What Policies Does Your Small Business Actually Need in Australia? (2026 Guide)

Under the Work Health and Safety Act 2011, you, as a Person Conducting a Business or Undertaking (PCBU), have a primary duty of care to ensure the health and safety of workers and others. Organisations can face fines of up to $3 million for category 1 WHS offences (varies state by state/territory). A documented WHS policy is not optional once you have employees.

Professional credibility is also a factor. Clients in allied health, finance, and construction increasingly ask to see your policies before they engage you. A commercial client reviewing your tender, or a subcontractor vetting a head contractor, will notice if you have nothing to show them.

The cost of not having policies shows up in legal exposure, operational inconsistency, and reputational damage when things go wrong. Getting ahead of it costs far less than managing the fallout.

The seven policies every Australian small business needs

Work Health and Safety (WHS) policy

The Work Health and Safety Act 2011 is the model law adopted across most Australian states and territories. It requires every PCBU to implement systems to manage workplace health and safety. A WHS policy documents your commitment to a safe workplace, your approach to hazard identification, your incident reporting procedures, and who is responsible for what.

Without a WHS policy, you have no documented framework to refer to after a workplace incident. The relevant WHS regulator can investigate, and the penalties for non-compliance are significant. A policy alone is not enough. You need procedures to back it up, but the policy is where it starts.

NSW’s new s 26A duty commences on 1 July 2026; Queensland has had an equivalent duty since 2018; and elsewhere, codes remain admissible evidence. PCBUs must now comply with approved Codes or demonstrate they manage hazards to an equivalent or higher standard. Codes that businesses have historically treated as optional are now enforceable. If your WHS policy was written before this change, reviewing it against the relevant Codes of Practice is a practical step to take now.

Privacy policy

Under the Privacy Act 1988, small businesses with an annual turnover of less than $3 million are generally exempt from mandatory compliance requirements. But exceptions apply. If you provide health services, trade in personal information, or are a contracted service provider to the federal government, the Act applies regardless of your turnover.

The Privacy and Other Legislation Amendment Act 2024 introduced new enforcement powers and offences. A further reform to reduce or remove the small business turnover threshold has been under active review since 2022 and may be legislated as early as 2026. Businesses that handle customer and employee data are wise to have a documented Privacy policy now, regardless of whether it is technically required.

A clear Privacy policy also reduces client hesitation when sharing sensitive information with you.

Equal opportunity and anti-discrimination policy

Federal legislation, including the Sex Discrimination Act 1984, Racial Discrimination Act 1975, Disability Discrimination Act 1992, and Age Discrimination Act 2004, prohibits discriminatory conduct in the workplace. Each state and territory also has its own anti-discrimination legislation.

An Equal Opportunity and Anti-Discrimination policy tells your team what behaviour is expected and what the consequences are for breaches. It gives you a documented position if a complaint is made to the Australian Human Rights Commission or a state body. Without a policy, you have no documented standard to point to, which weakens your defence and increases your exposure.

Social media policy

Employees posting about work on social media is one of the fastest-growing sources of workplace disputes in Australia. The Fair Work Commission has both upheld and overturned dismissals based on social media conduct. The difference often comes down to whether the employer had a clear, communicated policy.

A social media policy defines what employees can and cannot post about the business, clients, colleagues, and work matters. It does not need to be restrictive. It does need to be clear.

IT and acceptable use policy

Who owns the data on a company device? Can employees use company systems for personal use? What happens if a device is lost or stolen?

An IT and Acceptable Use policy sets the rules for how technology is used in your business. It covers devices, accounts, passwords, confidential data, and what constitutes a breach. As cyber threats grow and businesses face data incidents with increasing frequency, this policy has become a practical necessity rather than a nice-to-have.

Leave entitlements policy

Under the National Employment Standards in the Fair Work Act 2009, all employees are entitled to annual leave (4 weeks per year for full-time employees), personal and carer’s leave (10 days per year), compassionate leave, parental leave, community service leave, family and domestic violence leave (10 days paid per year), and public holidays. Long service leave entitlements are set by state legislation.

A Leave Entitlements policy does not create these rights; they exist regardless of whether you document them. But a policy clarifies how your business manages leave requests, what notice is required, and how disputes are handled. Without one, inconsistent treatment of leave requests creates both legal exposure and workplace resentment.

From 1 July 2026, Government Paid Parental Leave increases to 26 weeks (130 days). Superannuation must now also be paid with wages rather than quarterly, a change enforced alongside criminal wage theft penalties that came into force on 1 January 2025. Both changes affect payroll and HR policy settings for any business with employees. 

Businesses with fewer than 15 employees are classified as small business employers under the Fair Work Act. This affects the minimum employment period before an unfair dismissal claim can be made, which is 12 months rather than the standard 6 months for other employers.

Disciplinary and performance management procedures

This is the policy most likely to save you money. Unfair dismissal claims are expensive and disruptive. The Fair Work Commission requires employers to have a genuine reason for dismissal and to follow a fair process. Procedural fairness includes notifying the employee, giving them an opportunity to respond, and allowing them to have a support person present.

