How to Write a Better Privacy Policy: Best Practices for Privacy Policies

Australia’s Privacy Act 1988 requires APP entities to have a clear and up-to-date privacy policy in place. But while some organisations are required to have privacy policies, others choose to create one to access the benefits that come with transparency and strong data handling practices. But these documents aren’t all created equal – and some are clearer and more concise than others. In this post, we’ll outline privacy policy best practices and information about what yours must include.  

How to Write an APP-friendly Privacy Policy 

Your privacy policy should explain in simple language how your organisation handles the personal information it collects and stores. The requirements for privacy policies are set out in APP 1.  

Broadly, APP 1 introduces the requirement for APP entities to implement open and transparent management of personal information. An element of this is that APP entities have an up-to-date privacy policy.  

APP 1 requires that privacy policies include:  

• The organisation’s name and contact details. 
• What kinds of personal information being collected and stored. 
• How personal information is collected and where it is stored. 
• Why personal information is collected.  

• How the personal information will be used or disclosed. 
• How to access your personal information, or ask for a correction. 
• How to lodge a complaint. 
• If they are likely to disclose your information outside Australia and, if practical, which countries they are likely to disclose the information to. 

Privacy Policy Best Practices in Australia 

Here are some privacy policy best practices to help you draft a compliant, helpful, and trust-inspiring privacy policy: 

Develop your privacy policy after mapping your data flows 

Data mapping shows the journey of an organisation’s data from collection to destruction or de-identification, and all the steps in between. Engaging in data mapping before you write your privacy policy is the best way to ensure you accurately reflect your data handling in it.  

Write your privacy policy with your audience in mind 

Your audience is unlikely to be comprised of lawyers and privacy professionals. The language you use in the privacy policy must reflect this to comply with the Privacy Act and to improve trust.  

We understand that it’s not possible to avoid jargon entirely. Your privacy policy is likely to use industry jargon like cookies, IP addresses, HTML5, data controller, and so on. Whenever you use a technical term or legal or industry jargon, you should include a hyperlink to either an external webpage defining the term (in clear, simple language) or an FAQ or Glossary page on your website.  

Format the privacy policy in a way that promotes clarity 

The way an organisation’s privacy policy is formatted and designed impacts how clear it is to readers. You should ensure the way your privacy policy looks and the way it’s formatted promote clarity.  

The OAIC highlights that many organisations include the following headings:  

• Scope — describes what the policy applies to 

• Collection of personal information — provides the key information about what personal information is collected and why. Focus on areas that are most sensitive or that the reader would least expect 
• Disclosure (sharing) — describes the key disclosures and the conditions around those disclosures. This is a good place to mention overseas disclosures. Disclosures of personal information are usually the most important to individuals, but unexpected uses could be mentioned too 
• Rights and choices — describes any key choices that individuals can make, including the right to request access and correction of personal information held about them 
• How to make a complaint — briefly describes how to make a complaint about privacy and what to do if they are not satisfied with the outcome 
• Contact details — including (at least) a generic telephone and email address that won’t change with personnel. 

Quick Drafting Tips to Improve Clarity in Your Privacy Policy 

• Use short sentences of 20 words or less.  
• Use the active voice.  
• Break text up into paragraphs of 3-4 sentences, or fewer.  
• Use clear headings. 
• Number paragraphs under headings.  
• Use a table of contents.  
• Avoid acronyms.  
• Avoid unnecessary synonyms.  
• Aim for a Flesch Readability Score of 60 or higher. The Microsoft Editor has this functionality built in.  

View the OAIC’s guidance on drafting privacy policies for more information. 

While updates to your organisation’s privacy policy may not lead to the exodus of customers (like the Whatsapp update), it’s important to get it right. If not, you are risking your reputation and potential compliance issues.  

Don’t hesitate to reach out for guidance developing your organisation’s privacy policy. Or if you’re reading this article as a privacy professional, consider joining one of our upcoming CIPM training courses.