Privacy Act and chargebacks: what Australian Shopify sellers should check before sharing customer data

A jewellery seller in Newcastle gets a chargeback and sits down to answer it. The best evidence she holds is a screenshot of the customer's emails, with a name, a phone number and a home address. She pauses. Is she allowed to send that to the bank? Is it safe to paste it into a chargeback tool that runs on servers overseas? Does the Privacy Act even apply to a business her size? Questions about the Privacy Act and chargebacks come up the moment a seller moves from running a shop to defending one, and most guides skip them.

The Privacy Act is Australia's federal privacy law, and whether it binds your business depends on its size and what you do. Most small businesses with annual turnover of A$3 million or less are not covered, with exceptions, and a business can opt in. If you are covered, the Australian Privacy Principles apply, including APP 8, which deals with sending personal information outside Australia. This guide sets out what the OAIC says about the small business line, APP 6 (use and disclosure) and the cross-border rule, and a practical routine for handling customer data in disputes: collect only what the dispute needs, send it to the right place, and check any tool you use before you paste anything into it. This is general information, not legal advice.

This guide is for you if:

• You sell from an Australian Shopify store and handle disputes with customer names, addresses and emails as evidence.
• You use, or are considering, a chargeback tool or agency and want to know what to check about customer data.
• You are unsure whether the Privacy Act applies to your business.

Last updated: 22 October 2026. Written by the ChargeFix team. Reviewed against sources on 22 October 2026. General information, not legal or financial advice.

Disclosure. ChargeFix is a chargeback tool, so I have a commercial interest in tools being used. Sources, read on 22 October 2026: the OAIC's page on small businesses opting in to the Privacy Act, its APP 6 guidelines on use and disclosure, its APP 8 guidance on cross-border disclosure, its quick reference to the principles, Shopify's chargeback pages and ChargeFix's own privacy documents. I did not read the Privacy Act itself or the OAIC's guidance on privacy policies, access rights, data breaches or retention, so this guide does not cover them and gives no penalty figures. Examples are made up. Take advice from a privacy lawyer for your own case.

The 30-second answer (TL;DR)

• Under the OAIC's page, a business turning over A$3 million or less a year is generally outside the Privacy Act, but there are exceptions, and "other situations" can bring it back in.
• If you are covered, the cross-border rule asks you to take reasonable steps before disclosing personal information to recipients abroad, and hiring a contractor abroad to do a job usually counts as a disclosure.
• Many chargeback tools host data overseas, so treat tool choice as a privacy question, not just a price question.
• APP 6 allows a secondary use where it is a reasonable expectation and relates to the original purpose. Defending a payment for the sale fits that test on its face; send only what the dispute needs.
• Whatever your status, collect less, send less and keep a record of where customer data went.

Do this today (10 minutes):

1. Write down your last 12 months of turnover and whether you sell health-related goods or trade in personal information.
2. List every tool that touches dispute evidence: Shopify, email, any chargeback app or agency.
3. For each tool, note where it is hosted, if the vendor says.

How customer data moves in a dispute

Stage	Where customer data sits	The question to ask
Order	Shopify admin	Who in your team can see it?
Evidence gathering	Your inbox, courier site, spreadsheets	Are copies left on laptops?
Tool or agency	A vendor's servers	Where, and under what contract?
Response to the bank	Shopify's dispute screen	Are you sending only what the dispute needs?
After the case	Your archive	How long do you keep it?

Does the Privacy Act apply to your Shopify store?

The OAIC's page on small businesses opting in says most small businesses and not-for-profits with an annual turnover of A$3 million or less are not covered by the Privacy Act. It also says the exemption does not apply to health service providers or to organisations that trade in personal information, and that "other situations" can bring a small business under the Act, in whole or in part. A small store can also choose to opt in.

Your situation	What the OAIC page suggests	What to do
Turnover over A$3 million	Not within the small business exemption	Treat the Privacy Act as applying
Turnover A$3 million or less, no exceptions	Generally not covered	Confirm with advice; consider acting as if covered
Health service provider	Exemption does not apply	Treat as covered
Trade in personal information	Exemption does not apply	Treat as covered
Opted in	Covered, with a privacy policy on a public register	Follow the Act
Unsure	The page lists other situations	Get advice

The OAIC page does not list every "other situation", so confirm your position with a lawyer rather than relying on turnover alone. A cautious stance that costs little is to behave as if the Act applies and to publish a clear privacy statement.

