Skip to content

Free template · Word download · Privacy Act 1988

Privacy Policy Template for Australian businesses

A free, editable privacy policy template built to APP 1 of the Privacy Act, including the automated decision rules that apply from 10 December 2026. Copy it or download it as a Word document, no sign-up. Below it, a guide to every section the law asks for, the wording people get wrong, and the two questions a template cannot answer for you: whether the Act covers your business, and whether software makes decisions about your customers.

Last updated

Get the free template How to write it ↓

Rather not fill it in yourself? Have it written for your business instead. Your first document is free; card required, no charge today.

The cover page of a generated privacy policy, branded for an example company, showing its document control block, approval table and the Privacy Act requirements it maps to.
Generated from this page's structure, in an example company's branding

Free template

Free Australian privacy policy template

The complete privacy policy, free to copy from this page or download as an editable Word document. No sign-up. Replace every [bracketed placeholder] with your own details, delete anything that does not apply, and have it approved before you rely on it. The guide below explains what each section has to contain and what an auditor checks.

Free template, full text Download Word (.docx)

Privacy Policy

An editable privacy policy for an Australian business. Replace the bracketed placeholders and delete anything that does not apply to you.

[Organisation name] ([ABN]) [what you do, e.g. provides bookkeeping services to small businesses in Brisbane]. This policy explains how we collect, hold, use and disclose personal information, and how you can ask to see or correct the information we hold about you, or make a complaint. [If the Privacy Act covers you:] We manage personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. [If it does not:] We have chosen to handle personal information in line with the Australian Privacy Principles.

1. Whose information this policy covers

This policy covers the personal information we handle about [the groups of people you deal with, e.g. our clients, people who visit our website or contact us, job applicants and suppliers].

2. The personal information we collect

We collect only the personal information we need. Depending on how you deal with us, this includes:

  • [Clients]: [name, contact details, the services you use, payment details].
  • [Website visitors]: [what you type into our enquiry form, and information about how our website is used].
  • [Job applicants]: [your application, résumé and referees' details].
  • [Suppliers]: [contact details, ABN and bank details for payment].

3. Sensitive information

[Only if you collect it. Sensitive information is a defined term in the Privacy Act: health information and information about, for example, a person's racial or ethnic origin, religious beliefs or criminal record. Information you simply treat as confidential, such as bank details, is not sensitive information.] We collect [the sensitive information, e.g. health information] only with your consent and where it is reasonably necessary for [purpose], unless the law requires or allows us to collect it without your consent.

4. How we collect personal information

We collect most personal information directly from you, for example when you [fill in a form, email or call us, or use our website]. Sometimes we collect it from someone else, such as [another source, e.g. a referee you nominate or a credit reporting body], where it is unreasonable or impracticable to collect it from you.

[If your website uses them:] Our website uses [cookies and analytics tools, e.g. Google Analytics] to [understand how the site is used]. [Say how a visitor can turn them off.]

5. How we hold and protect it

We hold personal information in [where you keep it, e.g. our cloud client management system and Microsoft 365] [and on paper in locked storage at our office].

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include [your main safeguards, e.g. individual logins with multi-factor authentication, access limited to the staff who need it].

When we no longer need personal information for any purpose the law allows, we take reasonable steps to destroy it or de-identify it, unless the law requires us to keep it.

6. Why we collect, use and disclose it

We collect, hold, use and disclose personal information to [your purposes, e.g. provide our services, take payments, answer enquiries, recruit staff and meet our legal obligations].

We may also use or disclose it for another purpose that is related to the one we collected it for (directly related, for sensitive information) and that you would reasonably expect, or where the law requires or allows it.

[If you send marketing:] We send [what, e.g. a monthly newsletter] to [whom]. You can opt out at any time by [using the unsubscribe link or contacting us], and we will stop.

7. Who we share it with

We disclose personal information to [the kinds of recipients you really share with, e.g. our IT and software providers, payment processors and professional advisers] for the purposes above. [Say what a recipient receives where it helps, e.g. our accounting provider receives suppliers' bank details so we can pay them.]

