Marketing often relies on personal information: names, email addresses, phone numbers and purchase history. How you collect and use it affects customer trust, and in many cases it's regulated. This guide explains how Australia's privacy and spam rules apply to small business marketing, in plain language. It isn't legal advice.
This guide is general information written in our own words, based on the official sources listed at the end. Laws, regulator guidance and platform rules change, and how they apply depends on your business, so check the official source and get legal or professional advice where you need it. We don't recommend particular agencies, tools or platforms, and we never promise results.
Two sets of rules
Two separate laws are most relevant:
- The Privacy Act 1988, overseen by the Office of the Australian Information Commissioner (OAIC), which sets out the Australian Privacy Principles (APPs).
- The Spam Act 2003, enforced by ACMA, which regulates commercial emails and texts.
The Spam Act applies regardless of business size. Whether the Privacy Act applies depends on your business.
Who the Privacy Act covers
The OAIC says Australian Government agencies and organisations with an annual turnover of more than $3 million have responsibilities under the Privacy Act, subject to some exceptions. It also lists small businesses (with annual turnover of $3 million or less) that are covered, including:
- a business that sells or purchases personal information,
- a credit reporting body,
- a contracted service provider for an Australian Government contract,
- a business that has opted in to the Privacy Act,
- a business related to a business covered by the Act, and
- certain others, such as some health service providers.
The rules are complex and reforms have been proposed, so check the OAIC's current guidance or get advice about your situation. Even if you're not legally covered, following good privacy practice is sensible and builds trust.
Direct marketing under APP 7
For businesses covered by the Privacy Act, APP 7 deals with direct marketing. The OAIC's guidelines say an organisation must not use or disclose personal information for direct marketing unless an exception applies, and describe direct marketing as using or disclosing personal information to communicate directly with someone to promote goods and services.
Where direct marketing is allowed, the OAIC says the organisation must always provide a simple way to opt out. APP 7.6 lets individuals ask not to receive direct marketing, and the organisation must give effect to the request within a reasonable period and free of charge.
Rights people have
The OAIC explains that under the Privacy Act, people have rights including to know why their personal information is being collected, how it will be used and who it will be disclosed to, to ask for access to their information, to have incorrect information corrected and to stop receiving unwanted direct marketing.
The spam rules still apply
Separately, ACMA says you need consent before sending marketing emails or texts, and each message must identify you, include your contact details and make it easy to unsubscribe. See our email marketing guide and try our email marketing checker.
Good practice for every business
- Collect only the information you need for a clear purpose.
- Tell people how you'll use it, in plain language, when you collect it.
- Get clear consent before sending marketing.
- Make opting out easy, and honour it promptly.
- Store information securely and limit who can access it.
- Don't buy or sell customer lists.
- Delete information you no longer need.
A privacy policy
Businesses covered by the Privacy Act need a clearly expressed, up-to-date privacy policy. Even if you're not covered, a short, honest privacy statement on your website helps customers understand how you handle their information.
A practical checklist
Know what personal information you collect and why; tell people how you'll use it; get consent for marketing; offer an easy opt-out in every message; process opt-outs promptly; keep data secure; and delete it when you no longer need it. Review your sign-up forms, email tools and any providers that handle data for you.
Try the email marketing checker
Our free email marketing checker asks six quick questions about consent, identifying your business, contact details and unsubscribing, based on ACMA's guidance on the Spam Act 2003. It shows what to fix if anything is missing. It runs entirely in your browser, and nothing you answer is sent anywhere.
Where our information comes from
Factual statements in our guides are based on official sources, including the ACCC, the Australian Communications and Media Authority (ACMA), the Office of the Australian Information Commissioner (OAIC), business.gov.au and Google Search Central. We link to each source at the end of the page and write everything in our own words. We don't publish invented statistics, benchmarks, case studies or testimonials.
Rules and platforms change
Consumer, spam and privacy rules are reviewed from time to time, regulators update their guidance, and digital platforms change their features and policies often. Treat our guides as a starting point, and check the official source, or get legal or professional advice, before making decisions that matter for your business.
Free official help
business.gov.au publishes free guidance and templates on marketing, advertising and online reviews, and can be contacted on 13 28 46. The ACCC, ACMA and OAIC each publish plain-language guidance for businesses on their websites. State small business commissioners and small business development centres also offer information, workshops and, in some cases, low-cost advice.
Marketing on a small budget
You don't need a big budget to market well. Many of the most effective activities for small businesses cost little except time: a clear, helpful website; accurate local listings; genuine reviews; a simple email list built with consent; consistent social media on one platform; and great service that earns word of mouth. Start with these, measure results and invest more where you see returns.
Working with agencies and freelancers
If you hire help, be clear about your goals and budget, ask for examples of similar work, agree what will be delivered and how results will be reported, and make sure you keep ownership of your website, accounts and customer data. Be wary of anyone promising guaranteed results. Remember that you remain responsible for what is published on your behalf.
Accessibility helps everyone
Making your marketing accessible helps more people use it. Use clear headings and plain language, add descriptive alt text to images, make sure text contrasts well with backgrounds, caption videos, and check that your website and emails work well on phones and with screen readers. Accessible marketing is usually clearer marketing for everyone.
Consistency builds recognition
Use the same business name, logo, colours and tone across your website, listings, social media, emails, signage and printed material. Consistency makes your business easier to recognise and remember, and helps customers trust that they've found the right business. A simple one-page style guide can help anyone who creates content for you.
Look after existing customers
It's often easier to win more business from existing customers than to find new ones. Thank customers, follow up after a sale, ask for feedback, and give them reasons to come back, such as useful updates or offers for regulars. Happy customers also tend to recommend you to others, which is some of the most valuable marketing there is.
A quick checklist
If you remember only a few things from our guides, make them these: know who your customers are; set goals you can measure; be helpful rather than salesy; make every claim accurate and provable; get consent before emailing or texting; never fake or manipulate reviews; disclose paid partnerships; and review what's working regularly.
Key points
- The Spam Act applies to all businesses sending commercial emails and texts.
- The Privacy Act covers organisations with turnover over $3 million, plus some smaller businesses.
- Businesses that buy or sell personal information are covered regardless of size.
- APP 7 requires a simple opt-out from direct marketing, honoured free of charge.
- Collect only what you need and be open about how you use it.
Frequently asked questions
Does the Privacy Act apply to small businesses?
Generally it covers organisations with annual turnover over $3 million, but the OAIC lists some small businesses that are covered, such as those that sell or buy personal information.
What is APP 7?
The Australian Privacy Principle on direct marketing, which limits using or disclosing personal information for direct marketing and requires a simple opt-out.
Do the spam rules apply even if the Privacy Act doesn't?
Yes. The Spam Act applies to commercial emails and texts regardless of business size.
Can I buy or sell customer lists?
The OAIC notes that businesses that sell or purchase personal information are covered by the Privacy Act regardless of turnover.
Sources and further reading
Facts on this page were checked against these primary and official sources. Conditions change — confirm before you travel or buy.
- Rights and responsibilities — Office of the Australian Information Commissioner (OAIC)
- Chapter 7: APP 7 Direct marketing — Office of the Australian Information Commissioner (OAIC)
- Avoid sending spam — Australian Communications and Media Authority (ACMA)
