Form privacy notice checklist

A form privacy notice, often called a collection notice, has to cover ten matters under Australian Privacy Principle 5: who is collecting and how to reach them, how the information is collected, whether a law requires it, why it is collected, what happens if it is not given, who it goes to, how to access and correct it, how to complain, and whether and where it goes overseas. Put the purpose, recipients and anything surprising on the form itself, above the first field, and link the privacy policy for the rest.

Why a form needs its own notice

A privacy policy describes how an organisation handles personal information in general. A collection notice describes what is happening right now, on this form. The OAIC’s APP 5 guidelines are clear that a link to the policy is not automatically enough: an entity should first consider whether the policy covers the APP 5 matters as they relate to the particular collection. A rental application and a newsletter signup from the same business collect different things for different reasons, so one generic link rarely answers both.

The note on privacy policy versus privacy notice sets out how the two documents differ. This checklist is only about the notice on the form.

Coverage is worth checking too. The OAIC’s small business guidance says most businesses with an annual turnover of $3 million or less are not covered by the Privacy Act, but any business providing a health service is covered regardless of turnover. A physiotherapy clinic, a psychologist or a gym offering health assessments should assume APP 5 applies.

The ten APP 5 matters

APP 5.2 lists the matters an entity must take reasonable steps to tell people about, or make sure they are aware of:

1. its identity and contact details
2. the facts and circumstances of the collection, where the person may not know it is happening
3. whether the collection is required or authorised by law
4. the purposes of collection
5. the consequences if the information is not collected
6. the other entities it usually discloses this kind of information to
7. that its privacy policy explains how to access and correct the information
8. that its privacy policy explains how to complain
9. whether it is likely to disclose the information overseas
10. if so, and where practicable, the countries involved

Reasonable steps depend on the circumstances, including how sensitive the information is. A contact form asking for a name and email needs less than a clinical intake form. The guidelines also allow layered notices, from a short statement on the form to the full policy behind a link.

Where the notice goes on the form

Put the core notice where people read before they start typing: a paragraph at the top of the form, or on the welcome screen. Then add short, just in time lines beside any field that needs its own explanation.

The patient intake form from a fictional clinic does both. Its intro says everything the patient shares is confidential and only seen by their care team. Further down, the optional photo of the health fund card carries its own line: optional, and it saves the front desk typing it in. That second line answers the question a patient has at that exact field, which is why the patient is being asked for a photo of a card at all.

The rental application form opens with a sentence that does a lot of work in few words: one application per adult, and everything is used to assess the application and nothing else. The job application form closes with a declaration that includes agreement to details being held for this recruitment process, which tells the applicant the purpose and its limit.

Wording each point plainly

The UK regulator’s guidance on the right to be informed asks for information that is concise, transparent, intelligible and in clear and plain language, and the Australian guidelines say much the same. In practice:

• Write in the first person plural of the business. “We use your phone number to confirm bookings” beats “Personal information may be utilised for operational purposes”.
• Name recipients by role. “Your treating practitioner” tells the reader more than “third parties”.
• Say no when the answer is no. “Your details stay in Australia” is reassuring and costs one line.
• Put consequences beside the field. “Without a mobile number we cannot send reminders” explains why a field is required at the moment someone hesitates.
• Keep it short. Five or six sentences cover most forms; the policy carries the detail.

The table at the end of this article gives example wording for all ten matters, written for a fictional allied health clinic, with a note on where each line usually sits.

Sensitive information and health forms

Health, criminal record, religion, ethnicity and sexual orientation are sensitive information under the Privacy Act, and the OAIC’s key concepts guidance says an organisation should generally seek express consent before handling sensitive information. On a form that means three things.

Ask only what the service depends on. The patient intake example asks medical history as a checklist ending with “None of these”, so nobody is forced to disclose more than applies.

Explain the purpose beside the question, not only at the top.

Keep consent separate from acknowledgement. Telling someone how their information is handled is not the same as getting their agreement to a particular use. If the form needs both, use separate fields. The guide on writing a consent form covers consent wording in depth.

The checklist in use

Work down the table with the draft form open and mark each matter as covered on the form, covered by a linked policy, or not applicable with a reason. Then read the form as a first time visitor on a phone and check that the purpose and recipients are visible before the first field, not below the submit button.

Set a trigger for reviewing it. A notice goes stale the day something changes behind the form: a new booking system, an email alert copied to a second inbox, a reminder service hosted overseas. Keep a one line register of every form, what it collects and which systems receive the answers, and reread the notice whenever that line changes. The recipients and overseas rows of the table are the two that drift first, because nothing on the form itself looks different when they change.

Common mistakes

A policy link and nothing else. The link covers access and complaints; purpose and recipients still belong on the form.

Notice below the submit button. Nobody reads it before collection.

“Trusted partners”. Name the kind of recipient, and say if it is overseas.

Several agreements in one required tick list. A person who must accept terms and may choose marketing is making two decisions. Give each its own field.

Copying another organisation’s notice. It describes their systems and suppliers, not yours.

Build it

On a published classic form, a field’s description is shown only on file upload and photo fields; on every other classic field it is hidden from the respondent. So put the notice in a paragraph component above the fields, or fold a short explanation into the label itself. A conversational form does show descriptions under each question, so just in time lines can sit there.

For acknowledgements and consents, a checkboxes field with one option worded as the statement works, and options start unticked. A required checkboxes field is satisfied by any one ticked option, so when two statements must each be agreed, give each its own required field. The page on text and checkbox fields shows both, and the tutorial on creating a form with AI covers generating the form and then editing its wording.