Privacy Act Compliance for Your Enquiry Form: What Law, Accounting & Clinic Websites Are Legally Required to Tell Visitors

26 August 2026·6 min read

Quick answer: If your website has an enquiry, contact, intake or booking form, the Australian Privacy Principles expect you to tell visitors — briefly, in plain language, at the point of collection — what you're collecting, why, whether it's shared with any third party (your CRM, booking platform or practice software), and how they can access or correct it later. You don't need a wall of legal text; you need one honest paragraph. Below is the copy-paste collection notice formula, three worked examples for law, accounting and clinic forms, and the mistakes that quietly expose a practice to complaints. ✨

Every law firm, accounting practice and clinic website has one of these forms — name, email, a text box, "Submit" — and almost none of them say a single word about what happens to that information afterwards. Visitors notice the silence even when they can't name what's missing, and it's one of the quiet reasons a form that "should" convert doesn't. Here's how to fix it properly, without hiring a privacy lawyer for a five-minute job. 💖

What most law, accounting & clinic websites get wrong

Saying nothing at all — the form just asks for details and submits, with no mention of what happens next.
Burying it in a 3,000-word privacy policy nobody reads, with no signpost anywhere near the form itself.
Not naming the third parties — the booking platform, practice management system or email tool the data actually flows into.
Using a generic "Contact Us" template never written for a regulated profession collecting sensitive details.
No visible way to ask "what do you have on me" or request a correction — or nobody who'd know how to answer if someone did.

The copy-paste collection notice formula

This isn't your full privacy policy — it's the short, honest version that sits at or near the form, doing the actual job the Privacy Act expects at the point of collection:

We collect [the details you're asking for] to [respond to your enquiry / assess your matter / book your appointment]. We may share this with [named third parties — e.g. our practice management system, our booking platform] to deliver that service. We [do / don't] use your details for marketing unless you opt in separately. You can ask to access or correct your information at any time — contact [privacy email] or see our full Privacy Policy.

Five moves: what, why, who else sees it, marketing yes/no, and how to follow up. Sitting this directly above or below the submit button does more for trust than any testimonial slider.

Three worked examples

Same formula, adjusted for what each business actually collects and where it actually goes. 📈

Family law firm intake form: these forms often collect names, contact details and a description of the matter — sometimes including a former partner's or a child's details. "We collect this information to assess whether we can assist with your matter and to respond to your enquiry. Details are stored in our secure practice management system and aren't shared outside our firm without your consent. You can request access to or correction of your information at any time — see our Privacy Policy."

Accounting firm new-client form: "We collect your contact and business details to prepare a quote and understand your accounting needs. If you engage us, further financial information you provide is stored in our secure client portal and practice software, and isn't shared for marketing by any third party. You can ask to see or update your details at any time by emailing our office."

Physio clinic online booking form: "We collect your contact and appointment details through [booking platform name] to schedule and manage your appointment, and may collect brief health information relevant to your treatment once you're a patient. This information isn't shared beyond our clinic and our booking and clinical software providers. You can request access to your records at any time — ask our reception team or see our Privacy Policy."

Where this notice actually needs to live

Point of collection matters — a notice that only exists on a separate policy page three clicks away is doing a much weaker job than one visible right where someone is about to type in their details. In practice that means: a short version (two or three sentences, the formula above) sitting near the form itself, linking through to a fuller Privacy Policy page that covers your practice properly. List your real third parties by name or category — booking software, CRM, cloud file storage, email platform — rather than a vague "service providers." If any of those tools store data overseas, your policy should say so in general terms; that's a detail worth checking with each vendor rather than guessing.

💡 Heads up: health information — including anything collected by physio, psych, dental, chiro or podiatry clinics — is treated as sensitive information, which generally warrants extra care regardless of your business size. If you're a health service provider, don't assume a small-business exemption applies to you; check your actual position rather than assuming.

Mistakes to avoid

Treating the notice as set-and-forget — update it whenever you change booking platforms, CRMs or add a new tool.
Assuming the small business exemption always applies — health providers and businesses that trade in personal information generally don't get it.
Using an overseas-hosted tool without checking or disclosing where the data actually sits.
No easy opt-out for follow-up marketing after someone's submitted a genuine enquiry.
Writing it once and copying it to every page without checking it still matches what that specific form collects.

Please note: this is general information, not legal advice — every firm and clinic's obligations depend on your specific circumstances. Have a solicitor or your industry body review your actual privacy policy and collection notices, and check current guidance from the Office of the Australian Information Commissioner (OAIC) before relying on this.

Frequently asked questions

Does the Privacy Act actually apply to my small firm or clinic?

Many small businesses under the $3 million turnover threshold are technically exempt — but there are well-known exceptions, and health service providers are generally not exempt regardless of size. If you're unsure where you sit, that's a five-minute question worth putting to a solicitor or the OAIC directly rather than guessing.

Does this short notice replace my full privacy policy?

No — and this is the honest trade-off. The short notice does one job (telling someone what's happening right as they hand over their details); your full Privacy Policy page does a different, more complete job. You need both, and the short version should link through to the long one.

What counts as "sharing" with a third party?

More than you'd think — your CRM, your booking platform, your cloud storage and your email marketing tool all technically receive and store the data your form collects, even if you're not deliberately handing it to a stranger. Naming those categories (or the actual products) in your notice is more honest than a vague "we may share your information."

How often should this be reviewed?

Any time your tools change — a new booking platform, a new CRM, a new email system — plus a general check-in every six to twelve months. A notice that still describes software you stopped using two years ago isn't doing its job. 🌴