Privacy Policy Template for Online Stores in Australia

A privacy policy template for an Australian online store starts with a map of customer data, then explains each collection, use and disclosure. Adapt the examples below to your store’s actual practices before publishing them. A copied policy can promise protections your apps don’t provide.

This template is general information. Have a lawyer review your final policy, including your store’s coverage under privacy law and any overseas sales requirements.

Map the Data Your Store Collects

List every app that receives customer data before writing your policy. Include apps installed by marketing staff, payment integrations and services that receive information through another vendor.

1. Walk through your store as a guest and a signed-in customer. Record each form, tracking tool and customer interaction.
2. Complete the worksheet below with the actual fields your store collects. Delete rows for functions you don’t use and add any missing sources.
3. For every row, record the receiving app, purpose, storage location, overseas access and retention period. Include backup copies and support access.
4. Ask each app owner to confirm its settings and contract. Your completed worksheet must explain where each field goes and why it is needed.

Source	Information to look for	Receiving services to record
Checkout	Name, delivery address, email, phone, order and payment details	Store platform, payment processor, fraud tool and fulfilment service
Customer accounts	Login details, purchase history, first name and loyalty tier	Store platform and loyalty app
Newsletters	Email address, subscription preferences and campaign activity	Email platform and connected marketing tools
Reviews	Display name, review text, photos and order verification	Review provider and moderation tools
Chat	Messages, product clicks, account context and order requests	Chat provider, AI model providers and support tools
Analytics	Device details, identifiers, visited pages and events	Analytics services and reporting apps
Advertising pixels	Browsing events, customer identifiers and purchase events	Advertising platforms and audience tools

Separate payment information your processor receives from information your store retains. Describe uploaded photos and sensitive information separately if your store collects them.

Clauses Your Policy Must Include

For a covered store, Australian Privacy Principle (APP) 1 requires a clearly expressed, current policy about personal information. The clause list below follows the Office of the Australian Information Commissioner’s policy guide and APP 1 requirements. Extra detail must reflect what your store actually does.

The Privacy Act generally covers businesses with annual turnover above $3 million. Businesses at or below that threshold can still be covered. Examples include health service providers, businesses trading in personal information, certain Commonwealth contractors and businesses related to a covered business. Voluntary opt-in also creates obligations. Use the OAIC small-business checklist to assess your circumstances, then read the guide to Privacy Act coverage for the wider rules.

A Western Australian private retailer generally uses the same federal policy structure as retailers elsewhere. WA’s privacy framework covers its public sector and some contracted service providers. If your store delivers services under a WA government contract, have your lawyer assess that arrangement separately.

The examples below describe a hypothetical store. Keep a statement only when your data map and operating procedures support it. Add your legal entity name, trading name and privacy contact details at the start.

Information we collect

Name the categories of personal information collected, including information from third parties and any sensitive information.

We collect your contact details, delivery address, order details and messages you send us. If you create an account, we also hold your purchase history and account preferences.

How we collect it

Describe direct collection and automatic tracking. Identify indirect sources that customers might not expect.

We collect information when you place an order, create an account, subscribe to emails or contact us. Our analytics tools collect device identifiers and browsing events when you use our website.

Why we use and share it

Cover the purposes of collection, holding, use and disclosure. Distinguish order fulfilment from advertising and explain the choices available.

We use your details to process payments, deliver orders and answer your questions. We use subscription details to send requested marketing emails. You can unsubscribe through the link in each marketing email.

Storage and security

Explain how you hold information and protect it without promising perfect security. Include retention and disposal practices that your store can carry out.

We hold customer records in our store platform and the service providers described below. Staff access is restricted according to their duties. We delete or de-identify information we no longer need, unless retention is required by law.

Replace general retention wording with your actual periods or criteria where customers need that detail. Don’t claim encryption or an Australian storage location without supporting vendor information.

Overseas disclosure

State whether overseas disclosure is likely. Name likely recipient countries where practicable, including access by overseas support teams.

Some service providers receive personal information outside Australia. Our email service processes subscription information in [recipient countries]. Payment information goes to our payment provider in [recipient countries].

Complete each country field from your vendor records. A statement that providers operate worldwide gives customers little information about their data.

Access and correction

Explain how a person requests access or correction and how you handle the request. Supply working contact details.

Contact our privacy contact to request access to personal information we hold about you or ask us to correct it. We will confirm your identity before providing account information.

Add your response process and any lawful access charges or refusal grounds. Avoid imposing one request format as the only way a person can exercise their rights.

Complaints

Explain how to complain about a breach of the APPs or a binding APP code, then describe your complaint-handling process.

Send privacy complaints to our privacy contact with details of what happened. We will acknowledge your complaint, investigate it and explain our response. If you remain dissatisfied, you can contact the OAIC.

Add the contact details and response periods your team uses. Make the policy available free of charge and provide other formats where reasonably required.

Keep refund rights and purchase terms in their own documents. Use the returns policy template for that separate wording.

Disclosing Apps, AI Tools and Overseas Transfers

Describe third parties by their jobs and explain what information each category receives. Payment processors, delivery providers, email platforms, analytics services and AI assistants handle different information for different reasons.

