The Privacy Act and Enquiry Forms: Collecting Only What You Need

Does the Privacy Act cover your firm?

The Privacy Act's Australian Privacy Principles apply to organisations with an annual turnover above $3 million, and to some smaller businesses regardless of turnover. The OAIC defines a small business as one with an annual turnover of $3 million or less, then lists businesses that are covered regardless of turnover, including health service providers, businesses trading in personal information, contractors providing services under a Commonwealth contract, reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, businesses related to a covered business, and businesses that have opted in ^[1].

One of those categories now reaches many law firms. The OAIC's guidance for reporting entities under the anti-money laundering laws, updated on 28 August 2026, says that from 1 July 2026 obligations apply to certain "designated services" provided by professional service providers such as lawyers and conveyancers, and that "From 1 July 2026, the Privacy Act will also apply to tranche 2 entities" ^[7]. For a small business, that coverage is limited to activities connected with its obligations under the AML/CTF Act; other activities stay outside the Privacy Act unless another reason applies ^[7]. A firm that provides designated services should take this into account when deciding how its privacy policy and forms are written.

If your firm is below the threshold and none of those categories applies, the APPs may not bind it. That is a legal question for the firm to answer for itself. From a website point of view, the practical advice does not change much: clients expect a firm to handle their details carefully, and a short, accurate privacy notice costs little.

The principles most relevant to a form

The OAIC's quick reference summarises the principles ^[2]. Four matter most for a website enquiry form:

APP 8, which deals with steps an entity must take before disclosing personal information overseas, becomes relevant if your form tool or email provider stores data outside Australia ^[2].

What a collection notice should say

Keep it short and put it next to the submit button, with a link to the full policy. A workable notice covers:

• Who is collecting the details (the firm's name)
• Why: to reply to the enquiry and check for conflicts of interest
• Who else may handle them: for example the email provider or practice management system
• Whether they may go overseas
• Where to read the full privacy policy and how to contact the firm about privacy

Sample wording: "We use these details to reply to you and to check that we can act. They are sent to our team by email and stored in our practice management system. See our privacy policy for how we handle personal information and how to contact us."

Keeping confidential details out

A person filling in an enquiry form may not yet be a client, and the firm may act for the other side. Your duty under Rule 9 of the conduct rules concerns information confidential to a client and acquired during the engagement ^[3], and conflicts rules may stop the firm acting if it receives confidential information from a prospective client on the other side. A short prompt solves most of this: "Please give a brief outline only. Do not include confidential details until we have confirmed we can act for you."

Fields to avoid on a first-contact form: date of birth, home address, Medicare or tax file numbers, health details, and free-text boxes inviting a full account of events.

Sensitive information

The Privacy Act gives sensitive information, such as health information and criminal records, extra protection, and APP 3 applies higher standards to collecting it ^[2]. Family, criminal and injury enquiries naturally touch on these topics, which is another reason to keep the first form brief and gather detail at the first appointment, when the firm can explain how it will be handled.

The 2024 reforms and their dates

The Privacy and Other Legislation Amendment Act 2024 made several changes. Their status as at October 2026:

For most firm websites, the automated decision-making change is the one to diary: if any part of your website or intake process makes decisions about people using automated systems in a way that affects them, your privacy policy will need to say so from 10 December 2026 ^[4]. A plain enquiry form that emails your team does not make decisions about anyone.

Security checklist for the form

1. HTTPS on every page, with no mixed content warnings.
2. Messages sent by authenticated email (SMTP with a password), not unauthenticated server mail.
3. No database or file of enquiries kept on the web server unless deliberately secured.
4. Spam controls that do not block people using assistive technology, such as a hidden honeypot field and rate limits rather than puzzles.
5. Two-factor sign-in for everyone who can edit the site or read form settings.
6. A test enquiry each month to confirm delivery.

Analytics and cookies

If your site uses analytics or advertising tags, the privacy policy should say so, and those tags should not capture form contents. Keep third-party scripts off the enquiry page where you can.