We also disclose personal information where the law requires or authorises us to.

8. Sending information overseas

[If you do:] We are likely to disclose personal information to [the kinds of recipients, e.g. cloud and software providers that store our data] located in [countries, e.g. the United States]. [If you do not:] We do not disclose personal information to anyone outside Australia.

9. Decisions made using computer programs

[If computer programs make, or substantially help make, decisions that could significantly affect people, using their personal information:] We use [the kind of program, e.g. automated screening software] to [what it decides or helps decide, e.g. assess applications]. It uses [the kinds of personal information, e.g. your identity details and payment history].

[Decisions a program makes on its own, e.g. applications below a set score are declined automatically.] [Decisions a person makes with the program's help, e.g. our staff decide other applications, relying on the program's score.]

[If you do not use programs this way:] We do not use computer programs to make, or substantially help make, decisions that could significantly affect you.

10. Accessing and correcting your information

You can ask to see the personal information we hold about you, and ask us to correct it if you think it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact [role, e.g. our Privacy Officer] using the details below. We may need to confirm who you are first.

We will respond within [30 days]. Asking costs nothing, and any charge for giving you access will not be excessive. If we refuse, we will tell you in writing why (unless it would be unreasonable to do so) and how you can complain.

11. Making a complaint

If you think we have breached the Australian Privacy Principles, contact [role] at [email address]. We will acknowledge your complaint, look into it and respond within [30 days].

[If the Privacy Act covers you:] If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

12. Contact us

[Role, e.g. Privacy Officer], [Organisation name]: [email address], [phone number], [postal address].

13. Changes to this policy

We review this policy [at least once a year] and update it whenever the way we handle personal information changes. You can read it free of charge at [web address], and ask us for a copy in another form, such as a printed copy.

This template is a starting point, not legal advice. It follows APP 1 of the Privacy Act 1988 (Cth), including the automated decision rules that apply from 10 December 2026. Check every section against what your organisation actually does before you publish it.

The writing guide

How to write a privacy policy

14
sections
3
with real wording
6
questions readers ask
6
failure modes
a day
to write it yourself

APP 1.4 of the Privacy Act sets out what a privacy policy must contain, and the OAIC's APP guidelines explain how much detail each part needs. The test underneath all of it is simple: a reader should finish your policy knowing what you really do with their information. Fill in the template section by section, in this order. Three clauses carry more legal weight than the rest, so those come with example wording and the reason it holds up.

  1. Opening statement

    What it must contain

    Who you are and what you do, and that the policy explains how you manage personal information. Say which standard you follow: the Privacy Act 1988 and the Australian Privacy Principles if the Act covers you, or that you have chosen to follow the APPs if it does not.

    What readers and the OAIC check

    APP 1.3 asks for a clearly expressed, up-to-date policy. The OAIC's guidance asks for plain language a reader follows first time, not legal boilerplate lifted from another business.

  2. Whose information this policy covers

    What it must contain

    The groups of people you hold information about - clients, website visitors, job applicants, suppliers - and only the groups you really deal with.

    What readers and the OAIC check

    Whether the groups fit your business. A café's policy that mentions patients reads as copied, and so does a clinic's that never mentions health information.

  3. The personal information we collect

    What it must contain

    The kinds of personal information you collect and hold for each group, in plain categories such as contact, payment or application details (APP 1.4(a)).

    What readers and the OAIC check

    Specific kinds tied to your services. The OAIC's guidance warns against a long catch-all list of everything an organisation might hold.

  4. Sensitive information

    What it must contain

    Only if you collect it: the sensitive information you hold, as the Act defines it (health information, criminal record, racial or ethnic origin, religious beliefs and similar), why you need it, and the consent you collect it with (APP 3.3).

    What readers and the OAIC check

    That the term is used correctly. ID documents and bank details are confidential, but they are not sensitive information under s 6(1) of the Act.

    Wording that works
    We collect [the sensitive information] only with your consent and where it is reasonably necessary for [purpose], unless the law requires or allows us to collect it without your consent.

    It states the real legal test, consent and reasonable necessity together, instead of implying that being necessary is enough on its own.

