Does your website need a privacy policy? Privacy, terms and data policies explained
By Steven Coochin — 2025-05-05
Many of us click "I agree" on Privacy Policies and Terms of Service without reading a single line. It's easy to skip over legal text when you're eager to use a new app or fill out a form. But if your website collects customer details, whether through a contact form, a newsletter sign-up, or an online purchase, you can't afford to treat those documents as mere checkboxes. Understanding what you're agreeing to is prudent, and staying compliant with Australian regulations and keeping the trust of your customers and community is essential.
For your users, these policies are crucial. They determine whether their personal information ends up on spam lists, in the hands of scammers, or, even worse, exposed in a data breach. If your Privacy Policy or Terms permit extensive data sharing or have weak security practices, every email address and phone number you collect could be at risk of being used for unwanted marketing or fraudulent activities.
This isn't bureaucracy for its own sake. A solid Privacy Policy and Terms of Service do more than protect your business; they also build trust, establish clear expectations, and keep you compliant, with a focus on how data is managed.
What counts as personal information?
Your website collects personal information if it has a contact form, booking system, checkout, or email newsletter signup, as defined by the Office of the Australian Information Commissioner (OAIC).
Personal information includes:
- Names
- Phone numbers
- Email addresses
- Physical addresses
- Customer account details
If you store any of this, even temporarily, you need a website privacy policy that explains what you collect, why you collect it, how it's stored, and whether it's shared.
The Privacy Act 1988 covers businesses with an annual turnover of more than $3 million. Most smaller businesses are exempt, but not all of them: health service providers and businesses that buy or sell personal information are covered whatever their size. If you send marketing emails or texts, the Spam Act 2003 applies to you no matter how small you are. And even if the Privacy Act doesn't cover you, following it anyway is the simplest way to keep your customers' trust.
A Privacy Policy should clearly explain:
- What data you collect and why
- How the data is stored and protected
- Whether data is shared with a third party (e.g., Mailchimp, a payment processor, or your hosting provider)
- How users can access or request the deletion of their data
- How to contact you with privacy concerns
It helps customers feel confident that their information won't be misused. And if your site ever gets hacked or something goes wrong, having a proper policy enables you to comply with legal and ethical standards.
Terms of Service: set expectations early
Your Terms of Service (sometimes called Terms and Conditions) define the relationship between you and your customers or website visitors.
They can cover things like:
- How your products or services are delivered
- Payment terms and refund policies
- User behaviour expectations (no spam, no scraping, etc.)
- Intellectual property ownership (who owns the content, images, etc.)
- Limitation of liability and dispute resolution
Having this spelled out on your website protects you if things go sideways and makes managing expectations with your customers easier from day one. It also gives you legal protection, especially if you take orders, bookings, or payments through your site.
Your internal data handling process
In addition to your Privacy Policy, having a straightforward internal data handling process is good business. Think of it like your behind-the-scenes playbook for how your team deals with personal data.
- Who has access to customer information?
- How long is data stored?
- What happens when a customer asks for their data to be deleted?
- Are backups encrypted?
- Where is your data hosted? Is it in Australia or overseas?
The more transparent you are, the more trust you build. With the increase in data breaches and cyber threats, it's no longer sufficient to claim, "We take your privacy seriously." You must demonstrate how, what, where, and when you protect your users' privacy.
Handle email addresses and phone numbers with care
Email addresses and phone numbers are among the data Australian business websites most often collect and mishandle. Collecting them brings additional obligations under privacy and anti-spam laws, so handle them with care.
- Never share or sell customer contact details unless your Privacy Policy clearly allows it.
- Use confirmed opt-in for newsletters so you can prove each subscriber's consent.
- Gather only the data you need. If a name and email will do, leave the phone number out.
- Secure forms with HTTPS encryption and keep customer data locked down.
What your website says about trust
Your website is a point of contact, a data collection system, and a reflection of how seriously you take your customers' trust. Having a well-written Privacy Policy, clear Terms of Service, and an internal data handling plan is about professionalism as much as compliance.
So next time you launch a form or a checkout page, remember who a well-written Privacy Policy and Terms of Service are for: your customers and the future of your business, as much as the lawyers.