Privacy basics for your website forms in Australia

Every time someone fills in a form on your site, you're collecting personal information. Handling it well builds trust. Here are the basics.

Know whether the Privacy Act applies to you

The Privacy Act 1988 and the 13 Australian Privacy Principles cover businesses with an annual turnover over $3 million, and some smaller businesses too, such as health service providers. The law is being reformed, and the small business exemption is under review. Even if you're exempt today, following the principles is good practice.

Collect only what you need

Ask for the minimum: usually a name, an email and a message. Every extra field is more data to protect and one more reason for people to leave the form.

Tell people what happens to their details

• Have a clear privacy policy on your site
• Add a short note near the form saying why you're collecting the details and how you'll use them
• Link to the policy from the form

Store it safely

Send form entries to a secure system, not a shared inbox anyone can read. Limit who can see them, use multi-factor authentication, and delete what you no longer need.

Ask before you send marketing

Under the Spam Act 2003, you need consent before sending marketing emails, and every message needs a working unsubscribe. A booking enquiry isn't permission to add someone to your newsletter. Use a separate, unticked checkbox.

Have a plan for when things go wrong

Businesses covered by the Privacy Act must report eligible data breaches under the Notifiable Data Breaches scheme. Know who you'd call and what you'd do before you need to.

This is general information, not legal advice. Check the latest guidance at oaic.gov.au or talk to a lawyer about your situation.