Your Website and the Australian Privacy Act: A 2026 Checklist
Most Australian business websites collect personal information every day through contact forms, quote requests, newsletter sign-ups, analytics and advertising pixels. The Privacy Act 1988 and the Australian Privacy Principles (APPs) set the rules for that, and 2026 has brought more enforcement, new penalties and a new privacy policy requirement that starts on 10 December 2026.
This checklist covers what matters for a typical business website, based on official guidance from the Office of the Australian Information Commissioner (OAIC) and the legislation as at October 2026. It is general information, not legal advice.
Does the Privacy Act apply to your business?
The APPs apply to Australian Government agencies and to organisations with annual turnover over $3 million. Smaller businesses are generally exempt, but the OAIC lists exceptions that apply regardless of turnover, including:
- health service providers, which includes complementary therapists, gyms, weight-loss clinics, child care centres and private schools;
- businesses that trade in personal information;
- contracted service providers to the Commonwealth;
- businesses related to a covered business, and businesses that have opted in;
- AML/CTF reporting entities, for their AML/CTF activities. From 1 July 2026 those obligations extend to lawyers, conveyancers, real estate businesses, accountants and trust and company service providers.
The small business exemption still exists. The government agreed in principle in 2023 to remove it after consultation and a transition period, and on 31 August 2026 it released an exposure draft of a tranche 2 privacy Bill, but that draft does not remove the exemption and has not been introduced to Parliament.
Even exempt businesses are not entirely outside privacy law. Since 10 June 2025, individuals can sue for serious invasions of privacy under a statutory tort that is not limited to APP entities, and the Spam Act applies to marketing emails whatever your size. Following the checklist below is also simply good practice, because customers notice how their details are handled.
Your privacy policy (APP 1)
If the APPs apply, you need a clearly expressed, up-to-date privacy policy, available free of charge. The OAIC expects it to be on your website and suggests a prominent link on every page, usually in the footer. Under APP 1.4 it must cover:
- the kinds of personal information you collect and hold;
- how you collect and hold it;
- the purposes for which you collect, hold, use and disclose it;
- how people can access and correct their information;
- how people can complain and how you handle complaints;
- whether you are likely to disclose information overseas and, if practicable, the countries involved.
Generic templates often fail the "clearly expressed" and "up to date" tests because they describe tools the business does not use, or miss the ones it does. Your policy should match your actual forms, analytics, advertising pixels, CRM and email platform.
New from 10 December 2026: automated decisions
From 10 December 2026, APP 1.7 to 1.9 require extra privacy policy disclosures if all three of these apply: you have arranged for a computer program to make a decision, or to do something substantially and directly related to making one; the decision could reasonably be expected to significantly affect someone's rights or interests; and personal information about them is used in the program.
Examples in the law include decisions about whether someone gets a benefit, rights under a contract, or access to a significant service or support. On a website, think about online eligibility checks, automated approvals or declines, and screening tools. If this applies, your policy must describe the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions where the program plays a substantial part. It applies to decisions made after that date, even if the tool was set up earlier. The OAIC has published a fact sheet on the new obligation.
Contact forms and collection notices (APP 5 and APP 3)
When a form collects personal information, APP 5 requires reasonable steps to tell people, at or before the time of collection, who you are and how to contact you, why you are collecting the information, who you usually disclose it to, whether it may go overseas, what happens if they do not provide it, and that your privacy policy explains access, correction and complaints. In practice that means a short notice next to the submit button with a link to the full policy.
Only ask for what you need. In April 2026 the OAIC found that a rental application platform collected excessive information and collected it unfairly, and for the first time criticised "online choice architecture" such as confirmshaming, biased framing and bundled consent. Optional fields should be clearly optional, and consent should not be bundled into unrelated agreements.
