How to collect enquiry details the right way: privacy and consent basics

Two sets of rules shape how you handle enquiries

When someone sends an enquiry, they hand you personal information: a name, a phone number, an email, sometimes details about their situation. Two separate sets of Australian rules shape what you can do with it. The Privacy Act, through the Australian Privacy Principles, governs how you collect, use, store and disclose personal information. The Spam Act governs the marketing emails and text messages you send afterwards. They cover different things, so meeting one does not mean you have met the other.

Whether the Privacy Act applies to you depends on your business. The OAIC says a small business is one with an annual turnover of $3 million or less, and most small businesses are not covered. But some are, regardless of turnover, including health service providers and any business that trades in personal information. The Spam Act has no such exemption: it applies to every business that sends marketing messages. Treat the privacy principles below as good practice even if you are currently exempt, because customers expect them and your obligations can change as the business grows.

Collect only what you genuinely need

A core privacy principle is to collect only the personal information you reasonably need for what you actually do. Australian Privacy Principle 3 says an entity must not collect personal information unless it is reasonably necessary for one or more of its functions or activities. In practice that means an enquiry form should ask for what you need to reply and to judge whether you can help, and little else. Every extra field is more information to justify, to secure and eventually to dispose of.

It helps to separate the details you need now from the ones that can wait for a conversation. A name and one contact method let you respond. A short set of qualifying questions tells you whether the enquiry is a fit. Asking for a home address, a date of birth or financial details before you have even spoken rarely earns its place, and it can put people off submitting at all.

Keep readingDecide which questions your form needs

Tell people what happens to their details

People should understand what they are handing over and why, at the moment they do it. Australian Privacy Principle 5 says that when you collect personal information you should take reasonable steps to make the person aware of who you are and how to contact you, why you are collecting the information, who you typically disclose it to, and how they can find your privacy policy. You do not need a wall of text on the form; a short, plain sentence near the submit button, with a link to a fuller privacy policy, does the job.

Be honest and specific about what comes next. If a third party, such as an advertising platform or a CRM, will receive the details, say so in your policy. If you rely on an external booking tool or email provider, that is part of the picture too. A clear collection notice is not just compliance. It sets the expectation that you will handle the enquiry professionally.

Get consent before you market to them

Answering an enquiry is not the same as marketing to someone. The Spam Act says you must have consent before you send marketing emails or text messages, and it is up to you to prove you have it. Replying to the specific enquiry a person made is fine. Adding them to a newsletter or a promotional list is a separate step that needs its own permission, and you cannot send a message just to ask for that permission, because that message is itself marketing.

Consent can be express or inferred. Express consent is the reliable kind: someone knowingly agrees to receive marketing, for example by ticking a clearly worded box on your form that they actively select. Keep a record of who consented, when and how. Inferred consent is narrow. The ACMA says you can only infer it when someone has a provable, ongoing relationship with your business and the marketing is directly relevant to that relationship, and it does not cover messaging someone simply because they recently bought from you. A pre-ticked box or a purchased list is not consent.

Identify yourself and make unsubscribe easy

Every marketing message you send must clearly say who it is from. The Spam Act requires each commercial electronic message to accurately identify your business and include current contact details. Use your correct legal business name, or your name and ABN, and keep that information accurate for at least 30 days after sending. If someone sends messages on your behalf, the message still has to identify you as the business that authorised it.

Every marketing message must also include a working unsubscribe option. Under the Spam Act it has to present its instructions clearly, must not charge a fee or require the person to log in or create an account, and must keep working for at least 30 days. You have to honour an unsubscribe request within 5 working days. Set up your systems so opt-outs are actioned promptly and completely, because continuing to message someone who has unsubscribed is exactly what the rules are designed to stop.

Keep readingKeep automated reminders separate from marketing

Store it securely and use it only for the reason you collected it

Once an enquiry is in your systems, two habits keep you on the right side of the principles. First, use the information for the purpose you collected it, not a new one the person would not expect. Australian Privacy Principle 6 limits using or disclosing personal information beyond that primary purpose unless the person consents or would reasonably expect the secondary use. Second, protect it. Australian Privacy Principle 11 says to take reasonable steps to protect personal information from misuse, loss and unauthorised access, and to destroy or de-identify it when you no longer need it.

In everyday terms, that means enquiry details belong in a system with proper access controls rather than a shared inbox anyone can open, that only the people who handle enquiries can see them, and that you clear out old records you no longer have a reason to keep. Review your form, your privacy policy and your marketing lists from time to time, because both your obligations and your business change.

Keep readingGet enquiries to someone who can act

Keep readingSee what your privacy policy must say about automated decisions