Privacy Policy Template for Australian Businesses

What an Australian Privacy Policy Must Include

Australian Privacy Principle 1 (APP 1) requires covered entities to have a clearly expressed, up-to-date privacy policy. Under APP 1.4, the policy must explain:

• The kinds of personal information the business collects and holds.
• How the business collects and holds that information.
• Its purposes for collecting, holding, using and disclosing the information.
• How a person can request access or correction.
• How a person can complain about a breach of the APPs or a binding registered APP code, and how the business handles complaints.
• Whether overseas disclosures are likely and, where practicable, the countries where recipients are located.

Confirm which obligations apply to your business before adapting the clauses. The Office of the Australian Information Commissioner (OAIC) explains that some small businesses are covered. Particular credit-reporting activities can be covered even where a general small-business exemption applies.

The Australian Privacy Principles are the federal starting point for this template. A business’s location in NSW, Queensland or Western Australia doesn’t by itself settle every privacy obligation it has.

Privacy Policy Template

Complete every italic field below using your business’s records. The quoted passages are sample clauses. The notes tell you what to fill in or adapt before the clauses become your policy.

1. Identify the Business and Policy Scope

legal business name trades as trading name. This policy explains how we handle personal information when we provide services covered by this policy.

Our privacy contact is position title. Contact us at email address, by phone on phone number or by post at postal address.

Fill in the legal entity that handles the information. If several entities share the website, explain which entity provides each service. Use contact details the business monitors.

2. Describe the Information You Collect

We collect and hold categories of personal information. We collect this information when you activities that involve collection.

We also collect information from third-party sources, for purposes of those collections.

List the categories you actually handle. A brokerage can need identity documents and contact details, employment records, income and expenses, assets and liabilities. Describe sensitive information separately where you collect it.

Include website information if you collect it, such as enquiry-form responses or browsing records. Explain what your analytics and advertising tools collect. Don’t copy another website’s tracking claims.

3. Explain How You Hold Information

We hold personal information in record systems and storage arrangements. We protect it through high-level safeguards the business uses.

We retain information for retention periods or the criteria used to decide them. Our process for information we no longer need is destruction or de-identification process, subject to legal retention requirements.

Describe actual practices without publishing security details that would help an attacker. Include paper files if you use them. Align retention wording with the records your brokerage must keep.

4. State Your Purposes and Usual Disclosures

We collect, hold, use and disclose personal information to specific business purposes. For those purposes, we disclose relevant information to usual recipient categories and their roles.

For marketing communications, we use information used and the communications sent. You can stop these communications through working opt-out method.

Complete each purpose. Loan assistance, ongoing client service and marketing are different activities. Remove the marketing paragraph if it doesn’t describe your business.

5. Explain Access and Correction

You can ask for access to personal information we hold about you, or ask us to correct it, using the privacy contact details above. We may need to confirm your identity.

We handle requests through request-handling process. If the law permits us to refuse a request, we explain the reason and the available complaint process.

Describe how staff receive and assess requests. Don’t make a particular online form the only route. Add any separate credit-reporting process that applies to the information concerned.

6. Explain Privacy Complaints

If you believe we have mishandled your personal information or breached an applicable privacy obligation, contact our privacy contact. Tell us what happened and how you would like it resolved.

We handle complaints through investigation and response process. If you remain dissatisfied, you can use applicable external complaint bodies and their contact details.

Fill in the response process and relevant timeframes. Identify the applicable binding registered code, if any. Confirm external complaint routes with your compliance adviser, including any dispute resolution scheme relevant to the brokerage.

7. Explain Overseas Recipients

We disclose personal information to overseas recipient categories for purposes. These recipients are located in countries, where practicable to specify.

Use the overseas-provider guidance below to complete this clause. If your business has no likely overseas disclosures, say that accurately. Don’t invent a country list or make a blanket promise from a provider’s Australian billing address.

The OAIC’s privacy policy drafting guide asks businesses to tailor policies to their own activities. Use it to review the completed clauses against your information inventory.

Clauses a Brokerage Adds

A brokerage adds clauses explaining credit information and how client information moves through its lending relationships. Start by identifying your legal role for each activity.

The Privacy Act distinguishes a credit provider from an access seeker authorised by an individual. An agent can also be treated as a credit provider for specified tasks. An Australian credit licence doesn’t by itself answer which privacy role applies.

Credit Information and Reports

We collect credit-related information categories from sources to specific loan-assistance purposes. Where we obtain a credit report on your behalf, we do so through authorised access process.