Documented disciplinary procedures give your managers a consistent framework to follow. They also demonstrate to the Fair Work Commission that you had a process and followed it. Without documented procedures, even a justifiable dismissal can become an unfair dismissal finding.

Policies trades businesses specifically need

Trade businesses face site-specific risks that require more detailed documentation beyond the core seven.

Subcontractor agreements and conduct expectations

If you use subcontractors, a written subcontractor agreement protects both parties. It sets out the scope of work, payment terms, on-site WHS responsibilities, and conduct expectations. Without it, liability for site incidents becomes unclear, and disputes over scope become difficult to resolve.

Site safety and PPE requirements

Your WHS obligations extend to subcontractors and visitors on your site. A documented site safety policy, PPE requirements, and site induction procedure give you a clear record of how you discharge those obligations. This is not a paperwork burden. It is the documentation that protects you if an injury occurs.

Vehicle and equipment use

Trades businesses with fleets and equipment need documented procedures covering who is authorised to use company vehicles, what pre-start checks are required on equipment, and what steps to follow after a vehicle or equipment incident. Without this, responsibility becomes ambiguous.

Client complaint handling

A documented complaint handling process demonstrates professionalism and is often required for certain trade licences and government contracts. It also gives your team a clear process to follow when a client raises a concern, rather than leaving it to ad hoc management.

Policies professional services businesses need

Professional services businesses handle sensitive client information. That creates obligations beyond the core seven.

Client confidentiality and data handling

Law firms, accountants, financial advisers, and other professional services businesses operate under strict confidentiality obligations, many of which are set by their professional bodies. A confidentiality policy, backed by confidentiality clauses in your engagement terms, is standard practice and is expected by clients who share sensitive commercial or personal information.

Conflict of interest policy

Most professional services businesses encounter situations where a conflict of interest can arise, whether that is acting for two parties with competing interests or a team member’s personal relationships affecting their professional judgement. A Conflict of Interest policy provides a clear framework for identifying, declaring, and managing these situations.

Professional development and CPD

Many professional services businesses must satisfy continuing professional development (CPD) requirements for licensing or accreditation. Documenting your CPD policy, including how the business supports and tracks development activities, helps with compliance and demonstrates to regulators and clients that professional standards are maintained.

Billing and payment dispute procedures

Late payments and fee disputes are common in professional services. A documented billing policy that covers invoicing terms, late-payment consequences, and a dispute-resolution process reduces ambiguity. It also gives you grounds to act when a payment is overdue, rather than relying on a series of unanswered emails.

Should you write your own policies or hire a professional?

You can write your own policies. Free templates are available from Fair Work Australia, Safe Work Australia, and business.gov.au. For a sole trader with no employees or contractors, a basic privacy statement and a WHS policy may cover your needs.

The risks with a DIY approach are real, though. Incorrect legal references, missing obligations, and policies that contradict your employment contracts can create more problems than having nothing at all. A template that has not been updated after the Closing the Loopholes Act 2024 amendments, or one from another jurisdiction, will not reflect current Australian law.

A professional policy writer, like the team at SBAAS’s business policy writing service, ensures your policies are accurate under current legislation, aligned with your actual operations, and written in plain English that your team will actually read. SBAAS’s policies are ISO-compatible and written to comply with current federal and state requirements, including the Closing the Loopholes Act 2024. SBAAS also provides HR and IR consulting for businesses that need broader workplace support beyond policy documentation.

If you have employees, operate in a regulated industry, or are growing your business, having policies written by someone who understands Australian employment law is a worthwhile investment.

If your policies are incomplete, out of date, or copied from a template that has never been reviewed, you are carrying more risk than necessary. The SBAAS policy writing service covers HR, WHS, quality, governance, and compliance policies for Australian businesses. Call (07) 3916 9896 or get in touch online.

Frequently asked questions

Do small businesses in Australia have to have an HR policy?

There is no single law that requires a document called an “HR policy.” But your obligations under the Fair Work Act, WHS legislation, and anti-discrimination laws can only be managed effectively through documented policies and procedures. Any business with employees should document how it handles leave, performance management, disciplinary matters, and workplace safety at a minimum.

What is the penalty for not having a WHS policy in Australia?

Under the Work Health and Safety Act 2011, organisations can be fined up to $3.85 million for category 1 offences, which involve conduct carrying a risk of death or serious injury. Fines for category 2 offences can reach $1.925 million. A missing WHS policy does not automatically trigger a fine, but it demonstrates a failure to implement required safety management systems, which affects how any investigation or prosecution unfolds.

How often should business policies be reviewed?

Review your core policies at least every two years, or sooner after significant legislative changes, a business restructure, or a workplace incident. Given the volume of employment law reform between 2023 and 2026, including the Closing the Loopholes Act, Privacy Act amendments, and changes to casual employment and the right to disconnect, any policy written before 2024 is likely overdue for review.

Can I use a policy template for my small business?

Templates from reputable sources, including Fair Work Australia, Safe Work Australia, and business.gov.au, are a reasonable starting point. The risk is that templates are generic. They may not reflect your industry, your business structure, or the most recent legislative changes. Any template should be reviewed, customised, and confirmed against current law before use, not filed as-is.

The policies your small business needs in 2026 are not complicated to get right. Address them now, while the process is straightforward.