Quick answer
- Most small businesses are not covered by the Privacy Act 1988. For privacy law, a small business is one with an annual turnover of $3 million or less, counting all income from all sources. (OAIC)
- Some small businesses are covered whatever their turnover, including health service providers and businesses that trade in personal information. (OAIC)
- If you are covered, you must have a clearly expressed, up to date privacy policy, and it is usually published on your website. (OAIC, APP 1)
- If you are not covered, the OAIC still recommends protecting the personal information you hold, and a plain one page policy is an easy trust signal next to your quote form.
Every tradie website we build in Gosnells and across south-east Perth has a quote form. That form collects names, phone numbers, email addresses and job addresses, which is personal information. So one question comes up a lot: do I legally need a privacy policy on my website?
The honest answer is "it depends on your business", and the Office of the Australian Information Commissioner (OAIC) sets out exactly what it depends on. Here it is in plain English. This is general information, not legal advice.
The $3 million small business rule
The Privacy Act mostly applies to larger businesses. The OAIC says most small businesses are not covered, and defines a small business as one with an annual turnover of $3 million or less. (OAIC)
Two details catch people out:
- Turnover means all income from all sources. It does not include assets held, capital gains or proceeds of capital sales.
- The test looks back to 2002. The OAIC checklist asks whether your business has had an annual turnover of more than $3 million in any financial year since 2002. If you haven't traded a full financial year yet, you project a full year turnover from your income so far.
For most sole trader plumbers, sparkies, landscapers and cleaners, turnover sits well under that line. But turnover is only the first question.
When a small business is covered anyway
The OAIC lists businesses that are covered regardless of turnover. The ones most relevant to local service businesses are:
- Health service providers. This is broad. The OAIC includes allied health professionals, complementary therapists and child care centres. If you run a physio clinic, a massage practice, a disability support service or a home care business, assume you are covered.
- Businesses that trade in personal information. That means collecting or disclosing personal information for a benefit, such as selling your customer list to a marketing company or swapping lists with another business, without consent.
- Commonwealth contractors. If you provide services under a Commonwealth contract or subcontract, check your contract for privacy obligations.
- Businesses related to a larger covered company, such as a subsidiary.
- Businesses that opt in. A small business can choose to be covered by the Privacy Act.
The full list also includes residential tenancy database operators, credit reporting bodies and some other specialist cases. The OAIC's small business privacy checklist walks through every question in order, and only takes a few minutes.
What a privacy policy must include if you are covered
Covered businesses must follow the Australian Privacy Principles (APPs). APP 1 requires a clearly expressed and up to date privacy policy, made available free of charge, usually on your website. The OAIC suggests a prominent link on each page, such as in the footer. (OAIC, APP 1)
Under APP 1.4, the policy must cover at least:
- The kinds of personal information you collect and hold, for example contact details and job addresses.
- How you collect and hold it, for example through your website form, phone calls, and the software or cloud services you store it in.
- Why you collect, hold, use and disclose it, for example to quote and book jobs.
- How someone can access their information and ask for it to be corrected.
- How someone can complain about a breach, and how you will handle the complaint.
- Whether you are likely to disclose information to overseas recipients and, if practical, which countries.
The OAIC also says the policy should be easy to understand, avoid jargon and legalistic terms, and show when it was last updated. A short, honest page beats a long copied template that doesn't match how you actually work.
A new rule for automated decisions
From 10 December 2026, covered businesses that use a computer program, including AI tools, to make or substantially help make decisions that could significantly affect a person's rights or interests must explain this in their privacy policy. (OAIC, APP 1.7 to 1.9) Most tradies won't be affected, but health and support providers using software to approve or decline services should read the OAIC guidance.
Not covered? Why a privacy policy is still worth it
If you work through the checklist and you are not covered, the OAIC still recommends that you protect any personal information you hold, and suggests considering opting in, noting benefits such as increased consumer confidence and trust. (OAIC)
From a website point of view, a privacy page is cheap insurance:
- It reassures people at the form. Someone about to type their home address into a quote form wants to know it won't be sold or spammed. A one line note under the form ("We only use your details to reply to your quote. See our privacy policy.") answers that.
- It keeps you ready to grow. If turnover passes $3 million or you add a health service, the page is already there to update.
- It makes you think about your data. Writing it down shows you where enquiries end up: your inbox, your phone, a job app or a spreadsheet.
A quick website privacy checklist for tradies
- Run the OAIC small business checklist and note whether you are covered.
- Add a Privacy Policy page and link it in your footer.
- Add a one line privacy note under your quote or contact form.
- Only ask for what you need on the form. A name, phone, suburb and job details is usually enough to quote.
- Keep your website, email and form tools on accounts in your own business name, with strong passwords.
- Put a "last updated" date on the policy and check it once a year.
Getting your domain sorted too? Our guide on .com.au domain eligibility covers keeping it in your own name, and our website care plan guide explains what ongoing upkeep should include.
FAQs
Is a privacy policy a legal requirement for every Australian website?
No. It is required for businesses covered by the Privacy Act. Most small businesses with turnover of $3 million or less are not covered, unless they fall into a group the OAIC lists, such as health service providers or businesses that trade in personal information.
Does having a contact form mean I need a privacy policy?
A contact form alone doesn't bring you under the Privacy Act. Coverage depends on your turnover and the type of business. It does mean you collect personal information, so a short privacy note and policy is good practice.
I'm an NDIS or allied health provider. Am I covered?
Very likely. The OAIC says health service providers are covered regardless of turnover, and includes allied health professionals and complementary therapists. Check the OAIC guidance or get advice for your situation.
Can I copy another business's privacy policy?
It's not a good idea. The OAIC says a policy should be tailored to how your business actually handles information. A copied policy often describes systems and overseas transfers you don't have, and leaves out the ones you do.
Where should the privacy policy go on my website?
The OAIC suggests a prominent link on each page, which in practice means the site footer, plus a link near any form that collects personal information.
Sources
- OAIC, Small business: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business
- OAIC, APP Guidelines Chapter 1: APP 1 Open and transparent management of personal information: https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-1-app-1-open-and-transparent-management-of-personal-information
Guidance checked on 27 October 2026. This is general information, not legal advice. Check the OAIC website or speak to a lawyer about your own business.
Want a website that gets the basics right?
JetBlok builds fast websites for tradies and small businesses in Gosnells and across Perth, with a privacy page, a clear quote form and your Google listing sorted.
See it first, pay later: 10% deposit (minimum $199) to start, No GST charged. Build your quote or check our pricing.