  5. How we collect personal information

    What it must contain

    How you collect it: directly (forms, calls, email, your website), automatically (cookies and analytics), and from other people (referees, data providers) (APP 1.4(b)).

    What readers and the OAIC check

    Sources that match reality. If your website runs analytics, the policy says so; it is the most commonly missed source.

  6. How we hold and protect it

    What it must contain

    Where you hold personal information (your systems, any paper files), the main safeguards you actually have, and that you destroy or de-identify it once you no longer need it (APP 1.4(b), APP 11).

    What readers and the OAIC check

    Safeguards you can show. A promise of encryption or restricted access is a public statement someone can test.

    Wording that works
    We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include [your main safeguards].

    It uses the APP 11 standard, reasonable steps, and then names safeguards you really have, so it promises nothing you cannot evidence.

  7. Why we collect, use and disclose it

    What it must contain

    The purposes you collect, hold, use and disclose personal information for (APP 1.4(c)), when you may use it for another purpose (APP 6), and how to opt out of marketing (APP 7).

    What readers and the OAIC check

    A purpose for every group of people the policy lists, and nothing that reads as a licence to use information for anything.

    Wording that works
    We may also use or disclose it for another purpose that is related to the one we collected it for (directly related, for sensitive information) and that you would reasonably expect, or where the law requires or allows it.

    These are the APP 6 tests in plain words: two separate grounds, either of which is enough, with the stricter test for sensitive information kept.

  8. Who we share it with

    What it must contain

    The kinds of organisations you disclose personal information to and why, naming a provider where it helps the reader.

    What readers and the OAIC check

    Recipients that match your real supplier list, and no recipient you do not use.

  9. Sending information overseas

    What it must contain

    Whether you are likely to disclose personal information to anyone outside Australia and, where practicable, the countries (APP 1.4(f)-(g)). Cloud and software providers that store data overseas count.

    What readers and the OAIC check

    This is where copied policies fail most often: "we do not send information overseas" beside a US-hosted email or accounting platform.

  10. Decisions made using computer programs

    What it must contain

    From 10 December 2026: if a computer program makes, or does something substantially and directly related to making, decisions that could significantly affect people using their personal information, the kinds of information it uses, and the kinds of decisions it makes alone and helps a person make (APP 1.7-1.8).

    What readers and the OAIC check

    Real decisions described in plain categories, with no technical detail, and an accurate account of who makes the final call.

  11. Accessing and correcting your information

    What it must contain

    How to ask for access and correction, that you may confirm identity, your response time, that asking is free and any charge for access is not excessive, and what you do if you refuse (APP 1.4(d), APP 12-13).

    What readers and the OAIC check

    All five correction grounds: inaccurate, out of date, incomplete, irrelevant or misleading.

  12. Making a complaint

    What it must contain

    How to complain about a breach of the APPs and how you deal with complaints (APP 1.4(e)), with the OAIC as the next step if the Act covers you.

    What readers and the OAIC check

    A real contact and a real process. The OAIC cannot take a complaint about a business the Act does not cover, so an exempt business should not send people there.

  13. Contact us

    What it must contain

    A role and real contact details: an email address, phone number and postal address.

    What readers and the OAIC check

    A role rather than a person's name, so the policy survives a staff change.

  14. Changes to this policy

    What it must contain

    That the policy is free to read (APP 1.5), that a copy in another form is available on request (APP 1.6), and that you keep it up to date.

    What readers and the OAIC check

    That the published version still matches what you do today.

Write it plainly and keep it short. A policy someone can read in five minutes, that matches what you actually do, beats a long one that promises more than you can show.

Get it written for your business - your first document is free Card required; no charge today.

Before you start

Does the Privacy Act cover your business?

The Privacy Act 1988 applies to Australian Government agencies and to businesses and not-for-profits with an annual turnover of more than $3 million. Most smaller businesses are exempt - but not all of them. A small business is covered whatever its turnover if, for example, it provides a health service and holds health information, passes on or pays to collect people's personal information without their consent, is a contracted service provider for a Commonwealth contract, or is related to a larger company.

