Why this page is a measurement and not a template

The honest reason is not that we are withholding a template to sell you something. It is that we read privacy policies for a living, and the single most common defect we find is a policy that belongs to a different business. Wrong state, wrong regulator, services the business does not offer, clauses about overseas data transfers for a business that has none, and occasionally the original business's trading name still sitting in paragraph two.

A borrowed template looks finished, which is precisely what makes it worse than an obvious gap. A missing policy is a gap anyone can see. A policy that confidently describes somebody else is a written, published, inaccurate statement about how your business handles people's information.

So instead of a template, here is the thing a template cannot show you: how much of an Australian privacy policy is actually generic, and how much is not.

Three businesses, one questionnaire

We built three realistic answer sets and ran each through the same 129-question questionnaire and the same 108-clause library. No clause was written for this exercise. These are the documents the generator produces.

50
Dental practice
3,644 words. Holds health records, Medicare numbers and dates of birth. Treats children. Has a fingerprint door reader and a camera.
48
Mortgage broker
3,821 words. Pulls credit reports, runs anti-money-laundering checks, records client meetings, and uses lender software that assesses borrowing capacity.
36
Cafe
2,641 words. Takes card payments, runs guest wi-fi, has a loyalty program and an Instagram account. No health data, no credit checks, no app.

Numbered sections in the finished policy. Across all three, 58 distinct clauses fired from the library of 108.

34 clauses were identical. 24 were not.

Of the 58 distinct clauses used across the three businesses, 34 appeared in all three, 13 appeared in exactly two, and 11 appeared in only one. That 34 is the honest answer to how much of a privacy policy is boilerplate, and it is a real answer: it is roughly 59 per cent of the clauses, and considerably less than that by word count, because the shared clauses are mostly the short ones.

The 34 all three shared are the structural spine every Australian policy needs: who we are and how to contact us, what we collect, how it reaches us, why we collect it, who else we share it with, when the law requires disclosure, sending information overseas, how long we keep it, how to see and correct it, how to make a complaint, cookies, changes to this policy. A template can do this part. This part is also the part nobody gets wrong.

What only the dental practice got

  • Sensitive information and health information, as two separate clauses, because the Privacy Act treats health information as a category with its own collection standard.
  • Fingerprint and face recognition entry. Biometric information is sensitive information, and a door reader collects it.
  • Photographs and video of identifiable people.
  • Children's information, including who may consent on a child's behalf.

What only the mortgage broker got

  • Anti-money-laundering checks, as two clauses: the checks themselves, and the separate retention period that applies to those records.
  • Decisions made or assisted by software. This is the new APP 1.7 disclosure, commencing 10 December 2026, triggered here by lender serviceability calculators.
  • Recorded and transcribed meetings, and separately AI tools.
  • A clause stating that credit reporting is not covered by this policy, because Part IIIA of the Privacy Act requires a separate credit reporting policy. A broker who publishes one document and thinks the job is done has missed a second obligation entirely.

What only the cafe got

Nothing. Not one clause. And this is the finding worth sitting with, because it is the mechanism by which templates cause harm.

The cafe's 36 clauses were every one of them already inside the dental practice's 52. The cafe policy is not a different shape of policy. It is a smaller one.

A template written for "a small Australian business" is, in practice, a cafe-shaped policy: the common spine, plus payments, plus cameras. Hand it to the dental practice and it is not subtly wrong. It is missing sensitive information, health information, biometrics, photographs and children's information, which are the exact five clauses that practice needs more than any other business on this page. The template is most confident precisely where it is least adequate.

So read the actual sections

"Show me a sample first" is a reasonable thing to want, and a single finished policy is a poor way to answer it: one business's document tells a cafe owner nothing about which parts apply to a cafe. What is useful is the same section written three ways, because that is where you can see the questionnaire doing its work.

So that is what is below. Every section either business got, in all three versions, with the ones they did not get marked and explained. It is real output from the live generator, not a mock-up of one.

What the regulator publishes, and what it does not

The OAIC publishes a guide to developing an APP privacy policy. It is free, it is authoritative, and it includes a line-by-line checklist against APP 1.3 to 1.6 with yes, no and comment columns. If you are drafting your own, start there rather than with anything you find on a template site.

What it does not include is a template, sample text, or a recommended tool. The structure is public. The filled-in document is available nowhere authoritative. Every free template you will find online was written by a commercial publisher, often for a different country's law. Several of the best-known international generators do not list Australia among the regimes they support, and at least one that ranks on Australian template searches offers sample text referring to social security numbers, which Australia does not have.

If you are going to write it yourself

Entirely reasonable, and cheaper than anything on this site. Work through the OAIC checklist, and then make sure you have honestly answered these, because they are where the three policies above diverged:

  • Which countries does personal information go to? Not whether. Which. Your email, your website host, your accounting software and your booking tool are four separate answers.
  • Do you hold sensitive information? Health, biometrics, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, union membership. Checked by category, not by impression.
  • Who can a complaint be escalated to besides you and the OAIC? For regulated professions there is usually a second body, and it is often the one a client will actually use.
  • What will you do if there is a data breach? Written before anything happens, not after.
  • Does software make or substantially help make decisions about people? From 10 December 2026 that needs disclosing under APP 1.7.
  • Do you need a second document? Credit reporting, employee records and tax file numbers each sit under their own rules.

Then have a lawyer look at it. That advice applies equally to a policy you wrote yourself and one a generator wrote for you, and we say the same thing about ours: no lawyer has read your particular document, so have it reviewed before you publish it.

Sources and method