By country

Refund Policy Generator Australia

The Privacy Act 1988, thirteen Australian Privacy Principles, and consumer guarantees that no refund policy can override.

Generate your refund policy Read the refund policy guide

In Australia the refund policy is a statement about consumer guarantees first and about your own goodwill second. Getting that order wrong is the specific thing the ACCC penalises.

Australian privacy law is built on the thirteen Australian Privacy Principles in the Privacy Act 1988, supervised by the OAIC. APP 1 is unusual and important: it requires a clearly expressed and up-to-date privacy policy as an obligation in its own right, with prescribed content - not merely as a by-product of transparency duties.

The 2024 reforms began a multi-year expansion. A statutory tort for serious invasions of privacy is now available, transparency obligations for automated decisions that significantly affect individuals are phased in, a Children’s Online Privacy Code is being developed, and the OAIC has gained more direct enforcement powers.

Alongside privacy, Australian Consumer Law imposes consumer guarantees that cannot be contracted out of. A "no refunds" sign is not merely unenforceable - it is itself a breach that the ACCC has repeatedly penalised.

What a refund policy in Australia has to cover

The consumer guarantees: acceptable quality, fitness for purpose, matching description, and the remedy tiers for major and minor failures
That the consumer chooses the remedy for a major failure - refund, replacement or compensation
Any voluntary change-of-mind policy, clearly marked as additional to statutory rights
Proof of purchase requirements, which cannot be limited to a receipt alone
A statement that nothing in the policy excludes, restricts or modifies the consumer guarantees

How Australia actually moves personal data

Overseas disclosure under APP 8

Sending personal information overseas makes you accountable for the recipient’s handling of it unless an exception applies, and APP 1 requires you to list the countries involved where practicable.

Government-related identifiers

Tax file numbers, Medicare numbers and driver licence numbers are restricted under APP 9, and the identity-verification breaches of recent years made this a live enforcement area.

Direct marketing under APP 7

Marketing to individuals requires either their expectation or consent, and every message must offer a simple opt-out - separate from and in addition to Spam Act duties.

Health and sensitive information

Sensitive information requires consent for collection under APP 3, and health service providers are covered by the Privacy Act regardless of turnover.

Automated decision-making

The reforms require privacy policies to disclose the use of automated decisions that significantly affect individuals, with the transparency obligation phasing in ahead of enforcement.

Third parties the draft will ask you about

Stripe · Afterpay · Zip · Australia Post · Xero · AWS ap-southeast-2 · Campaign Monitor · Atlassian · Telstra

The rules that apply

Privacy Act 1988 and the 13 APPs

Applies to businesses with turnover above AUD 3 million and to smaller businesses in specified categories including health service providers and those trading in personal information.

APP 1 - open and transparent management

Requires a clearly expressed, up-to-date and free privacy policy with prescribed content, including overseas disclosure countries.

Notifiable Data Breaches scheme

Eligible data breaches must be assessed within thirty days and notified to the OAIC and affected individuals where serious harm is likely.

Australian Consumer Law

Consumer guarantees on acceptable quality, fitness for purpose and description, which cannot be excluded, restricted or modified.

Spam Act 2003

Consent, sender identification and a functional unsubscribe for commercial electronic messages, enforced by ACMA with substantial penalties.

What the generated refund policy contains

The statutory right, stated separately
Consumer cancellation rights exist whatever your policy says, so they are set out first and your goodwill terms second.
Time limits and how they are counted
When the clock starts, whether it runs in calendar or working days, and what stops it.
Condition and evidence requirements
What state goods must come back in, and what proof of purchase you accept.
Who pays return postage
Split between faulty and change-of-mind returns, because the law treats them differently.
Refund method and timing
Original payment method, and the deadline you commit to once goods or notice are received.
Exclusions, stated lawfully
Perishables, personalised goods, unsealed hygiene items and downloaded digital content - the exclusions the law actually permits.

Meeting APP 1 in practice

Check whether the Privacy Act catches you
Turnover above AUD 3 million, or one of the categories where turnover is irrelevant.
Write the policy to APP 1.4 content list
Kinds of information, how collected and held, purposes, access and correction, complaints, overseas disclosure and countries.
Build the breach assessment runbook
Thirty days to assess, then notification to the OAIC and individuals where serious harm is likely.
Separate marketing consent from privacy consent
APP 7 and the Spam Act need their own records.
Align refund terms with consumer guarantees
State the guarantees first, then any additional voluntary policy.

Where this usually goes wrong

Advertising "no refunds"

Consumer guarantees survive any policy. The ACCC has penalised businesses for signage and terms that misrepresent a consumer’s rights, independently of whether a refund was refused.

Not listing overseas disclosure countries

APP 1.4(f) asks for the countries where recipients are likely to be located. "We may transfer data internationally" does not satisfy it.

Assuming the small-business exemption applies

It does not apply to health service providers, businesses trading in personal information, contracted service providers to the Commonwealth, or those that have opted in.

Treating the Spam Act and APP 7 as one rule

They are separate: the Spam Act governs the message, APP 7 governs the use of personal information for marketing. Compliance with one does not discharge the other.

No breach assessment process

The NDB scheme requires an assessment within thirty days of becoming aware of a suspected eligible breach. Without a procedure, the clock runs unnoticed.

Frequently asked questions

Does the Privacy Act apply to small businesses?

Generally only above AUD 3 million turnover, but there are important exceptions: health service providers, businesses that buy or sell personal information, credit reporting bodies and Commonwealth contractors are covered whatever their size.

Is a privacy policy legally required in Australia?

Yes for APP entities. APP 1.3 requires a clearly expressed and up-to-date policy about the management of personal information, available free of charge and in an appropriate form.

Can I refuse a refund if the customer changed their mind?

Yes - consumer guarantees do not cover change of mind. What you cannot do is state or imply that no refunds are ever available, because that misrepresents the guarantees that do apply to faulty or misdescribed goods.

What is the new privacy tort?

A statutory cause of action for serious invasions of privacy, which lets individuals sue directly rather than relying on an OAIC complaint. It changes the risk profile of intrusive tracking and surveillance practices.

Can I run a no-refunds policy?

Not against statutory rights. In the UK and EU a consumer’s cancellation and faulty-goods rights apply regardless of what your policy says, and advertising "no refunds" is itself treated as a misleading practice.

Do digital products have to be refundable?

The cancellation right can be waived for digital content, but only if the customer gave express consent to immediate delivery and acknowledged losing the right. That acknowledgement has to be captured at checkout, not assumed.

How long do I have to issue a refund?

In the UK and EU, within 14 days of receiving the goods back or of the customer proving they returned them. Card scheme rules and marketplace policies often impose something tighter.