If the Act covers you, APP 1.3 requires a clearly expressed, up-to-date privacy policy, and your customers can take a complaint to the Office of the Australian Information Commissioner (OAIC). If it does not, you can still publish one - customers, app stores, ad platforms and larger clients increasingly expect it - but write it as your own commitment to the Australian Privacy Principles, and do not send people to the OAIC, which cannot take a complaint about a business the Act does not cover. Any small business can also choose to be covered by opting in with the OAIC.

PolicyMint asks this first, and writes the policy for whichever answer is true.

New from 10 December 2026

Automated decisions in your privacy policy

From 10 December 2026, APP 1.7 to 1.9 require a privacy policy to describe computer programs that make, or substantially help make, decisions that could significantly affect people: the kinds of personal information the programs use, the decisions they make on their own, and the decisions where they help a person decide. Screening applications, scoring customers, flagging fraud and setting individual prices are all common examples, and a score that is a key factor in a staff member's decision counts even though a person makes the final call.

The template above includes the section, at number 9. For the three-part test, worked examples, the mistakes to avoid and a stand-alone version to insert into the policy you already have, see the automated decision-making privacy policy template.

Your privacy policy says how you handle personal information; a data breach response plan says what you do when that goes wrong, including when the Notifiable Data Breaches scheme requires you to tell the OAIC and the people affected.

Who reads it

What readers and the OAIC look for

A privacy policy is read by customers deciding whether to trust you, by the platforms and larger clients you work with, and by the OAIC if a complaint reaches it. These are the questions it has to answer, and what answers them.

Can I find it and read it for free?

Satisfies A current version on your website, linked from every page's footer and readable without signing in (APP 1.5).

Fails A PDF behind a login, or a policy that only exists "on request".

Does it describe what you actually do?

Satisfies Every system, recipient and country in it matches your supplier list and your website.

Fails "We never share your information" beside a payment processor and an email platform.

Where does my information go overseas?

Satisfies The likely countries named, including where your cloud providers store data (APP 1.4(g)).

Do computer programs make decisions about me?

Satisfies From 10 December 2026, a section describing them, or a plain statement that you do not use programs that way.

How do I see or fix my information?

Satisfies A role, a contact, a response time, and the five grounds for correction.

Where do I go if you do not resolve my complaint?

Satisfies The OAIC, if the Privacy Act covers you. If it does not, how you resolve complaints yourself.

Fails Sending people to the OAIC when the Act does not cover your business.

What goes wrong

The mistakes that make a privacy policy misleading

Most privacy policy problems are not about writing quality. They are statements that are no longer, or were never, true.

  • Copying another business's policy

    It lists information you do not collect and misses what you do. The OAIC asks for a policy that describes your own practices, and readers can tell when it does not.

  • Promising absolutes

    "We never share", "we only use it for", "nothing leaves Australia". Each is a public statement that can be tested against your suppliers. Say what you do, not what you never do.

  • Calling confidential data "sensitive information"

    Sensitive information is a defined legal term with stricter collection rules. Using it for bank details or ID documents misstates the law and implies consent processes you do not run.

  • Forgetting the cloud

    Email marketing, accounting and CRM platforms often store data overseas. That is overseas disclosure, and the policy has to say where.

  • No automated decisions section by 10 December 2026

    If software scores, ranks or screens people for you, the policy must describe it for decisions made from that date, including by programs you already use.

  • Pointing to the OAIC when you are not covered

    Most businesses with an annual turnover of $3 million or less are exempt from the Privacy Act. Their customers cannot take a complaint about them to the OAIC, so the policy should not send them there.

See the real output

What PolicyMint generates

The cover in the hero and the page below are the template above run through PolicyMint's export path, with an example company's branding applied. Generated for your business, the policy comes back naming the information you really collect, your systems, suppliers and overseas providers, and your privacy contact, built from the requirements of the Privacy Act and the OAIC's guidance and checked against each one before you see it.

A body page of a generated privacy policy, showing numbered clauses written for a specific business with the placeholders resolved.
One page of the generated document, for an example company. The trial produces the whole document, not a sample.