What does the Privacy Act exemption mean in practice?

The OAIC page says the exemption removes most small businesses from the Act. It does not say exempt businesses may ignore privacy, and your customers, your payment provider and your own tools will still expect care. A business that opts in under section 6EA agrees to follow the Act, publishes a privacy policy and is listed on a public register.

Question	Covered business	Exempt small business
Must follow the Australian Privacy Principles	Yes	Not generally, per the OAIC page
Can still be asked by customers about their data	Yes	Yes, as a matter of good practice
Can choose to opt in	Already covered	Yes, free, via the OAIC process
Needs a privacy policy	Yes	Needed if you opt in, wise anyway

Customers who buy from you do not know your turnover. A short policy, a named contact and a habit of sending only what is needed protect your reputation whatever the law says.

What is APP 8, and why do overseas tools matter?

APP 8 deals with disclosing personal information to someone abroad. In the guidance I read, the rule is that before an organisation discloses personal information overseas it must take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, usually through an enforceable contract. The OAIC also says that an organisation can be accountable for the recipient's breach, and that using an offshore contractor to perform services is generally a disclosure.

Point in the OAIC guidance	What it means for a dispute tool
Reasonable steps before overseas disclosure	Check the vendor's contract and security before you connect it
Usually an enforceable contract	Look for a data processing agreement
Accountability for the recipient's breach	A vendor's mistake can become your problem
Overseas contractor performing a service is generally a disclosure	A US-hosted chargeback tool is likely an APP 8 question
Exceptions exist, such as substantially similar law or consent after being told the rule will not apply	Do not rely on an exception without advice
Overseas cloud storage can be a "use", not a disclosure, if you keep effective control	The contract and your being able to retrieve or delete it matter

That last point is nuanced. The guidance I read says cloud storage held abroad can be treated as a use where the organisation keeps effective control, for example through contract limits, subcontractors being bound and being able to get data back or delete it. Whether a particular tool meets that test is a question for advice, not for a blog.

Which chargeback tools host data abroad, and why does the Privacy Act care?

Many chargeback tools are built and hosted in the United States. As an example, one vendor's materials I read describe hosting on AWS in the US East region. Hosting is a fact to ask each vendor for, not a reason to rule one out.

Question to put to any vendor	Why it matters
Where is customer data stored and processed?	Tells you whether the cross-border rule is in play
Which sub-processors do you use, and where?	Cloud hosts and AI providers can sit abroad
Do you offer a data processing agreement?	It is the usual enforceable contract
What do you store, and what do you only read?	Less stored means less to protect
How long do you keep it?	No retention period is a gap to note
Is customer content used to train AI models?	Should be answered in writing
How do I delete my data?	You need an exit

A vendor that answers these in writing is easier to trust than one that does not. If the answers are missing from public documents, ask by email and keep the reply.

What did I find in ChargeFix's documents about the Privacy Act?

You should hold ChargeFix to the same questions. In its privacy documents, ChargeFix describes the merchant as the controller and ChargeFix as the processor. It says it stores case ID, amount, reason, status, dates and shop settings, and that it does not store customer names, emails, addresses or rebuttal letters, which it reads from Shopify only while a merchant is reviewing. It lists sub-processors including Shopify, a database provider, an unnamed cloud host, an AI provider (it does not say which) and an optional tracking lookup service.

Item	What the documents say	Gap to note
Role	Merchant is controller, ChargeFix is processor	None
Data stored	Case details and settings	None
Data not stored	Customer names, emails, addresses, letters	Verify in your own use
Hosting region	Not stated	Ask before you install
AI provider	Not named	Ask
Retention	No fixed periods	Ask
Permissions	Described in words, not named in the privacy policy	Check at install

I include this because it would be odd to advise you to ask vendors hard questions and then exempt my own. Ask us too.

Does the Privacy Act allow you to share customer data with the bank?

The OAIC's APP 6 guidelines give the test. An entity should use or disclose personal information only for the purpose it was collected, which is the primary purpose, unless an exception applies. Any other purpose is secondary.

