Start by taking the criticism seriously

The standard objection to privacy policy generators runs roughly like this: a tool that asks you eight questions and hands back a finished document cannot know enough about your business to describe it accurately, and a policy that describes a business you do not run gives you a false sense of having dealt with the problem.

That is correct, and it is worth being direct about it. A wrong policy is a worse position than a missing one. A missing policy is an obvious gap. A policy that confidently states you do not send information overseas, when your booking system is hosted in Oregon, is a written statement by your business that is untrue, sitting in public, with your name on it. We see this constantly in the scans we run: policies naming the wrong state, the wrong regulator, services the business does not offer, and in a few cases a different business entirely.

So the question is not "generator or lawyer". It is how many questions does the thing ask, and do they reach the parts that actually differ between businesses. Below are the five gaps the criticism names, in the order they are usually raised.

The five gaps, one at a time

1. The third-party tools nobody disclosed

Almost every small-business website sends visitor information to services the owner has never listed: analytics, a chat widget, an embedded booking tool, a payment provider, a pixel added by whoever ran the last ad campaign. The Australian Privacy Principles expect a policy to say who else receives personal information. Most of them do not, because nobody asked the owner to enumerate it.

What this requires: not one question but a working list. Our questionnaire asks separately about analytics and advertising tools, chat and booking embeds, payment processors, email and CRM platforms, any app or customer portal, and what each one actually receives. The OAIC made tracking pixels an explicit focus in 2026, and a pixel the owner cannot name is a disclosure the policy cannot describe.

2. Personal information that leaves Australia

This is the gap that catches the most businesses by surprise, because it rarely feels like an overseas transfer. Your email is Microsoft or Google. Your website is on a host with servers in Singapore. Your accounting software stores data in the United States. Under APP 8, sending personal information to an overseas recipient is a disclosure, and in most cases your business stays accountable for what that recipient does with it.

What this requires: asking the owner which countries, and which categories of information go there, in language that does not assume they know what a sub-processor is. A generator that asks "do you transfer data internationally?" and accepts "no" has not found out anything, because the honest answer from most owners is "I don't think so."

3. Sensitive information is not just personal information

The Privacy Act treats some categories differently and more strictly: health information, biometrics, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, union membership. Collection generally needs consent, and the policy has to deal with it specifically rather than folding it into a list of "personal details".

What this requires: recognising that a dental practice, a physiotherapist and a disability services provider are all holding health information whether or not they think of themselves as a health service, and that a gym with a fingerprint door reader is collecting biometrics. Our questionnaire asks about each category by name and asks the health-service question separately, because the answer changes five clauses rather than one.

4. How someone complains, and who they can escalate to

A policy has to tell a person how to complain to you, and what happens next if they are not satisfied. Everyone knows to name the OAIC. Far fewer know that for a lot of regulated professions there is a second body the complaint can go to, and that naming it is the difference between a policy that works and a policy that sends a client to the wrong place.

What this requires: an industry question. A mortgage broker's clients can go to the Australian Financial Complaints Authority. A health practitioner's can go to AHPRA or the state health complaints commissioner, which differ by state. A migration agent's can go to the OMARA. This was the most recent gap we closed, after a mortgage broker ran her finished policy past a second opinion and the missing escalation path came back as the first finding.

5. What happens after a data breach

The Notifiable Data Breaches scheme requires some businesses to assess and, in some cases, notify both the OAIC and the affected individuals when a breach is likely to cause serious harm. A policy that says nothing about this says nothing about the single situation in which a customer will go looking for it.

What this requires: a clause that describes the actual process, written before anything has gone wrong. This is also the point at which the rest of the questionnaire earns its keep: a business that cannot say what it holds, where it is and who else has it cannot assess a breach in the thirty days the scheme contemplates.

So what does ours ask?

129 questions, of which around 73 apply to a straightforward business. Questions that do not apply are never shown: a cafe is not asked about credit reporting, and a broker is not asked about health records. The five gaps above account for roughly forty of those questions between them, which is more than most generators ask in total.

That is not a claim that more questions make a document correct. It is the narrower and more useful claim that a policy cannot state anything the questionnaire never asked about, and the five things above are exactly where the short questionnaires stop. If you want to see how far apart the results get, we ran three real Australian business types through the same questionnaire and published the clause-by-clause comparison. The dental practice came out at 50 sections, the mortgage broker at 48 and the cafe at 36, with 34 clauses shared by all three.

What a generator still cannot do

Being precise about this, because it is the part the criticism gets right and it does not go away by asking more questions.

Nobody reads your document. The clause library the AegorIQ generator is built from has been reviewed by an Australian law firm. The policy it writes for you has not been read by anyone, because it is assembled from your answers at the moment you give them. It is only as accurate as those answers, and if you describe your business incorrectly the policy will describe it incorrectly with great confidence.

It is not legal advice, and we are not a law practice. Where something is a legal judgement we say so rather than ruling on it. Whether the Privacy Act applies to your business at all is one of those judgements: businesses under $3 million turnover are generally exempt, with carve-outs that catch health service providers and businesses that trade in personal information, among others.

We recommend having the generated policy reviewed before you publish it. To make that easier we have partnered with an Australian law firm that offers AegorIQ customers a discounted fixed-fee review. You engage them directly, we receive no referral fee, you are not obliged to use them, and we do not pass on your details. The arrangement is described in full on the generator page.

What to ask before you buy any generator, including ours

These are vendor-neutral. If a tool cannot answer them, that is the answer.

  • How many questions does it ask, and how many apply to me? A tool that asks everyone the same twelve questions is a template with a form on the front.
  • Does it ask which countries my information goes to? Not whether, which.
  • Does it ask about sensitive information by category? Health, biometrics and the rest, by name.
  • Does it name an industry complaints body, or only the OAIC?
  • Does it produce a breach-response clause?
  • Is it written for Australian law specifically, or is Australia one option in a dropdown of forty jurisdictions? Several of the best-known international tools do not list Australia among the regimes they support at all, and at least one ranks on Australian searches with sample text referring to social security numbers, which do not exist here.
  • Who has reviewed what? There is a real difference between a reviewed clause library and a reviewed document, and a vendor should be able to say plainly which one it is offering.
  • What happens when my business changes? A policy is a point-in-time statement. Ours can be regenerated free for 30 days; after that the document you downloaded is yours to keep.

Where the regulator leaves you

Worth knowing, because it explains why this market exists at all. The OAIC publishes a guide to developing an APP privacy policy, including a detailed checklist against APP 1.3 to 1.6 with yes/no and comment columns. It is genuinely good and it is free.

What it does not contain is a template, sample text, a recommended tool, or a suggestion to engage a lawyer. The authoritative structure of an Australian privacy policy is public; the filled-in document is available nowhere authoritative. Everything in this market sits in that gap, ours included.

Sources