Where the guide says [role] or [system], the document says yours; where PolicyMint cannot know a fact, it asks rather than guesses.

The PolicyMint guided review: a generated scope statement with one highlighted sentence that needs the reader's input, and beside it a review panel explaining what is needed, a field to answer it, and the choice between having the answer written in or inserted exactly as typed.

The one fact this document could not know stays highlighted in the document and the export. The review explains what is needed and writes your answer in. Nothing is invented. Fictional demo data.

Side by side

Writing it yourself vs generating it

The same policy either way. The difference is who traces your systems and suppliers, and who checks the result against the law.

Dimension Writing it yourself from this guide Generating it with PolicyMint
What you end up with A privacy policy in your own words, as accurate as your own audit of your systems The same policy, written from your answers and exported in your branding as Word or PDF
Matches what you actually do You trace every system, supplier and overseas country yourself Asks about each one and writes only what you tell it; anything it does not know is marked for you, never guessed
Covered by the Act, or not You work out whether the small business exemption applies, and word the policy to match Asks first, then writes it for either answer: under the Act, or as your own voluntary commitment with no OAIC route
The 10 December 2026 rules You decide whether APP 1.7 applies to your software and how to describe it Asks whether software makes or helps make decisions about people, and writes the section the law requires
Checked before you use it Your own review Checked against each APP 1 requirement by three independent verifiers on a different AI model, plus a repair pass
Price Your time, and you own every clause afterward A$10.00US$6.50£5.00€6.00 for this document, and your first document is free

Privacy policy template FAQ

The questions people ask

Including who needs one, and what changes on 10 December 2026.

Does my business need a privacy policy?

If the Privacy Act 1988 covers your organisation, yes: APP 1.3 requires every APP entity to have a clearly expressed, up-to-date privacy policy. Most businesses with an annual turnover of $3 million or less are exempt, but a small business is covered if, for example, it provides a health service and holds health information, trades in personal information without consent, or chooses to opt in. Many exempt businesses publish one anyway, because customers, app stores, ad platforms and larger clients expect it.

What must an Australian privacy policy include?

APP 1.4 lists it: the kinds of personal information you collect and hold; how you collect and hold it; why you collect, hold, use and disclose it; how people can access and correct it; how they can complain and how you deal with complaints; and whether you are likely to disclose it overseas and, where practicable, to which countries. From 10 December 2026, APP 1.7 and 1.8 add automated decision-making information where computer programs make, or substantially help make, significant decisions about people.

What changes on 10 December 2026?

From that date, if a computer program makes, or does something substantially and directly related to making, a decision that could reasonably be expected to significantly affect someone's rights or interests, and uses their personal information to do it, your privacy policy must describe the kinds of personal information used and the kinds of decisions made by the program alone or with its help. It applies to decisions made from that date, including by programs you set up before it.

Is this privacy policy template free?

Yes. The complete template is on this page and as an editable Word document, with no sign-up. Replace the placeholders, delete what does not apply, and check every section against what you actually do before you publish it. If you would rather have it written for your business, PolicyMint asks about the information you collect, your systems, suppliers and overseas providers, and writes it; your first document is free, card required, no charge today.

Is a privacy policy template legal advice?

No. This template is a starting point built to APP 1 of the Privacy Act, in plain English. It cannot know your business: whether the Act covers you, which suppliers hold your data and where, or whether software makes decisions about your customers. Those facts decide what your policy has to say.

How much does PolicyMint charge to write a privacy policy?

A privacy policy is one full-length document: A$10.00US$6.50£5.00€6.00 at the list rate, or 25 credits. Signing up grants 25 credits, so your first one is free, card required, with no charge today.

Ready when you are

Publish a privacy policy that matches what you really do

Answer a few questions about the information you collect, your systems and your suppliers. Get a privacy policy written for your business, in your branding, checked against the Privacy Act before you see it.

Write my privacy policy No subscription See pricing

Your first document is on us. We ask for a card when you download it and you are not charged for it, and there is no sales call.