APP 6 exception	What the OAIC guidance says	Does it help in a dispute?
Consent	The person agreed to the secondary use or disclosure, expressly or by implication	Helps if your checkout terms and privacy policy say disputes involve sharing order details
Reasonable expectation and related purpose	A reasonable expectation plus a related purpose; the test is objective and a tenuous link is not enough	The strongest fit for defending a sale
Required or authorised by law	Required or authorised by Australian law or a court or tribunal order	Depends on the facts
Permitted general situation	Includes taking action on suspected unlawful activity or serious misconduct, if you reasonably believe the use or disclosure is necessary	May apply to a fraud dispute
Enforcement activity	Necessary for enforcement by an enforcement body, with a written note	Rarely relevant

For a customer's order, the primary purpose is fulfilling the sale. Answering a payment dispute about that sale is closely related, and most customers would expect a seller to explain the transaction to the bank when asked. That reasoning is mine, applied to the OAIC's test, and a lawyer can confirm it for your business. The test also shows the limits. Sending unrelated parts of a customer's file, using dispute data to market to them, or handing everything to a third-party tool without a contract are not obviously within it.

Situation	Reasoning under APP 6	Safer practice
Order and delivery details to the bank through Shopify	Related to the sale	Send what the dispute needs
Customer emails about the order	Related to the sale	Quote the relevant lines
Unrelated parts of the customer's file	Not needed for the dispute	Leave out
Marketing to the customer using dispute data	A different purpose	Do not
Passing data to an overseas tool	The cross-border rule also applies	Contract, hosting check

How do you collect less customer data in a dispute?

Minimising is the cheapest Privacy Act compliance step and it improves your responses. A reviewer wants a clear story, not a pile of personal details.

Evidence	What the dispute needs	What to leave out
Customer emails	The lines about the order, the dates, the promises	Phone numbers, signatures, unrelated chat
Delivery proof	Tracking, scan, signature	Photos showing people or interiors beyond the doorstep
Order page	Items, dates, payment details as shown	Internal notes about the customer
ID checks	The fact that a check was done	Copies of ID documents
Screenshots	The relevant section	Full inbox views

Redact what is not needed before you attach it. Keep the unredacted original in your own records.

Redaction checklist before attaching evidence

[ ] Crop screenshots to the relevant part
[ ] Black out phone numbers, other addresses and card details not on the order
[ ] Remove other customers' names
[ ] Remove internal notes
[ ] Save the redacted file with the dispute ID in its name
[ ] Keep the original in the order folder

What should your privacy notice say about disputes?

If you are covered, or have opted in, you need a privacy policy. If you are not, a short one still helps. For disputes it should say, in plain words, that you may share order and delivery details with your payment provider and the customer's bank to answer a dispute or prevent fraud.

Policy element	Plain wording example
What you collect	"Your name, address, email, phone and order details."
Why	"To process your order and answer questions about it."
Disputes	"If a payment is disputed, we may share order and delivery details with our payment provider and your bank."
Tools and providers	"We use service providers, some of which may store data outside Australia."
Contact	"Email privacy@yourshop.example to ask about your information."
Retention	"We keep order records for [period]."

Have a lawyer check the final wording. Do not copy another shop's policy without reading it.

How should you record where customer data went under the Privacy Act?

A short log of tools and recipients answers most questions you will ever face about your data. Keep it simple.

Recipient	What they receive	Where hosted	Contract	Date reviewed
Shopify	Orders, customers, disputes	Per Shopify	Shopify terms	22 Oct 2026
Email provider	Customer emails	[as stated by provider]	Provider terms	[date]
Chargeback tool	Disputes, orders for review	[ask vendor]	[DPA?]	[date]
Courier	Name, address, phone	[per courier]	Courier terms	[date]

The log is an honest record of what you know and what you have yet to ask. Fill the blanks over time.

How do you apply the Privacy Act to each evidence type?

Each kind of evidence carries a different amount of personal information. Handle the sensitive ones with more care.

