Running a business website in Australia comes with a specific set of legal obligations that many small business owners aren't fully aware of. Getting these wrong can expose your business to regulatory action from the OAIC, ACCC, or ACMA. This guide covers the key requirements — though it is general information only and not legal advice. Consult a solicitor for your specific circumstances.
Privacy Act 1988 and the Australian Privacy Principles
The Privacy Act 1988 governs how Australian businesses collect, use, and store personal information. The Australian Privacy Principles (APPs) apply to businesses with an annual turnover of more than AUD $3 million, as well as certain smaller businesses that handle health information or trade in personal data.
For websites, the key obligations include:
- Privacy policy: If you collect personal information (names, emails, phone numbers through contact forms), you must have a clearly accessible privacy policy explaining what you collect, why, how it's stored, and how individuals can access or correct their data.
- Collection notice: At the point of collection (e.g. a contact form), you should notify users what their information will be used for.
- Third-party disclosure: If you share data with third parties (email marketing tools, CRMs, analytics platforms), this must be disclosed in your privacy policy.
- Overseas disclosure: If any third-party tools store data offshore (most SaaS tools do), APP 8 requires you to take reasonable steps to ensure equivalent privacy protection.
ACCC Consumer Law: No Misleading Claims
The Australian Consumer Law (ACL), administered by the ACCC, prohibits misleading or deceptive conduct in trade or commerce. For websites, this means:
- Testimonials and reviews must be genuine and not cherry-picked in a misleading way
- Pricing must be displayed clearly, including all mandatory fees (GST-inclusive pricing is required when displaying prices to consumers)
- Claims about your products or services must be substantiated
- Fake urgency (false countdown timers, fabricated stock scarcity) can constitute misleading conduct
Mandatory Website Disclosures
While Australia doesn't have a single mandatory "website imprint" law like some EU jurisdictions, several disclosures are expected or required depending on your business type:
- Business name and ABN: Required on tax invoices and strongly recommended on business websites for transparency
- Contact information: Physical address and contact details are required for businesses operating under an Australian Financial Services Licence (AFSL) and recommended for all
- Terms and conditions: Particularly important for e-commerce, subscription services, and any site where users agree to something
- Refund policy: Required to be clearly stated under Australian Consumer Law if you sell goods or services online
Spam Act 2003 Compliance
If your website collects email addresses for marketing purposes, the Spam Act 2003 requires that you: obtain explicit consent before sending commercial electronic messages, clearly identify your business as the sender, and provide a functional unsubscribe mechanism in every commercial email. Pre-ticked newsletter opt-in checkboxes are not valid consent under Australian law.
DDA Accessibility
The Disability Discrimination Act 1992 (DDA) applies to websites. The AHRC has published guidance indicating that inaccessible websites may constitute discrimination. While enforcement for small business websites is rare, WCAG 2.1 AA compliance is the practical standard to aim for — this means things like sufficient colour contrast, alt text on images, keyboard navigability, and descriptive link text.
Does my small business need a privacy policy if I have a contact form?
Yes, if your contact form collects personal information (names, emails, phone numbers), you should have a privacy policy even if your turnover is under AUD $3 million. It's good practice and builds customer trust. If you use any third-party services (Google Analytics, Mailchimp, etc.) that process visitor data, disclosing this is particularly important.
Do I need to show GST-inclusive prices on my Australian business website?
Yes — when displaying prices to consumers (not B2B), Australian Consumer Law requires that the total price including GST be prominently displayed. Showing a price and then adding GST at checkout can constitute misleading conduct under the ACL. For B2B pricing pages, it's common to note prices as "ex-GST" but this should be clearly stated.
What accessibility standard applies to Australian business websites?
The practical standard is WCAG 2.1 Level AA. The Australian Government mandates this for government websites, and the DDA creates a general obligation for businesses not to discriminate against people with disabilities — which can extend to websites. For small businesses, the priority is sufficient colour contrast, descriptive image alt text, and keyboard-navigable forms.