We use and disclose that information through permitted uses and recipient arrangements. You can request access or correction through applicable process and contact.

Fill in the categories and access route. A brokerage acting as an access seeker needs the individual’s written authority. Explain what happens to the report after access, without implying permission for unrestricted onward sharing.

Where the brokerage is a credit provider subject to section 21B, it needs a credit-reporting policy covering credit information and credit eligibility information. Complete these additional clauses for that role.

We hold kinds of credit eligibility information in storage arrangements. We derive kinds of provider-derived information from credit reports for purposes.

Our access, correction and complaint processes for credit information are applicable processes and contacts. We disclose credit-related information to entities without an Australian link, where likely, in countries, where practicable to specify, for permitted purposes.

Have the adviser assess these clauses against the full section 21B requirements. The credit-reporting policy can be incorporated into the broader policy.

Aggregator and Lender Sharing

We disclose relevant information to aggregator and its role to specific purposes. We disclose information to lender categories or identified lenders when circumstances and purposes of lender disclosure.

Other recipients are service-provider categories or other recipients, which receive information for their specific roles.

Explain who the aggregator is and what it does with client information. Include actual verification and application-support arrangements. Keep a lender’s credit assessment role distinct from the brokerage’s loan-assistance role.

The policy describes usual practices. Use a separate privacy collection notice for the information clients need when you collect their details. A policy link alone doesn’t establish consent to obtain a credit report.

AI Tools and Overseas Providers

Describe the AI tasks that use personal information and the providers that receive it. The OAIC’s commercial AI guidance recommends updating policies and notices to explain AI use.

AI Processing

We use AI tools for approved tasks involving personal information. These tools process information categories to produce outputs. We disclose information to providers or recipient categories for those tasks.

Provider use of that information for model training is actual contractual and account arrangement. Our staff review outputs and the decisions or communications that require review.

Describe what the provider can actually do under your contract and settings. Retain a no-training claim only when it covers the information and account concerned. A policy clause doesn’t authorise a secondary use that the law otherwise restricts.

Overseas Processing

Trace storage and remote access before completing clause 7. Australian hosting doesn’t settle whether overseas support staff or other providers can access the information.

APP 8 guidance distinguishes overseas disclosure from some processing arrangements that remain a use by the business. Where APP 8 applies, assess its requirements separately from the policy wording. Listing countries doesn’t itself satisfy the cross-border obligations.

Automated Decisions

We use kinds of personal information in computer programs that types of decisions made solely by the programs. We also use computer programs to activities directly and substantially supporting specified decisions.

The human involvement in these processes is actual review and decision-making role.

Adapt this clause only to processes your brokerage uses. Distinguish information summaries from programs that make or substantially support decisions affecting a person’s rights or interests.

The additional automated-decision transparency duty applies from its statutory commencement, shown in the OAIC’s official details. From that commencement, qualifying processes require the policy to identify the relevant information and kinds of decisions.

Use the official details to set your compliance deadline. Human involvement doesn’t automatically place a process outside the requirements.

Privacy Policy Generators

A privacy policy generator can organise the answers you supply into clauses. It can’t establish your information flows or resolve the brokerage’s legal role without the underlying facts.

Assess a free privacy policy generator on the questions it asks. A tool that only asks for a trading name and website address won’t capture your credit-report access arrangements. The same gap applies to overseas support access and provider training rights.

Before using generated wording, compare every disclosure claim with a supplier contract or business process. Remove claims about safeguards you don’t use. Ask your compliance adviser to assess the role-specific credit clauses and the completed policy.

Publish and Review the Policy

Publish the approved policy where visitors can find it without logging in, and make it available free of charge. Link it from the website footer and the places where you collect personal information.

Use the policy’s own version record to identify the approved wording. Keep the approved version with your compliance manual and assign a person to maintain it.

Review it when you introduce an AI tool, change a provider’s access or add a new information use. A changed aggregator relationship or overseas recipient can also require an update.

Before publishing, complete this check.

1. Replace every italic field and remove the instructional notes from the business’s policy copy.
2. Trace one typical client file from collection to each recipient. Confirm the policy describes those actual flows.
3. Test the access and complaint contact routes. Confirm someone receives the request and knows the response process.
4. Open the policy as a logged-out visitor. Confirm the full text is readable and a free copy is available when requested.

If the policy promises a control your process doesn’t provide, resolve the mismatch before publishing. The finished policy must describe how your brokerage handles information in practice.