The 15-Minute Win: Write a Simple Privacy Policy for Your Website with AI

Why Most Small Business Websites Are Missing Something Important

Look at the footer of most Australian small business websites. No privacy policy. Not even a basic one.

That’s a problem, because if your website has a contact form, a booking system, an email sign-up, or an online shop, you’re collecting personal information. And customers have every right to know what you’re doing with it.

AI can help you draft a solid privacy policy in about 15 minutes. It won’t replace a lawyer, but it’ll get you 90% of the way there, for free.

Does the Privacy Act Actually Apply to You?

The Privacy Act 1988 technically covers Australian businesses with an annual turnover above $3 million. If you’re under that threshold, you may not be legally required to comply, but there are exceptions. According to the OAIC’s small business guidance, the Act still covers you regardless of turnover if you’re a health service provider, handle tax file numbers, or trade in personal information for benefit.

Even if you’re not technically covered, a privacy policy builds customer trust. It shows you’ve thought about what you collect and why. And it’s something customers increasingly look for before handing over their details.

What a Privacy Policy Needs to Cover

The Office of the Australian Information Commissioner (OAIC) sets out what a proper privacy policy should include under Australian Privacy Principle 1.4. The basics are:

• What personal information you collect (names, emails, phone numbers, payment details)
• Why you’re collecting it and how you use it
• Whether you share it with third parties (think: your email marketing tool, your payment processor, your accountant)
• How you store it and keep it secure
• Whether you send data overseas
• How someone can access, correct, or request deletion of their information
• How to make a complaint

That list looks difficult written out. It’s actually not, most small business policies are one or two pages of plain English.

The 15-Minute Method: Use AI to Draft It

Here’s a prompt you can copy straight into ChatGPT or Claude. Fill in the bracketed parts with your own details before you hit send:

I run a small Australian business called [Business Name]. We collect personal information through [describe how: e.g. a contact form, email newsletter sign-ups, online bookings, online purchases]. We use [list any third-party tools you use: e.g. Mailchimp, Stripe, Calendly, Google Analytics].

Please write a privacy policy for my website that complies with Australian Privacy Principle 1 under the Privacy Act 1988. Write it in plain English, suitable for an Australian small business audience. Include sections on: what information we collect, why we collect it, how we use and store it, whether we share it with third parties, whether any data is sent overseas, how customers can access or correct their information, and how to make a privacy complaint. End with a note that this policy may be updated and a date.

Keep the tone professional but friendly, not legalistic.

That’s it. Hit send and you’ll have a first draft in under a minute.

What to Do With the Draft

Don’t just copy-paste and publish. Run through this checklist first:

• Read the whole thing. AI sometimes adds generic clauses that don’t apply to your business. If it mentions data you don’t collect, remove it.
• Check the third-party tools list. If you use Mailchimp, Stripe, Google Analytics, or any booking system, they’re handling your customers’ data. The policy should name them (or at least name the categories: “payment processors,” “email marketing platforms”).
• Add your contact details. Someone needs to be able to reach you with a privacy question. Include an email address.
• Note if data goes overseas. Most cloud-based tools store data in the US. Mention it, it’s a legal requirement under APP 8 if you’re covered by the Act.
• Add today’s date as the “last updated” date.

Once you’ve reviewed it, add the page to your website footer. Most website builders (WordPress, Squarespace, Wix) have a footer menu where you can link it.

One Thing AI Can’t Do

If you’re in a regulated industry, health, finance, legal, childcare, or you handle sensitive information at scale, get a lawyer to review the draft. The AI output is a starting point, not sign-off. A short legal review from a privacy-aware solicitor costs far less than fixing a complaint after the fact.

For most small businesses with a basic contact form and a mailing list, though, a reviewed AI draft is a perfectly reasonable foundation.

Sources

• OAIC, Small Business and the Privacy Act
• OAIC, Guide to Developing an APP Privacy Policy
• Privacy Act 1988 (Cth), Australian Government

This post is part of The 15-Minute Win series, quick AI wins for Australian small businesses.

More practical guides: How-To Hub →

📊 Compare AI tools side by side | 💼 Free resources & AI prompt packs