If your business turns over more than $3 million a year, or you’re in a covered group such as health services, the Privacy Act applies to your website. Most smaller businesses are exempt, but that doesn’t make their websites safe. Contact forms, booking tools, analytics and plugins all collect personal information, and customers expect you to look after it either way.
Key takeaways
- The Privacy Act covers businesses over $3 million turnover, plus some smaller ones, including health providers, gyms and childcare centres.
- Your website almost certainly collects personal information, often more than you realise.
- Google Analytics’ own terms require a privacy policy, so most sites need one regardless of the Act.
- Recent reforms gave the regulator new powers, and more changes are in draft. The $3 million exemption stays for now.
- Most website leaks come from old form entries, outdated plugins and forgotten logins, and all three are fixable.
Does the Privacy Act apply to my small business?
The starting point is turnover. According to business.gov.au, a business with annual turnover over $3 million must comply with the Privacy Act. Smaller businesses can still be covered if they are:
- private health service providers, which includes complementary therapists, gyms, weight loss clinics, childcare centres and private education providers
- businesses that buy or sell personal information
- contractors providing services under an Australian Government contract
- credit providers or credit reporting bodies
- residential tenancy database operators.
Covered businesses must follow the Australian Privacy Principles (APPs). These set rules for what you collect, how you tell people about it, how you secure it and when you delete it. If you’re close to the line or unsure which group you’re in, check with your accountant or a privacy lawyer.
What personal information does a business website collect?
More than most owners think. Personal information is anything that identifies a person, or could reasonably identify them. On a typical small business website, that includes:
- Contact and quote forms: names, emails, phone numbers and whatever people type in the message box.
- Bookings and enquiries: appointment details, which for a clinic or gym may include health information.
- Online shops: addresses, order history and customer accounts.
- Newsletter sign-ups: email addresses, often synced to a mailing service overseas.
- Analytics and ad pixels: cookies, device details and browsing behaviour, sent to Google, Meta and others.
- Your own admin area: staff names and email addresses on every user account.
Many form plugins also save a copy of every submission in the website’s database. Years of enquiries can pile up there without anyone noticing.
How do small business websites leak data?
In our experience, leaks rarely come from a dramatic attack on a big database. They come from small gaps that build up over time:
- Old form entries. Thousands of stored enquiries sit in the database, ready to be copied if the site is breached.
- Outdated plugins. Patchstack found 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins (Patchstack). Some of those let attackers read data they shouldn’t.
- Pirated software. Nulled plugins often hide code that quietly sends data elsewhere.
- Forgotten accounts. A former employee or developer still has admin access years later.
- Exports left lying around. Customer lists exported to a public folder or a shared inbox and never deleted.
- Too many third-party scripts. Each chat widget, pixel or embed can see what visitors do on the page.
The consequences are real. The OAIC received 1,205 notifiable data breach reports in 2025, the most since the scheme began in 2018, and 59% came from malicious or criminal attacks (OAIC). Our guide to small business cyber security in Australia covers the wider risks beyond your website.
Do I need a privacy policy on my website?
If the Privacy Act covers you, yes. Covered businesses need a clear, up-to-date privacy policy that explains what you collect, why, and how you protect it. Business.gov.au recommends publishing it on your website.
Even if you’re exempt, you probably still need one. Google Analytics’ terms say you must post a privacy policy that discloses your use of cookies and of Google Analytics itself (Google). Payment providers and ad platforms have similar rules.
A good website privacy policy is short and specific. It should name the forms and tools you actually use, say where data is stored (including overseas services) and give a real contact for privacy questions. A template copied from another site rarely matches what your site does.
What changed in the recent Privacy Act reforms?
The first round of reforms became law on 10 December 2024 (MinterEllison). For website owners, the main points are:
- New regulator powers. Since 11 December 2024, the OAIC can issue infringement notices and compliance notices.
- A right to sue. People can take action over serious invasions of privacy, under a new statutory tort that started by June 2025.
- Automated decisions. From 10 December 2026, covered businesses that use automated decisions that significantly affect people must say so in their privacy policy.
A second round is in draft. The Privacy Amendment (Personal Data Protection) Bill 2026 would require data handling to be “fair and reasonable” and set a 72-hour deadline to notify the OAIC of an eligible breach. It leaves the small business exemption unchanged (Sparke Helmore). It’s a draft, so details may change.
How do I stop my website leaking customer data?
- List what you collect. Walk through every form, plugin and script on your site and note what each one collects and where it sends it.
- Collect less. Remove form fields you don’t use. Don’t ask for a date of birth or address unless you need it.
- Clear out old entries. Set your form plugin to delete stored submissions after a set period, or turn storage off if emails are enough. Business.gov.au says you must destroy or de-identify personal information you no longer need.
- Keep everything updated. Update plugins, themes and WordPress promptly, and remove anything you no longer use.
- Tidy up logins. Remove old accounts, give each person their own login and turn on two-factor authentication for admins.
- Host it securely. Choose secure web hosting with a firewall, isolated accounts, free SSL and off-site backups.
- Update your privacy policy. Make it match what your site really does today.
Who keeps watch once it’s fixed?
Privacy isn’t a one-off job. New plugins get added, staff come and go, and new flaws are found every week. Someone needs to check regularly that nothing has changed for the worse.
That’s what website security monitoring is for: daily malware scans, firewall and login protection, and alerts when something looks wrong. If you’re curious about the detail, here’s what 24/7 security monitoring involves behind the scenes. Our website maintenance plans include it with every tier, along with monthly updates and off-site backups.
Frequently asked questions
Is a sole trader covered by the Privacy Act?
Usually not, if turnover is $3 million or less. But a sole trader who provides a health service, such as a complementary therapist or a gym, can be covered regardless of size. Selling or buying personal information also brings you under the Act. If you’re unsure, get advice before you assume you’re exempt.
Is it illegal to have no privacy policy on my website?
For a business covered by the Privacy Act, a clear privacy policy is required. For an exempt business, there’s no general legal requirement. But if you use Google Analytics, its terms require a privacy policy, and many other tools have similar rules. In practice, almost every business website needs one.
Is my contact form storing personal information?
Probably. Many WordPress form plugins save every submission in the website’s database as well as emailing it to you. Check your form plugin’s settings or its entries screen. If you see old enquiries listed, they’re stored on your site and should be cleared out on a schedule.
Will the small business exemption be removed?
Not in the current draft. The second round of reforms, released as a draft Bill in 2026, leaves the $3 million exemption in place. Removing it has been debated for years, so it’s worth watching. Good data habits now mean you’ll be ready either way.
What should I do if my website has been breached?
Contain it first: take the affected part offline, change passwords and call for help. If the Privacy Act covers you, assess the breach quickly and notify the OAIC and affected people if serious harm is likely. Keep notes of what happened and when, because you’ll need them later.
Sources
- Protect your customers’ information, business.gov.au
- State of WordPress Security in 2026, Patchstack
- Data breach notifications increase to all-time high in 2025, OAIC
- Google Analytics Terms of Service, Google
- Privacy and Other Legislation Amendment Act 2024 now in effect, MinterEllison, January 2025
- A new era for privacy in Australia: implications of Privacy Act reform tranche 2, Sparke Helmore, September 2026