What Must an Australian Privacy Policy Include Under the Privacy Act?

APP 1 has two distinct parts. APP 1.2 requires you to have and implement practices, procedures, and systems to comply with the APPs — not just to have a policy document, but to actually follow it. APP 1.3 requires the policy to be freely available to anyone without requiring them to pay, register, or provide personal information to access it.

APP 1.4 sets out the specific content. Your privacy policy must include:

1. The kinds of personal information you collect and hold
2. How you collect and hold personal information
3. The purposes for which you collect, hold, use, and disclose personal information
4. How an individual can access and request correction of the personal information you hold about them
5. How to complain about a breach of the APPs, and how you handle complaints
6. Whether you are likely to disclose personal information to overseas recipients, and if so, which countries

A concise, accurate 600–900 word policy is more useful — and more likely to be read — than a 4,000-word document copied from a US template.

APP 1.4 requires the policy to be in "clear and plain language." The OAIC's guidelines specifically identify plain English as a requirement. In practice:

• No undefined legal jargon
• Short sentences and active voice
• Organised with headings so readers can find the section they need
• Written for the reading level of your actual audience

A policy stating "personal data may be utilised in furtherance of our legitimate operational objectives" fails this test. "We use your contact details to respond to your enquiry and process your order" passes it.

The Privacy and Other Legislation Amendment Act 2024 amends APP 1 to require disclosure of any automated decision-making process that makes, or substantially assists in making, a decision with a significant effect on an individual. From 10 December 2026, your privacy policy must describe:

• That you use automated decision-making
• The kinds of personal information used as inputs
• The kinds of decisions made or substantially assisted by the process
• Whether a human reviews the automated output before the decision is acted on

This applies to AI scoring tools, algorithmic approval workflows, automated hiring assessments, and similar systems.

1. About this policy — who you are, what the policy covers
2. What we collect — name, email, phone, payment details, usage data
3. How we collect it — website forms, email, telephone, third-party sources
4. Why we collect it — processing orders, invoicing, providing support
5. Who we share it with — delivery providers, payment processors, cloud services
6. Overseas recipients — if any tools you use are hosted offshore
7. How we keep it secure — brief description of security measures
8. How long we keep it — retention periods for different types of information
9. Your rights — how to access, correct, and complain
10. ADM disclosure — from 10 December 2026, where relevant
11. Contact — your privacy contact email or name

• Copying a US or UK template — the Privacy Act is Commonwealth Australian law; GDPR and CCPA language does not map to the APPs
• No complaint process described — APP 1.4(h) specifically requires this; many templates omit it
• An outdated policy — describing tools you no longer use, or missing services added since your last update
• Inaccessible policy — buried behind a login or only available on request rather than publicly linked
• No mention of overseas transfers — almost every business using cloud services transfers data offshore; if you use Google Workspace, Stripe, or Mailchimp, your policy must say so