Evidence type	Personal information inside	Handling under the Privacy Act mindset
Order page	Name, address, email, items	Attach as needed, avoid internal notes
Courier delivery proof	Name, address, signature, doorstep photo	Crop photos, share only to the bank via Shopify
Customer emails	Name, email, sometimes phone and other details	Quote relevant lines, redact the rest
IP and device data	Technical identifiers	Share only what Shopify's dispute screen asks for
ID checks	Document details	State the fact of a check, never attach copies
Support chat logs	Names, possibly sensitive remarks	Excerpt only the relevant exchange

This table is about habit, not law. The Privacy Act asks you to think about purpose, and each row above asks what the dispute needs.

How do APP 6 and APP 8 work together under the Privacy Act?

Choosing a tool raises two separate questions under the Privacy Act, and the OAIC treats them separately. APP 6 asks whether the disclosure or use is allowed at all. APP 8 asks, once it is allowed, what you must do before the information goes abroad.

Step	Question	OAIC source point	What to do
1	Is the Privacy Act binding on my business?	Small business exemption at A$3 million or less, with exceptions	Check turnover and the exceptions
2	Is using the tool a use or disclosure for the original purpose, or a secondary one?	APP 6 primary and secondary purposes	Treat dispute handling as related to the sale and check it with a lawyer
3	Does the tool hold data abroad?	Cross-border rule: a contractor abroad performing a service is generally a disclosure	Ask the vendor where it hosts
4	If yes, what contract is in place?	Cross-border rule: reasonable steps, usually an enforceable contract	Get a data processing agreement
5	Can I keep control of the data?	Cloud storage can be a use if you keep effective control: contract limits, bound subcontractors, being able to retrieve or delete it	Ask for those terms in writing
6	How is it protected?	APP 11: reasonable steps against misuse, interference and loss	Ask about encryption and access

The Privacy Act does not say which tool to choose, and the Privacy Act is not a certification scheme. It says what to be able to show if someone asks how you handled customer data. A short file with the vendor's written answers, the contract and the date you asked is the proof.

What does APP 11 mean for the Privacy Act and your dispute files?

APP 11 requires an entity to take reasonable steps to protect personal information from misuse, interference and loss, and to destroy or de-identify it in certain circumstances. The OAIC quick reference does not say what those circumstances are, so ask a lawyer about retention. The protection duty is easier to act on, and most dispute files are a risk because they pile up in inboxes and downloads.

Place where dispute data collects	Risk	Habit
Email attachments	Copies on phones and shared mailboxes	Keep the dispute file in one folder and delete duplicates
Screenshot folders	Unredacted customer details	Redact before saving the evidence copy
Downloaded courier proofs	Names, addresses and signatures	Store with the order, not on the desktop
Spreadsheets	Customer lists reused for other purposes	Keep order numbers, not full details
Shared drives	Wide access	Limit access to those who handle disputes

These habits matter whether or not the Privacy Act binds you, because a lost laptop or a misdirected email is a problem for your customers either way.

What is a dated plan for Privacy Act safe dispute handling?

This plan starts on Monday 26 October 2026 and finishes in January 2027.

Date	Task	Output
Mon 26 Oct	Work out your turnover position and whether any exception applies	A one page note
Tue 27 Oct to Fri 30 Oct	List every tool that touches dispute evidence	A tool list
Mon 2 Nov to Fri 6 Nov	Send the vendor questions to each tool in writing	Questions sent
Mon 9 Nov to Fri 13 Nov	Write or update your privacy statement with the dispute line	A published policy
Mon 16 Nov to Thu 26 Nov	Adopt the redaction checklist	A habit
Fri 27 Nov	Black Friday: expect more disputes later, check vendor replies	A decision on each tool
Mon 14 Dec	Book advice from a privacy lawyer on open questions	An appointment
Mon 4 Jan to Fri 29 Jan 2027	Answer post-sale disputes with redacted evidence	Responses filed in time

What is different for Australian merchants?

The dispute fee on Shopify Payments in Australia is A$25, returned only if you win. Shopify says the card issuer decides, and Shopify Protect is limited to US stores on its own page. For privacy, the points above apply: the A$3 million small-business line, the exceptions, the cross-border rule and the question of foreign vendors.

What to settle with a lawyer: whether an exception takes your business outside the small-business exemption, how any recent amendments apply, and the hosting and contract terms of each vendor you use.

What are the common mistakes with the Privacy Act and chargebacks?

