Practice · 09
Privacy, consumer law and compliance
The rules that apply to how you sell, advertise and hold data. Most businesses find out about them from a complaint.
Privacy, the Australian Consumer Law, marketing rules and the terms a business trades on.
The work
A business that sells to the public is regulated whether it knows it or not. The consumer guarantees apply to every sale. The Spam Act applies to every marketing email. A privacy policy is either accurate or it is a liability. And a set of website terms copied from a competitor in another country tends to say things that are not true here.
The practice writes the documents to fit how the business actually operates: privacy policies and collection notices, website and sales terms, refund and warranty wording that follows the consumer guarantees, marketing consent that holds up. It reviews standard terms against the unfair contract terms rules, advises on advertising and pricing claims before they go out, and drafts the short plan for the day something goes wrong. When a regulator writes, it answers.
A compliance document set is a fixed fee. A one-off review of your existing terms is a smaller one.
This work includes
- Privacy policies and collection notices
- Does the Privacy Act apply to you
- Data breach readiness and response
- Website terms and conditions
- Online sales and subscription terms
- Australian Consumer Law: guarantees, refunds, warranties
- Unfair contract terms review
- Advertising, pricing and misleading conduct
- Email and SMS marketing under the Spam Act
- Direct debit and payment terms
- Industry codes and licensing conditions
How it usually runs
-
A short audit of what you actually do
What data you collect, where it goes, what you promise customers, how you advertise, and what your terms say. Most compliance problems are a gap between the document and the practice, not a missing document.
-
The documents, fitted to the business
A privacy policy that describes what really happens. Terms that match how you sell. A refund policy that follows the consumer guarantees rather than contradicting them. Marketing consent that the Spam Act recognises.
-
A plan for the bad day
Who does what in the first hour after a data breach, a regulator's letter, or a consumer complaint that goes public. Written down, short, and rehearsed once.
Where the line is
- A regulator's court proceedings, and consumer claims that go past a tribunal, move to a litigator on the panel. Tribunal matters, regulator correspondence and negotiated outcomes stay here.
- Financial services, credit and health regulation each have their own licensing regimes. The practice advises on the general law and refers licence-specific questions where needed.
Nobody pays anybody for a referral here, in either direction. How the practice hands work on →
Common questions
-
Does the Privacy Act apply to my small business?
Often not, and sometimes yes when you would least expect it. The general threshold is annual turnover over three million dollars, but health service providers, businesses that trade in personal information, and several other categories are covered regardless of size. Even where the Act does not apply, customers expect a privacy policy and many platforms require one. The practice will tell you which side you are on.
-
Can I say no refunds?
Not as a blanket rule. The Australian Consumer Law gives consumers guarantees that cannot be excluded, and a sign or a term saying no refunds can itself be misleading conduct. What you can do is set out clearly when a change-of-mind return is not offered, and how the guarantees are handled when something is actually faulty. The wording is the whole difference.
-
Are my standard terms caught by the unfair contract terms rules?
If they are a standard form contract with a consumer or a small business, quite possibly. Since late 2023 unfair terms can attract penalties, not just be struck out, which changed the calculation for businesses that had left old terms in place. A review of your standard terms against the unfair terms rules is a fixed-fee job and usually a short one.
-
We had a data breach. What do we do first?
Contain it, then assess it, then decide whether it has to be notified. If the Privacy Act applies and the breach is likely to cause serious harm, notification to the regulator and the affected people is mandatory and the assessment has a time limit. Call before you send anything to customers. The first message is the one that gets quoted back.
Often sits beside this
Make an enquiry
Send a short note about what is happening. You will hear back within one business day, and there is no charge for finding out whether the matter is a fit.