The law reads an online form from the top down
A notice before the first field. Only the fields that are reasonably necessary. A tick that can count as a signature where a Commonwealth law requires one and the method passes the test in s 10 of the Electronic Transactions Act 1999. And, where there was no chance to fix a mistake, a conditional right to withdraw that part of it.
Each part of a form has its own rule.
General information, not legal advice. The rules are in the Privacy Act 1988 and the Electronic Transactions Act 1999, and each page below names and links the official source it draws on.
Who the rules reachDoes the Privacy Act apply to your business’s form?
After Submit
The Act's security principle, APP 11.1, requires such steps as are reasonable in the circumstances to protect the answers a form collects from misuse, interference and loss, and from unauthorised access, modification or disclosure. Since 11 December 2024 the Act's APP 11.3 adds that those steps include technical and organisational measures, and the OAIC says it applies to information held after that date.
The keeping rule is APP 11.2: once the business no longer needs the answers for a purpose the Act allows, and they are not in a Commonwealth record and no law requires keeping them, it requires reasonable steps to destroy them or to ensure they are de-identified.
If the business is likely to disclose the answers to someone overseas, the notice has to say so: the APP 5.2 matters include whether the business is likely to disclose the information to overseas recipients and, if practicable to specify, the countries. The privacy policy has to set that out too (APP 1.4), and before any disclosure overseas the business must take reasonable steps to ensure the recipient does not breach the APPs, unless an exception applies, such as the individual's informed consent.
Who the rules reach
The Privacy Act draws its line this way: an individual, body corporate, partnership, unincorporated association or trust is not one of the Act's small business operators if it carries on a business that has had an annual turnover of more than $3,000,000 for a financial year. Government pages put the same line shorter, as more than $3 million or as $3 million or more; the guide below reconciles the wordings.
Whatever the turnover, the Act reaches some businesses: it covers all health service providers regardless of turnover, and a range of small businesses, as the OAIC's glossary puts it.