1. Assuming you are exempt without checking. Turnover is not the only test.
2. Pasting customer data into a tool without asking where it goes. The cross-border rule may be in play.
3. Attaching full inbox screenshots. Crop to the relevant lines.
4. Sending ID documents. The dispute needs the fact of a check, not the copy.
5. Having no policy. Even exempt businesses benefit from one.
6. Forgetting retention. Old dispute files are a risk with no benefit.
7. No record of recipients. You cannot answer a customer's question about their data.
8. Trusting a vendor's summary without a contract. Ask for the agreement.
9. Submitting before the response is complete. Shopify says early submission locks your edits.
10. Missing the deadline. After it passes, only Shopify's automatic evidence goes in.

Frequently asked questions

Does the Privacy Act apply to my small Shopify store?

Under the OAIC's page, firms turning over A$3 million or less a year are generally outside the Privacy Act, but exceptions exist, including health service providers and organisations that trade in personal information, and "other situations" can apply. Smaller firms can opt in. Take advice, and consider acting as if the Act applies.

What is APP 8 in the Privacy Act, in plain terms?

APP 8 deals with disclosing personal information to recipients abroad. The OAIC guidance I read says an organisation should take reasonable steps, usually through an enforceable contract, to ensure the offshore recipient does not breach the Australian Privacy Principles, and that engaging a contractor abroad to provide a service will usually be a disclosure.

Is a US-hosted chargeback tool a problem?

Not automatically, but it is a cross-border question if you are covered. Ask where data is stored, which sub-processors are used, whether a data processing agreement is offered, and how data is deleted, since the Privacy Act expects reasonable steps. Ask in writing and keep the reply.

Does the Privacy Act let me send a customer's emails to the bank as evidence?

APP 6 allows a secondary use that is a reasonable expectation and relates to the primary purpose, which for a sale is fulfilling and standing behind the order. Send only the lines about the order, redact unrelated details and keep the original. A lawyer can confirm your case.

What does a lost dispute cost in Australia?

On Shopify Payments the disputed amount and a A$25 fee leave your balance when the chargeback opens, and the fee returns only if you win. On a A$180 order that is A$205 at once. Sending less personal data does not change that arithmetic, but it lowers other risks.

Do I need a privacy policy if I am exempt?

The OAIC page says a business that opts in needs a privacy policy and is listed on a public register. For exempt businesses the page does not say a policy is required, but a short, plain one is sensible because customers expect to know what you do with their information.

What should I ask a chargeback vendor about customer data?

Ask where data is stored and processed, which sub-processors it uses and where, whether it offers a data processing agreement, what it stores and what it only reads, how long it keeps data, whether customer content trains AI models, and how you delete your data. Get answers in writing.

Does ChargeFix store customer names and addresses?

ChargeFix's documents say it does not store customer names, emails, addresses or rebuttal letters, and that it reads them from Shopify while a merchant reviews a case. The documents do not state the hosting region, name the AI provider or give retention periods. Ask before installing if those matter to you.

How long does the Privacy Act let me keep dispute files?

APP 11 requires an entity to take reasonable steps to protect personal information from misuse, interference and loss, and to destroy or de-identify it in certain circumstances; the page I read does not say what those circumstances are, so ask a lawyer for a retention period. In practice, keep dispute files only as long as you need them to answer the bank or the customer, then delete them, and note the schedule in your privacy policy.

Should I get legal advice about the Privacy Act?

Yes, for the open questions: whether the exemption applies, whether your use of a tool is a disclosure abroad, and what your policy must say. A short consult on the Privacy Act is cheaper than an error. Use this guide to prepare questions, not to replace the advice.

Start free trial with ChargeFix

For the Privacy Act and chargebacks, the safest habit is to send less and know where it goes. ChargeFix reads the real order, payment, tracking and delivery data for each Shopify Payments dispute, scores the evidence and drafts the response from your own records, never inventing facts. You review and file it, or let Auto mode handle them. Start free trial

Sources

• APP 6 Use or disclosure of personal information, OAIC
• Australian Privacy Principles quick reference, OAIC
• Opting in to the Privacy Act, OAIC
• APP 8 Cross-border disclosure of personal information, OAIC
• Chargebacks and inquiries, Shopify Help Center
• Responding to chargebacks and inquiries, Shopify Help Center
• Shopify Protect, Shopify
• ChargeFix privacy statement