Free tool · Privacy Act × AML/CTF

Free privacy policy generator for AML/CTF firms

Answer plain questions and get a privacy policy and a collection notice written for a business with AML/CTF obligations, including the new section on decisions made with the help of software that privacy policies may need from 10 December 2026. Free, no sign-up, and nothing you type into it leaves your browser.

Start now Read the Privacy Act guide

Your answers stay on your computer. This page builds the documents in your browser. Nothing you type is sent to CompliDesk or stored anywhere. Close the page and it is gone, so download your documents before you leave.

1 Your business Business name *

ABN

Business address

What services do you provide? *

This finishes the sentence "[Business name] provides these services: …".

What should the policy cover? *

Only the personal information we handle for our AML/CTF obligations (a small business with a turnover of $3 million or less, not covered by the Privacy Act for another reason, may choose this. The policy says you follow any other privacy rules that apply to you, such as the tax file number rules.) Everything our business does with personal information (step 3 then asks what else you collect and why)

2 Your privacy contact

Name *

Role

Email *

Phone

3 What you collect, and how

The kinds of personal information you collect

How you collect it

4 Who you share it with

Software or providers that hold client information (optional)

Does any of it go outside Australia? *

Email, cloud storage, identity verification and compliance software often store or process information overseas. Check with your providers if you are not sure.

Yes, some of our providers store or process it overseas No. We have checked, and none of our providers store or process it outside Australia

5 Software that helps you decide (from 10 December 2026)

From 10 December 2026, if a computer program makes, or does something substantially and directly related to making, a decision that could significantly affect a person, your privacy policy must say what kinds of personal information it uses and what kinds of decisions are involved (APP 1.7 to 1.9). Tick the tools you use. If you use none, leave them all clear.

6 How you keep it safe Where it is held (optional)

How you protect it *

7 Requests and complaints How someone asks to see or correct their information * How you handle a privacy complaint *

General information, not legal advice. Have a lawyer review the documents before you publish them.

Your documents

You have changed your answers since these documents were made. Click "Create my documents" again before you download them.

You ticked no software in step 5, so the policy has no section on decisions made with the help of computer programs. If you start using identity verification, screening or risk-rating software, add that section before 10 December 2026.

Before you publish. Read both documents against what your business really does, and have a lawyer review them. Put the policy on your website and give the collection notice to clients when you collect their details, for example in your onboarding form or engagement letter. Update both when your providers or services change.

What else the Privacy Act asks for

A privacy policy is step one

The OAIC's checklist for AML/CTF reporting entities has 14 questions. A policy and a collection notice answer two of them. The rest cover a list of the information you hold, a plan for when information is lost or stolen, destroying what you no longer need, answering requests, and training staff.

The OAIC's 14 questions

Each question in plain words, and what a yes looks like for a small firm.

Data breach response plan

What to put in your plan for when client information is lost or stolen.

The 10 December rule

What APP 1.7 to 1.9 mean for AML/CTF firms using ID, screening and risk software.

The full Privacy Hub comes with every CompliDesk monthly plan. It keeps your privacy policy and collection notice with your AML/CTF records, builds your list of client information from them, writes your plan for lost or stolen information, takes you through the OAIC's 14 questions, records requests and breaches with the days counted, and includes a 15-minute privacy lesson for staff. See pricing or book a demo.

Updates

Hear when the rules change

Privacy and AML/CTF rules keep moving. Leave your email and we will tell you when something changes that affects your policy. This form is separate from the generator above: it sends only what you type into it.

Questions about the free privacy policy generator

Yes. There is no charge and no sign-up. Answer the questions, then download or copy your privacy policy and collection notice.

No. The documents are built in your browser. Nothing you type into the generator is sent to CompliDesk or stored. If you close the page, your answers are gone, so download your documents first. The separate updates form further down sends only what you type into it.

Yes. From 10 December 2026, if a computer program makes, or does something substantially and directly related to making, a decision that could significantly affect a person, a privacy policy must describe the kinds of personal information used and the kinds of decisions involved (APP 1.7 to 1.9). The generator writes that section from the tools you tick, such as identity verification, screening or risk-rating software.

If you provide AML/CTF designated services, yes for that work. Since 1 July 2026 the Privacy Act covers the personal information you handle for your AML/CTF obligations, whatever your turnover. An otherwise exempt small business may limit its policy to that AML/CTF handling, and the generator lets you choose.

No. The generator writes documents from your answers, with reference to the OAIC's privacy guidance for AML/CTF reporting entities. The OAIC has not reviewed or endorsed them. They are general information, not legal advice. Read the documents against what your business does and have a lawyer review them before you publish.

Free privacy policy generator for AML/CTF firms

A privacy policy is step one

The OAIC's 14 questions

Data breach response plan

The 10 December rule

Hear when the rules change

Questions about the free privacy policy generator

Privacy and AML/CTF in one place.