By country

Terms & Conditions Generator Australia

The Privacy Act 1988, thirteen Australian Privacy Principles, and consumer guarantees that no refund policy can override.

Generate your terms and conditions Read the terms and conditions guide

Australian terms are constrained by consumer guarantees and by the unfair contract terms regime, which since November 2023 carries civil penalties rather than mere unenforceability. A clause that is merely aggressive is now potentially expensive.

Australian privacy law is built on the thirteen Australian Privacy Principles in the Privacy Act 1988, supervised by the OAIC. APP 1 is unusual and important: it requires a clearly expressed and up-to-date privacy policy as an obligation in its own right, with prescribed content - not merely as a by-product of transparency duties.

The 2024 reforms began a multi-year expansion. A statutory tort for serious invasions of privacy is now available, transparency obligations for automated decisions that significantly affect individuals are phased in, a Children’s Online Privacy Code is being developed, and the OAIC has gained more direct enforcement powers.

Alongside privacy, Australian Consumer Law imposes consumer guarantees that cannot be contracted out of. A "no refunds" sign is not merely unenforceable - it is itself a breach that the ACCC has repeatedly penalised.

What a terms and conditions in Australia has to cover

Consumer guarantees stated as non-excludable, with the mandatory ACL wording where you limit liability for other supplies
Unfair contract terms review of unilateral variation, automatic renewal and termination clauses
Clear pricing including a single total price where you advertise components
Dispute resolution and the applicable state or territory jurisdiction

How Australia actually moves personal data

Overseas disclosure under APP 8

Sending personal information overseas makes you accountable for the recipient’s handling of it unless an exception applies, and APP 1 requires you to list the countries involved where practicable.

Government-related identifiers

Tax file numbers, Medicare numbers and driver licence numbers are restricted under APP 9, and the identity-verification breaches of recent years made this a live enforcement area.

Direct marketing under APP 7

Marketing to individuals requires either their expectation or consent, and every message must offer a simple opt-out - separate from and in addition to Spam Act duties.

Health and sensitive information

Sensitive information requires consent for collection under APP 3, and health service providers are covered by the Privacy Act regardless of turnover.

Automated decision-making

The reforms require privacy policies to disclose the use of automated decisions that significantly affect individuals, with the transparency obligation phasing in ahead of enforcement.

Third parties the draft will ask you about

Stripe · Afterpay · Zip · Australia Post · Xero · AWS ap-southeast-2 · Campaign Monitor · Atlassian · Telstra

The rules that apply

Privacy Act 1988 and the 13 APPs

Applies to businesses with turnover above AUD 3 million and to smaller businesses in specified categories including health service providers and those trading in personal information.

APP 1 - open and transparent management

Requires a clearly expressed, up-to-date and free privacy policy with prescribed content, including overseas disclosure countries.

Notifiable Data Breaches scheme

Eligible data breaches must be assessed within thirty days and notified to the OAIC and affected individuals where serious harm is likely.

Australian Consumer Law

Consumer guarantees on acceptable quality, fitness for purpose and description, which cannot be excluded, restricted or modified.

Spam Act 2003

Consent, sender identification and a functional unsubscribe for commercial electronic messages, enforced by ACMA with substantial penalties.

What the generated terms and conditions contains

Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.

Meeting APP 1 in practice

Check whether the Privacy Act catches you
Turnover above AUD 3 million, or one of the categories where turnover is irrelevant.
Write the policy to APP 1.4 content list
Kinds of information, how collected and held, purposes, access and correction, complaints, overseas disclosure and countries.
Build the breach assessment runbook
Thirty days to assess, then notification to the OAIC and individuals where serious harm is likely.
Separate marketing consent from privacy consent
APP 7 and the Spam Act need their own records.
Align refund terms with consumer guarantees
State the guarantees first, then any additional voluntary policy.

Where this usually goes wrong

Advertising "no refunds"

Consumer guarantees survive any policy. The ACCC has penalised businesses for signage and terms that misrepresent a consumer’s rights, independently of whether a refund was refused.

Not listing overseas disclosure countries

APP 1.4(f) asks for the countries where recipients are likely to be located. "We may transfer data internationally" does not satisfy it.

Assuming the small-business exemption applies

It does not apply to health service providers, businesses trading in personal information, contracted service providers to the Commonwealth, or those that have opted in.

Treating the Spam Act and APP 7 as one rule

They are separate: the Spam Act governs the message, APP 7 governs the use of personal information for marketing. Compliance with one does not discharge the other.

No breach assessment process

The NDB scheme requires an assessment within thirty days of becoming aware of a suspected eligible breach. Without a procedure, the clock runs unnoticed.

Frequently asked questions

Does the Privacy Act apply to small businesses?

Generally only above AUD 3 million turnover, but there are important exceptions: health service providers, businesses that buy or sell personal information, credit reporting bodies and Commonwealth contractors are covered whatever their size.

Is a privacy policy legally required in Australia?

Yes for APP entities. APP 1.3 requires a clearly expressed and up-to-date policy about the management of personal information, available free of charge and in an appropriate form.

Can I refuse a refund if the customer changed their mind?

Yes - consumer guarantees do not cover change of mind. What you cannot do is state or imply that no refunds are ever available, because that misrepresents the guarantees that do apply to faulty or misdescribed goods.

What is the new privacy tort?

A statutory cause of action for serious invasions of privacy, which lets individuals sue directly rather than relying on an OAIC complaint. It changes the risk profile of intrusive tracking and surveillance practices.

Are terms and conditions legally binding?

They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.

What is the difference between terms of service and terms and conditions?

Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.

Can I limit my liability to zero?

No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.

Do I need terms if I sell nothing?

If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.