Nobody asks this question directly.
It comes out as so I probably should ask you, or this is going to sound bad, but. Usually somewhere in the second half of a call, once the actual reason for the call has been dealt with.
The question underneath is always the same. What am I supposed to have by now?
It is a fair question, and it almost never gets answered plainly, because the honest lawyer answer is it depends. Which helps nobody.
So here is the unhedged version, with no fear attached. This is not a list of everything you could have. It is the short list of what actually matters if you are past your first year and taking money from clients or customers.
- There are five documents most Australian online businesses actually need, not fifteen.
- A privacy policy copied from another website is the most common gap, and there is a 10 December 2026 deadline attached to it.
- A contractor generally owns what they create for you unless they assign it to you in writing.
- Since August 2024 the contractor and employee test looks at the practical reality of the relationship, not the label in the agreement.
- If you are missing several, do not try to fix all of them. Finish the one attached to the risk that would hurt most.
Table of contents
- What legal documents does every Australian online business need?
- How do you know whether yours are actually current?
- What should you do if you do not have them?
- Frequently asked questions about legal templates
- Foundd Legal turns seven this month
What legal documents does every Australian online business need?
1. A client contract, or services agreement
What you are doing, what it costs, when you get paid, and what happens when something goes wrong.
This is the one that gets you paid. It is also the one that ends arguments before they start, because most client disputes are not really disputes. They are two people who each assumed something different and never wrote it down.
What it protects against: the client who goes quiet on an invoice. The scope that quietly doubles. The person who wants a refund in month five of a six month programme.
2. Website terms and conditions
The rules of using your site and buying from you.
Most people think of this as a formality. It is not. This is the document that lets you say no to an unreasonable refund request without inventing a policy on the spot, at ten at night, while feeling terrible.
What it protects against: refund demands outside your stated policy. Disputes over digital delivery. People misusing your content.
3. A privacy policy that is actually yours
Not the one you copied from another website in 2022.
A privacy policy has to describe what you really collect, where it really goes, and what you really do with it. Including your AI tools, which is where almost every policy is now out of date.
There is a date attached to this one. From 10 December 2026, new rules require businesses to disclose when software is making decisions about people, and what kinds of personal information it uses to make them. If you have fraud checks in your payment system, segmentation in your email platform, a chatbot, or intake screening, that is likely to include you.
Broader privacy reform is also looking at the small business exemption, so we are too small for this is a shrinking argument.
What it protects against: a data breach where your own policy contradicts what you were doing. Regulator attention. Customers who ask a question you cannot answer.
If your privacy policy describes a business you no longer run, it is not doing much protecting.
4. A contractor agreement, if you use contractors
VAs, designers, editors, anyone you pay who is not an employee.
Two things go wrong here. The first is intellectual property. Under Australian copyright law a contractor generally owns what they create unless they assign it to you in writing. So the logo, the graphics and the copy you paid for may not be yours.
The second is classification. Since August 2024 the test for whether someone is a contractor or an employee focuses on the practical reality of the working relationship, not just the label in the agreement. Calling someone a contractor does not make them one.
What it protects against: not owning work you paid for. A misclassification claim. Confusion about who can end the arrangement and how.
5. Something specific to what you actually do
This is the one people skip, and it is often the one carrying the most risk.
If you coach, you need a disclaimer that says coaching is not therapy, medical advice or financial advice. If you run a cosmetic clinic, AHPRA and TGA rules govern your marketing in ways general terms do not touch. If you sell a course, you need terms that deal with access, sharing and refunds for digital products. If you photograph people, you need a release.
General documents cover general risk. Your biggest risk is usually specific.
How do you know whether yours are actually current?
Write the five down. Put a tick, a cross or a question mark next to each.
The question marks are the real answer. A document you are unsure about is functionally the same as not having one, because you will not rely on it under pressure. If you do not know what your website terms say about refunds, they are not going to help you during a refund argument.
Most people who do this properly end up with two ticks, one cross and two question marks. That is normal. It is not a failure, it is a to do list.
What should you do if you do not have them?
Do not try to do all five.
That is exactly how this ends up on a list for another two years. Five documents is a project, and projects get postponed.
Instead, pick the one attached to the thing that would hurt most.
If not getting paid would hurt most, do the client contract. If a refund fight would hurt most, do the website terms. If you have contractors making things for you, do the contractor agreement. Finish that one properly. Then look at the next.
One finished document beats five half started ones, every single time.
Frequently asked questions about legal templates
Do I need a lawyer to use a template?
No, if the template was drafted for Australian law and written to be filled in by the business owner. What you do need is to actually fill it in properly. A template with the scope left vague is barely better than nothing. If your situation is unusual, that is when it is worth a conversation.
Are templates legally binding?
Yes. A contract does not become binding because a lawyer wrote it for you personally. It becomes binding because both parties agreed to it. What a well drafted template gives you is terms that hold up and cover the things that actually go wrong.
Foundd Legal turns seven this month
Seven years, and the pattern has not changed. People do not avoid this because they are lazy. They avoid it because nobody has made it small enough to finish.
So for our seventh birthday we are doing something special. Want in? Just sign up to our newsletter.
About the Author
Riz is the Founder & Director of Foundd Legal, a lawyer with 20+ years' experience and a long history of building online and ecommerce businesses.
She helps creatives and online business owners protect and grow their businesses with clear, practical legal tools that actually make sense.
SIGN UP TO OUR FREE BUSINESS CHECKLIST
Disclaimer
We do our best to keep this content accurate and up to date, but laws change, interpretations evolve, and the internet isn't perfect. Occasionally, information may be outdated or contain errors.
This content is for general information only and isn't legal advice. If you choose to rely on it, you do so at your own discretion. For advice specific to your business, you'll need support tailored to your situation.
All rights reserved. © Foundd Legal Pty Ltd
