Does my firm need a privacy policy if we are under the $3 million turnover threshold?

Possibly not across the whole business, but the small business exemption has exceptions, including health service providers and, since 1 July 2026, AML/CTF reporting entities for their AML/CTF-related handling. Many firms also commit to the Privacy Act in client contracts. Check which applies to you before deciding a policy is optional.

Is a privacy policy the same as a collection notice?

No. The policy is the standing document describing how the firm handles personal information generally. A collection notice is given at or before the moment you collect information, such as on a web form, and explains why you are collecting that particular information and what happens to it. Most firms need both.

Can we just use a privacy policy template?

A template is a reasonable starting structure. The problem is that APP 1 asks what your firm actually collects, how it holds it and who it goes to, and a template cannot know that. The OAIC's guidance specifically warns against generic policies. Use the template for headings, then write the content from an audit of what you really do.

The privacy policy that survives an OAIC sweep

What did the OAIC sweep actually look at?

Privacy policies, and nothing else. In January 2026 the OAIC began its first compliance sweep, reviewing around 60 businesses across six sectors: rental and property, chemists and pharmacists, licensed venues, car rental, car dealerships, and pawnbrokers and second-hand dealers. The common thread was businesses that collect personal information from people face to face.

The assessment was against APP 1.4, the list of what a policy must contain. When it announced the sweep, the OAIC said non-compliant policies could attract compliance notices and infringement notices of up to $66,000 each, separate from the larger civil penalties available for serious cases. In May the Privacy Commissioner told an industry audience that the sweep had found instances of non-compliance in a significant proportion of the sixty entities.

Professional-services firms were not on the list. The reason to care anyway is what the sweep represents. The 2024 amendments gave the OAIC infringement notice powers for exactly this kind of breach, and a privacy policy is the one compliance document anyone can read without asking you for it. It's the cheapest thing in the Act for a regulator to check.

What does APP 1.4 require a policy to say?

Six matters. Each one is a question about your actual operations, which is why a template on its own can't answer them.

The kinds of personal information you collect and hold. Names and contact details, yes. Also identity documents, financial records, health information in a personal injury file, tax file numbers, whatever your practice genuinely touches.
How you collect and hold it. Forms, email, phone, meetings, third parties, and where it is stored once you have it.
The purposes you collect, use and disclose it for. Delivering the engagement, meeting legal obligations, billing, marketing if you do it.
How someone can access their information and ask for a correction.
How someone can complain, and how you will handle the complaint.
Whether you are likely to send it overseas, and to which countries where that is practicable to state.

On top of the list, APP 1.3 requires the policy to be clearly expressed and kept up to date, and APP 1.5 requires reasonable steps to make it available free and in an appropriate form. For most firms that means a page on the website that a client can actually find.

Where do small-firm policies usually fall short?

On the second and sixth points, almost always. The policy was written once, usually from a template or by a web developer at launch, and the firm's systems have changed several times since.

Look for these gaps in your own:

It describes collection through "our website" without saying what the website collects or through which forms.
It says nothing about overseas disclosure, while the firm's practice management, email, file storage and form tools are hosted by providers whose data may sit offshore.
It lists purposes that match a generic small business, not a practice that handles client matters under professional obligations.
It names a contact person who left, or an email address nobody monitors.
It has no date, so nobody can tell whether it is current.

None of these are hard to fix. They persist because nobody owns the document, and it only gets reopened when something forces it.

How do website forms change what the policy has to cover?

Every form is a collection point, so each one adds to what the policy must describe. A contact form, a booking tool, a newsletter sign-up, a client intake form and a file upload page are five separate answers to "what do you collect and how".

Forms also bring the overseas question with them. Most form, scheduling and email marketing tools are third-party services, and where they store submissions is set by the provider, not by you. Check each one's current data-hosting terms rather than assuming. Wherever the answer is overseas, or unclear, your policy needs to say so.

A form also needs its own collection notice, which is a separate obligation under APP 5 and is often missing entirely. The policy is the standing document. The notice goes on the form itself, at or before the moment someone presses submit, and says why you want this information and what happens to it. A one-line summary with a link to the full policy is the layered approach the OAIC encourages.

If your firm is also a reporting entity under the AML/CTF Act, the privacy exemption no longer covers your AML/CTF work, and your intake forms are where most of that information arrives.

How do you write one that matches the firm?

Audit first, write second. An afternoon with the person who knows your systems will produce most of what the policy needs:

List every place personal information comes in: each web form, the main inboxes, phone notes, meetings, referrals, third-party verification.
For each one, write down what is collected, which system it lands in, and who can see it.
For each system, find where the provider stores the data. Note the country, or note that you could not confirm it.
List everyone you share information with in the ordinary course: counsel, experts, auditors, outsourced bookkeeping, IT support.
Name who handles access requests and complaints, with an address that someone actually reads.

Only then open the template. Use its headings and write the content from your list. The result is usually shorter and plainer than the template, which is fine. Clearly expressed is a requirement, not a style preference.

Then give the document an owner and a date, and put a review in the calendar for whenever a new system or form goes live. The who-owns-what question applies here too: if a contractor built your forms, make sure you know where the submissions go.

What is coming next?

Automated decisions. From 10 December 2026, APP 1 will also require a policy to disclose where a computer program is used to make, or substantially help make, decisions that could reasonably be expected to significantly affect someone's rights or interests, including the kinds of personal information used and the kinds of decisions involved.

Most small firms do not make decisions like that by program today. The ones automating triage, eligibility screening or pricing should check now, because the policy you write now will need that section before the end of the year.

What to do next

Open your current privacy policy and check it against the six APP 1.4 matters above. Mark each one as accurate, vague or missing.
Run the five-step audit, starting with your website forms, since they are where the policy and reality usually drift furthest apart.
Add a short collection notice to every form that doesn't have one.
Put an owner's name and a review date on the policy, and tie the review to any new system going live.
If you are unsure whether the Act applies to all or part of your firm, get advice on that first. Everything else follows from it.