Website legal requirements Australia

The Privacy Act 1988 contains 13 Australian Privacy Principles. They apply to most Australian Government agencies and private sector organisations with an annual turnover above $3 million, among others. The Office of the Australian Information Commissioner (OAIC) regulates the Act. Check whether it applies when planning your forms and privacy policy.

From 10 December 2026, changes made by the Privacy and Other Legislation Amendment Act 2024 require covered entities to disclose certain information in their privacy policy if they use personal information in computer programs to make decisions that could reasonably be expected to significantly affect an individual's rights or interests. The policy must disclose the kinds of personal information used and the kinds of decisions made.

All businesses selling goods and services in Australia must comply with the Australian Consumer Law, including businesses based overseas. A store policy or warranty cannot override its consumer guarantees. Make sure your shop policies reflect those guarantees.

Under the Spam Act 2003, you need a customer's permission before sending commercial emails or text messages. Build permission into your marketing forms and remove people who unsubscribe within 5 working days. The Australian Communications and Media Authority (ACMA) enforces the rules.

The Australian Human Rights Commission's Guidelines on equal access to digital goods and services (April 2025), issued under the Disability Discrimination Act 1992, recommend conforming with WCAG 2.2 at a minimum of Level AA. Use that recommendation as a design and testing target for your website or app.

Goods and services tax (GST) in Australia is a tax of 10% on most goods, services and other items sold or consumed in Australia, paid to the Australian Taxation Office (ATO). Configure your checkout to account for GST where it applies.

An Australian business must register for GST when its GST turnover is $75,000 or more, or $150,000 or more for a non-profit organisation. Check your turnover when planning how your shop handles tax.

The Reserve Bank of Australia's Payments System Board decided to remove surcharging on debit, prepaid and credit card payments on the eftpos, Mastercard and Visa networks from 1 October 2026. Account for that decision when setting up card payment surcharges at checkout.

English has no official legal status in Australia, but it is the de facto official and national language. In the 2021 Census, 72% of the population used only English at home. You can use English when planning your site's pages and forms.

The .au namespaces include com.au, net.au and .au direct. auDA (.au Domain Administration) was endorsed by the Australian Government as the administrator of the .au domain in 2000. Consider these namespaces when choosing your site's address.

Plan for data breaches too. Under the Notifiable Data Breaches scheme, an organisation or agency covered by the Privacy Act must notify affected individuals and the OAIC when a data breach is likely to result in serious harm.

• Check whether the Privacy Act applies to your business.
• Review your privacy policy for disclosures about relevant computer-program decisions.
• Make sure your shop policies reflect consumer guarantees.
• Add permission to marketing forms and process unsubscribe requests.
• Use WCAG 2.2 Level AA as a design and testing target.
• Check GST registration and configure your checkout for applicable GST.
• Review card payment surcharges when setting up checkout.
• Choose your site's language and consider an Australian domain namespace.