Tracking pixels, analytics and cookies
Australia has no law that specifically requires a cookie banner. But the OAIC's tracking pixels guidance, published in November 2024, makes clear that the Privacy Act applies when pixels collect, use or disclose personal information. An IP address, page URL or hashed email can make someone reasonably identifiable when it can be matched with other data.
The guidance says to disclose pixels in your privacy policy and collection notices, use the data only for the purposes you collected it for, give people a simple way to opt out of targeted advertising, and review your tracking regularly rather than setting and forgetting it. Collecting sensitive information, such as health information, through a pixel requires consent.
This is now an enforcement priority. In June 2026 the OAIC found that a telehealth provider and an IVF provider had interfered with privacy by collecting sensitive information through third-party pixels. Its report on 50 health websites found 96% used tracking technologies, 52% used a third-party pixel, and 77% of the pixel users did not mention pixels in their privacy policy. One provider found 50 active pixels it did not know about.
Overseas tools: hosting, CRMs and email platforms (APP 8)
Many website tools store data overseas. Before disclosing personal information to an overseas recipient, you must take reasonable steps to make sure they will not breach the APPs, and you generally remain accountable if they do. The OAIC says storage with an overseas cloud provider can be a "use" rather than a "disclosure" where a binding contract limits the provider to storing the data and you keep effective control. Either way, list the likely countries in your privacy policy, or general regions if there are many.
Security and data breaches (APP 11)
You must take reasonable steps to protect personal information from misuse, loss and unauthorised access, and since December 2024 the law states that those steps include technical and organisational measures. Destroy or de-identify information you no longer need, including old form submissions sitting in inboxes and plugins. If you suspect a data breach, you must assess it within 30 days, and if it is likely to result in serious harm, notify the OAIC and affected individuals as soon as practicable.
Email sign-ups and the Spam Act
The Spam Act applies to marketing emails and SMS regardless of the Privacy Act exemption. You need consent, every message must identify you and include an unsubscribe option that is free, works for at least 30 days and is honoured within five working days, and you must keep records of consent. ACMA takes this seriously: in 2026 Lululemon paid a $702,900 infringement notice over emails without a functional unsubscribe, and TAB paid more than $2.7 million for spam and telemarketing breaches.
Penalties and the privacy policy sweep
Since December 2024 the OAIC can issue infringement notices for administrative breaches, including a privacy policy that is not clearly expressed or up to date, a policy missing required content, and problems with direct marketing opt-outs. At the penalty unit value of $364 from 1 July 2026, a notice is $4,368 per contravention for an individual, $21,840 for a body corporate and $72,800 for a listed corporation. Serious interferences with privacy carry penalties of up to $50 million or more for companies.
In January 2026 the OAIC began its first privacy policy compliance sweep, covering about 60 entities in rental and property, chemists, licensed venues, car rental, car dealerships and pawnbrokers. Privacy policies are no longer a box nobody checks.
Your website privacy checklist
- Confirm whether the APPs apply to you, including the health service and other exceptions.
- List every tool on your site that touches personal information: forms, analytics, pixels, chat, booking, CRM and email platforms.
- Rewrite your privacy policy to match that list and APP 1.4, including overseas countries.
- If you use automated decisions that significantly affect people, add the APP 1.7 disclosures before 10 December 2026.
- Add a short collection notice to every form and remove fields you do not need.
- Audit tracking pixels, remove unknown or unused ones, and get consent before collecting sensitive information.
- Check email sign-ups for consent records and working unsubscribe links.
- Delete old form submissions you no longer need and secure the accounts that hold them.
- Link the privacy policy from every page and review it at least once a year.
Conclusion
Privacy work is also trust work. A clear policy, honest forms and tidy tracking make your business look organised to customers, and they reduce risk as enforcement increases. When we build or rebuild a site, we can map its forms and tracking so your privacy policy describes them accurately. If you want us to look at yours, request a website and SEO review. We are not lawyers, so for legal questions about your obligations, speak to a privacy adviser or start with the OAIC.