Your policy can name categories, then identify vendors where that helps customers understand a disclosure. Record hosting countries, subprocessors and overseas support access. An Australian vendor address does not establish Australian-only processing.

The Department of Industry’s AI Ethics Principles recommend telling people when they interact with AI. Identify the assistant in the chat interface as well as explaining its data use in the policy. These voluntary principles are separate from legal disclosure duties.

Adapt this clause to a shopping assistant that receives the listed information. The bracketed fields are for the retailer to complete before publishing its policy.

We use [vendor name] to provide an AI shopping assistant. It processes chat messages and product clicks to answer questions and suggest products. For signed-in customers, we provide their first name and loyalty tier for personalisation. When you request order help, it processes the order details needed for that request. This information is processed in [hosting and recipient countries]. We retain chat records for [retention period or criteria].

Add the vendor’s actual rules for model training and secondary use. Include uploaded images if those features are enabled. State whether the assistant recommends actions, makes decisions itself or passes requests to staff.

For an assistant limited to recommendations and staff referrals, this sentence can fit:

The assistant recommends products and forwards order requests to our staff. It does not decide whether to cancel an order or approve a refund.

Use that sentence only when it matches your configuration. If software makes those decisions, describe that process in the next clause.

Disclosing Automated Decision Making

Automated decision making uses software to make a decision or perform a step that informs it. Simple product recommendations and decisions about refund eligibility can have different effects on customers.

The 2024 amendments introduce an APP 1 transparency duty for covered entities using personal information in qualifying computer-assisted decisions. It applies where a decision could reasonably be expected to significantly affect a person’s rights or interests. A staff member’s involvement does not automatically remove the duty.

The obligation commences at the boundary specified in the OAIC’s automated decision-making guidance. Use that official commencement information when scheduling your policy update. This duty is already enacted and is separate from the proposed tranche 2 changes.

Describe the kinds of personal information used and the kinds of decisions made solely by software. Also identify decisions where software performs a substantially and directly related step.

For a hypothetical store with staff-reviewed fraud screening, use wording along these lines:

Our fraud-screening software uses order details, payment information, device identifiers and purchase history to assess suspicious orders. It produces a risk result that our staff use when deciding whether to accept or cancel an order.

For a hypothetical store that lets software decide cancellations and refund eligibility:

Our software uses order details, payment status and return history to decide whether to cancel an order or approve a refund request. These decisions are made automatically. Contact our customer service team to request a staff review.

Only promise staff review if you provide it. Explain the actual decision categories and information used, and have your lawyer assess whether the legal impact threshold is met. A disclosure does not authorise an unlawful cancellation or limit consumer guarantees.

Collection Notices at Checkout and Sign-Up

A privacy policy explains your overall handling of personal information. A collection notice explains a particular collection when it happens. A footer policy link alone might not notify someone adequately.

Under APP 5 notification guidance, covered stores must take reasonable steps to notify people or ensure they know the relevant collection matters. Put notices beside the forms, before collection where practicable.

For a hypothetical checkout, adapt this notice:

[store legal name] collects your contact, delivery and order details to process your purchase. We share the required details with payment and delivery providers. Without them, we cannot complete delivery. Our privacy policy explains overseas recipients, access and correction requests and complaints. Contact us at [privacy contact details].

Add likely recipient countries where practicable and any relevant legally required collection. Link the words “privacy policy” to your complete policy in your checkout.

For a newsletter form:

[store legal name] collects your email address to send the newsletter you request. Our email provider processes subscription data in [recipient countries]. You can unsubscribe through any newsletter. Our privacy policy explains access, correction and complaints. Contact us at [privacy contact details].

Keep optional newsletter consent separate from the information needed to fulfil an order. Test the form: a customer must be able to understand the collection before submitting it.

Privacy Act Tranche 2 Reforms

The Attorney-General’s Department describes the second reform package as exposure-draft legislation that remains subject to further government consideration. Its consultation hub distinguishes proposals from enacted requirements.

The proposed fair and reasonable test would assess collection, use and disclosure of personal information. Stronger consent standards and changes to notices are also proposed. Your existing APP obligations continue while these proposals remain under consideration.

Removal of the small-business exemption was agreed in principle in the government’s response to the Privacy Act Review. That position does not itself remove the exemption. The 2026 consultation paper does not list its wholesale removal as a measure in this package.

If further legislation passes, review the following parts of your policy and processes first:

• Reassess coverage if the small-business rules change.
• Revisit the information collected and its purposes against any new fair and reasonable test.
• Update marketing consent and collection notices against the final notification rules.
• Review app disclosures, overseas processing and retention against changes to definitions and provider obligations.

Read the final law and commencement provisions before describing a proposed requirement as mandatory. Changing policy wording alone cannot correct a data practice that fails a new rule.

Keeping the Policy Current

Review the policy whenever you add an app or change how customer data is handled, and at least yearly. Put an effective or last-reviewed date at the top of your store’s policy.

Before each review, consult the OAIC privacy guidance and the Attorney-General’s Department privacy information. Compare enacted changes with your data map and update affected notices too.

Finish with a practical check. Run a test purchase, newsletter signup and chat request, then compare the fields and receiving apps with your policy. If an app receives data the policy never describes, correct the map and wording before publishing. Your lawyer’s final review must use that same map.