What is a privacy statement? What do I need to include in a privacy statement?

A privacy statement is a statement that sets out what personal information a company, service provider, or other agency collects and what it will use it for. It may be published on a website, or included with a product or service. Privacy statements are used to comply with Principle 3, and in some cases principle 3A, of the Privacy Act, which says that when an organisation, business or agency collects information from an individual, either directly or indirectly, it should ensure that the individual is informed about what information is being collected and the purpose it is to be used for.

A privacy statement ensures that people are aware:

that you're collecting information about them (if it's not obvious)
why you're collecting the information
what you're going to use it for
who you're going to give it to (if anyone)
whether the person has to give you the information and what will happen if they don't
that they can access the information you hold about them, and they can correct it if it's wrong.

When you collect peoples’ information from somewhere other than the person themself, there are different requirements for what you need to tell people:

that the information has been collected
the purpose of the collection
the intended recipients of the information
the name and address of the agency that is collecting information and the agency that holds the information.
if the collection is authorised or required by law, which particular law that is
their right to access and correct their information

There are a number of exceptions to this principle, such as if the individual has already been made aware of the indirect collection, or that the information won’t be used in a way that identifies people. Read the exceptions to this principle including explanations and examples.