Do You Actually Need a Privacy Policy? A Small Business Guide

Plenty of small business owners have a website with a contact form, a mailing list or an online booking system, and no privacy policy at all. Some of them are fine, and some aren't. Whether you need one isn't a matter of opinion. It depends on how the Privacy Act 1988 applies to your business, and that has a few more twists than most people expect.

This guide walks through the questions to ask yourself. It's general information, not legal advice, and we'll point out where it's worth checking with a professional.

Step 1: Check the turnover test

The Privacy Act includes an exemption for small businesses with an annual turnover of $3 million or less. The Office of the Australian Information Commissioner (OAIC) says turnover means all income from all sources, and it doesn't count assets or capital gains. If your business is under that line, the Act may not apply to you. But that is only the first question, not the last.

Step 2: Check the exceptions

Some small businesses have to comply with the Privacy Act whatever their turnover. According to the OAIC's small business guidance, these include businesses that provide health services, businesses that trade in personal information, contractors providing services to the Australian Government, credit reporting businesses, residential tenancy database operators, businesses that handle tax file numbers, reporting entities under the AML/CTF Act, and small businesses related to a larger body corporate. If any of these sound like you, assume you're covered and get proper advice.

Step 3: Understand where the law is heading

At the time of writing in September 2026, the small business exemption is still in force. The government has agreed in principle to remove it, but as far as we can tell no bill has passed and there is no start date. You may see websites quoting specific dates for when small businesses will be caught. Treat those as commentary, not law, and check the OAIC for the current position. It's worth planning for the change though, since a business that already knows what personal information it collects is much better placed if the rules shift.

Step 4: Think about why you might want one anyway

Even if you're exempt, a privacy policy is often still useful. Many platforms and services ask for a link to one, for example when you run lead forms on social media, use some advertising tools, publish an app or take online payments. Customers also notice when it's missing, especially if you're asking for their details. A short, honest policy is a small signal that you handle information carefully.

Step 5: Work out what you actually collect

Before generating anything, list what personal information your business collects and why: names and emails from your contact form, phone numbers from bookings, payment details handled by a third party, website analytics, and anything else. Note where it's stored and who else sees it, like your email provider or booking software. A privacy policy is only accurate if it describes what you really do.

Step 6: Generate a draft, then make it match reality

BeesoftAI's Privacy Policy generator can draft a policy for your website using the details from step five. It's one of BeesoftAI's Pro tools, so it's included from the Pro plan up rather than the free tier, and a run costs 30 tokens. Treat the result as a starting point, then read it carefully and remove or change anything that doesn't match what your business really does. A policy promising things you don't do is worse than a plain one that's accurate.

Step 7: Publish it, link it, and keep it current

Put the policy on its own page, link it from your website footer and anywhere you collect personal details, and set a reminder to review it once a year or whenever you change how you handle information, such as adding a new tool or service.

The honest bit

A generated privacy policy is a template, not legal advice. If you're in one of the exception categories, handle sensitive information such as health details, or aren't sure whether the Privacy Act covers you, speak to a solicitor or a privacy professional before relying on any draft. The rules are also changing, so check current guidance at the OAIC rather than relying on this article alone.

For many small businesses though, understanding what you collect and having a plain, accurate policy is a sensible and fairly quick job, and it puts you in a better position whichever way the rules go.