If the Privacy Act 1988 applies to your business, your website forms need to do a few things: tell people why you’re collecting their details and what you’ll do with them, ask only for what you need, send and store submissions securely, and delete them once you no longer need them. Most of this is set out in the 13 Australian Privacy Principles (APPs), and most of the fixes on a typical small business website are small, technical changes rather than big projects.
This article explains what the rules are about and what to look at on your site. It isn’t legal advice. Whether and how the Act applies to you depends on your business, so confirm the details with an adviser or the Office of the Australian Information Commissioner’s (OAIC) own guidance.
Does the Privacy Act apply to my small business?
Maybe. The Act generally covers businesses with an annual turnover above $3 million, and there is a small business exemption below that. The exemption has exceptions, though. Health service providers, businesses that trade in personal information, and some others are covered regardless of turnover. Some businesses also opt in, or are required to comply by a contract with a larger client or a government agency.
So the exemption may apply to you, but check with an adviser rather than assuming. And even if you are exempt today, the checks below are good practice. Customers expect them, and they make a data breach far less damaging if one ever happens.
What changed with the 2024 reforms?
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. It was the first tranche of a larger reform programme. Among other things, it gave the OAIC more enforcement options, including tiered civil penalties and infringement notices, and it clarified that the “reasonable steps” a business must take to protect personal information include technical and organisational measures.
It also created a statutory tort for serious invasions of privacy, which commenced in June 2025, and new transparency requirements for privacy policies where computers are used to make decisions that significantly affect people. Those automated-decision requirements start on 10 December 2026. Further reforms have been proposed and consulted on, so keep an eye on the OAIC and the Attorney-General’s Department for anything that affects you.
For a website owner, the practical takeaway is simple: vague security is harder to defend than it used to be. “We have a form plugin” is not a plan.
Does every form need a collection notice?
APP 5 requires you to take reasonable steps to tell people certain things when you collect their personal information: who you are, why you’re collecting it, who you usually share it with, and how they can access or correct it. On a website, this is usually a short collection notice placed right next to the submit button, plus a link to your full privacy policy.
A good collection notice is one or two plain sentences. Something like: “We’ll use these details to reply to your enquiry and send a quote. We store them in our CRM and don’t sell them. See our privacy policy.” It should be specific to that form. A booking form that passes details to a third-party scheduling tool should say so.
While you’re there, open the privacy policy itself. Check it names the tools you actually use today, not the ones you used when the site was built.
Are you collecting more than you need?
APP 3 says you should only collect personal information that is reasonably necessary for what you do. Forms tend to grow fields over the years, and nobody removes them. Go through each form and ask, for every field, “what do we do with this?”
- Date of birth on a general enquiry form is rarely needed.
- A full street address isn’t needed until you’re actually quoting a job at that address. A suburb or postcode often does the job first.
- Free-text boxes invite people to type things you never wanted, such as health details or card numbers. A short hint like “please don’t include payment or medical details” helps.
- File uploads should be limited to the types and sizes you genuinely need.
- Make optional fields clearly optional, and remove fields nobody reads.
Less data collected is less data to protect, store and eventually delete. It also tends to make forms shorter, which people prefer to fill in.
Is it safe to receive form submissions by email?
For a simple “call me back” enquiry, an email notification is usually fine. For anything sensitive, it’s worth rethinking. Under the Privacy Act, sensitive information includes health information, racial or ethnic origin, religious beliefs, sexual orientation and criminal records, among other categories, and it carries stricter rules.
Email copies end up in many places: the inbox, sent folders, phones, backups and forwarding rules nobody remembers setting up. A safer pattern is for the form to store the full submission somewhere with proper access control, such as your CRM or a secure form tool, and send an email that only says “new enquiry received” with a link. Staff then log in to read it. We cover the plumbing for this in connecting your website forms to your CRM.
What about spam and bots?
Spam is a privacy issue as well as an annoyance. Bots that flood a form can bury real enquiries, and some use forms to send junk to your customers through auto-reply emails. Protection should be in place, but it should be the kind that doesn’t lock out real people. Hidden honeypot fields, rate limiting and modern low-friction checks such as Cloudflare Turnstile or reCAPTCHA are common options, though each has its own data-handling terms you should read.
If your form has gone quiet, it may be the opposite problem. Our guide to checking whether your contact form is delivering walks through testing it properly.
Where are submissions stored, and for how long?
APP 11 requires reasonable steps to protect personal information from misuse, loss and unauthorised access, and to destroy or de-identify it once you no longer need it. On a website, submissions often live in more places than the owner realises: the form plugin’s database table, the email inbox, a spreadsheet integration, the CRM and the hosting backups.
- List every place each form sends or stores data.
- Check the site and every connected tool uses HTTPS, two-factor authentication and named user accounts, not one shared login.
- Remove access for staff, contractors and former developers who no longer need it.
- Set a retention period for each form and switch on automatic deletion where your tools allow it.
- Delete old entries sitting in the form plugin once they’re safely in your CRM.
- Check where your tools store data, especially any overseas services, as APP 8 covers cross-border disclosure.
- Know who to call, and what to do, if a breach happens. The Notifiable Data Breaches scheme may require you to notify the OAIC and affected people.
Access is part of security too. When you bring in a developer, invite them to the accounts they need rather than sharing passwords. Our article on giving a developer access without sending your passwords explains how.
If you only do three things
Add a short, accurate collection notice to every form. Remove the fields you don’t use. Stop sending sensitive details by email and store submissions somewhere with proper access control and a deletion date. Then confirm with an adviser whether the Act applies to you and whether anything else is needed.
Tidying up form fields, notices, spam protection and where submissions go is usually a small, defined job. It fits within our bug fixes work, or our API integrations service if submissions need to go to a CRM securely. From $250 for a defined fix. Most bug jobs land between $250 and $1,200.
