Australian Privacy Policy Template and Generator

This Australian privacy policy template turns your information-handling practices into an editable policy. Complete every section, then copy or download the text for review.

The generator covers a website and the wider business or practice. A published policy must describe what you actually do. It cannot establish that those practices are lawful.

Most businesses with annual turnover above $3 million are covered by the Privacy Act. Many smaller businesses are exempt, but exceptions apply.

Examples include health service providers, businesses trading in personal information and Commonwealth contractors. Reporting entities under anti-money-laundering law also have privacy obligations.

Business type and turnover do not settle every exception. Use the OAIC small-business checklist to assess coverage, including related businesses and voluntary opt-in.

“Load law firm example” inserts fictional particulars for Example Legal Practice. Replace its contacts and every statement about its operations before using the draft.

Australian Privacy Principle 1 requires a clear policy that explains how an organisation manages personal information. Its minimum subjects cover the following information.

• The kinds of personal information collected and held.
• How the organisation collects and holds that information.
• The purposes of collection, holding, use and disclosure.
• How individuals request access and correction.
• How individuals complain about an APP or binding-code breach and how complaints are handled.
• Likely overseas disclosures and recipient countries where practicable.

The OAIC APP 1 guidance explains these subjects and the requirement to make the policy available free of charge.

The law firm privacy policy example adds matter instructions, identity documents and records about other individuals. Its sensitive-information description includes health information and criminal history.

Keep client confidentiality, privilege and collection notices under separate review. A general privacy policy does not give permission to disclose a client’s information.

Describe AI tools that process personal information, including the information involved and its purpose. Explain provider handling and human review according to your actual arrangements.

The OAIC’s commercial AI guidance also addresses transparent privacy policies and collection notices. Naming an AI tool alone leaves its information handling unexplained.

From 10 December 2026, APP 1.7–1.9 require additional disclosures for qualifying computer-assisted or automated decisions. The decision must use personal information and reasonably be expected to significantly affect an individual’s rights or interests.

The policy must identify the information kinds used and distinguish decisions made solely by programs from decisions supported by substantially and directly related computer tasks.

Human review does not automatically remove a decision from scope. Ordinary AI use and the decision-disclosure test are separate questions in this generator.

Use the automated decision-making guide below for the detailed test. Keep the policy’s disclosures consistent with your assessed systems and operations.