Privacy Policy Template for Accounting Practices
Draft a privacy policy from the information your practice collects and the tools it uses.
Enter practice procedures only. Keep client details out of these fields. Entries clear when you leave.
Start your policy
Enter your practice details or load a fictional example.
Build Your Practice Privacy Policy
A privacy policy describes what happens to personal information across your accounting practice, from first enquiry to the records you keep after an engagement ends.
The generator turns your practice details into an editable draft. Use Load example to see a fictional practice’s draft, or enter your own details and select Prepare policy.
For practices covered by the Privacy Act 1988, Australian Privacy Principle 1 (APP 1) requires a clear, up-to-date policy. The draft uses the following section map.
Check the Office of the Australian Information Commissioner’s APP 1 guidance for the full requirements.
- Information We Collect and Hold covers the types of personal information under APP 1.4(a).
- How We Collect and Hold Information describes where information comes from and how you store and protect it under APP 1.4(b).
- Why We Handle Information gives the purposes for collecting and holding personal information and explains why you use or disclose it under APP 1.4(c).
- Access and Correction tells people how to see their information or ask for a correction under APP 1.4(d).
- Privacy Complaints gives a contact and explains how you handle complaints under APP 1.4(e).
- Overseas Disclosure says whether overseas disclosure is likely and, where practicable, which countries recipients are likely to be in under APP 1.4(f) and (g).
- Getting This Policy gives people a way to request a free copy or ask for another format under APP 1.5 and 1.6.
The OAIC’s small business guidance explains when the Privacy Act applies. TFN rules can still apply to a practice that is exempt from the APPs.
Replace all fictional details before publishing. Copy the edited draft or download a plain-text file for your document editor.
If you change an input, prepare the policy again to include the change. This template is general information and does not give legal advice.
Tax File Numbers, Cloud Software and AI
In TFN handling, describe when your practice collects Tax File Numbers and how it restricts their use and disclosure. Under the Privacy (Tax File Number) Rule 2015, limit access to staff who need the information for authorised purposes.
Describe your actual safeguards without revealing security details that could help someone bypass them.
List the software you use, where it stores information and where providers or subcontractors can access it. Then decide whether your practice is likely to disclose personal information overseas.
Overseas storage and overseas disclosure are separate questions. The OAIC’s APP 8 guidance explains how effective control affects that distinction.
If you cannot practicably list likely recipient countries, explain why in Overseas recipients.
Registered tax and BAS agents must obtain client permission before disclosing information about a client’s affairs to a third party unless there is a legal duty to disclose.
A published policy describes your practice’s handling. Get permission through your engagement process where required. See the Tax Practitioners Board’s outsourcing guidance for cloud providers and offshore services.
In AI use, describe what the tool receives, what it does with the information and how staff use its output.
Check the provider’s terms for retention, reuse in model training and overseas access. The OAIC’s AI privacy guidance recommends keeping personal information out of publicly available generative AI tools.
For decisions made from 10 December 2026, APP 1.7 to 1.9 add a disclosure test.
The rule covers a program your practice arranges to make a decision using a person’s information. It also covers a program that uses that information for a step substantially and directly related to the decision.
Select Yes if that decision could also reasonably be expected to significantly affect the person’s rights or interests.
The Decisions Made by a Computer Program section records the types of personal information the program uses.
It separates the kinds of decisions the program makes on its own from the kinds it directly supports.
A person signing off does not automatically put the decision outside the rule.
For example, consider whether an identity check blocks a client’s application or directly influences a staff decision to accept it.
Website and Company Privacy Policies
Your website is where people can find your company privacy policy. Cover website enquiries and any tracking that collects personal information alongside information from your other practice activities.
If the site only has a website privacy policy, check that clients can also find the policy for records held outside the site.
Your internal privacy procedure tells staff who checks a requester’s identity, who can disclose records and who investigates a complaint. Keep those instructions with your practice procedures.
Give the public policy enough detail for a client to make a request and know how you will handle it.
Keeping the Policy Current
Review the policy before you add an AI tool, change cloud providers or start collecting a new category of information.
Compare the proposed data flows with the published policy, update the affected clauses and check whether you also need to change your client notices or permissions.
Assign a practice owner to check the published policy regularly. Test the privacy contact and complaint route and make sure the current copy is freely available. The OAIC’s guide to developing a privacy policy includes a review checklist.