicants. See real estate privacy compliance for more.

Check your policy against what you really do

Before you publish, read the finished policy against your real systems, section by section.

• Every form, tool and supplier that touches personal information is covered somewhere.

• Every placeholder in square brackets has been replaced or deleted.

• Overseas suppliers and their countries are named, where practicable.

• Access, correction and complaints are all explained.

• The contact details work, and someone checks them.

• The policy is linked from every page of your website, usually in the footer.

• The last updated date is right, and there’s a reminder to review it in 12 months.

For more on each requirement, see privacy policy requirements in Australia.

Keeping your policy up to date

A template is a snapshot, so update your policy whenever you add a tool, change a supplier or start collecting something new, and review it at least once a year.

Edit this template in Savira

If you’d rather not manage a document by hand, Savira’s privacy policy generator starts from the same nine sections. You edit each section in one place, add extra sections when you need them, preview the result and copy the finished policy to your site.

This template draws on the OAIC’s Chapter 1: APP 1 Open and transparent management of personal information, updated 30 September 2026.

This is general information, not legal advice. Every business handles information a bit differently, so if you’re not sure how this applies to yours, it’s worth checking with a lawyer or privacy adviser.