How to set up a small online business legally in Australia

You've decided to launch an online business in Australia. Maybe you've already settled on a product or service, picked a platform, and started sketching out pricing. At this point, the legal and administrative setup becomes unavoidable — not because regulators are watching over your shoulder on day one, but because the registrations, documents, and policies you put in place now determine how securely you can trade, how clearly you can enforce your terms, and how much you'll need to retrofit later when things get more complex.

Work through each step in the order below. Some steps can overlap, but most depend on the ones before them. When you reach the end, you'll have an ABN, a registered business name, a compliant website, a core set of legal documents, and a tax registration setup that matches your turnover.

Note: registering a business name or a domain name does not give you exclusive rights to use that name across Australia. Brand protection requires a separate trade mark filing — that step is addressed below, but it is not the same thing as a business name or domain registration, and confusing the two is one of the most common and costly mistakes founders make.

Prerequisites

Before you begin the steps below, make sure you have:

A decision on your business structure (sole trader, partnership, or company) — this determines which entity holds your ABN and business name, and restructuring later carries cost and complexity.
Your personal identity documents to hand: a Tax File Number and, for company registration, 100 points of ID for each director.
A chosen business name that you have searched against the ASIC business names register, the IP Australia trade marks database, and common domain registrars to check availability across all three.
A realistic revenue estimate for the next 12 months — you'll need this to determine whether GST registration is mandatory or optional at launch.
If you are registering a company: a decision on your registered office address (which becomes a public ASIC record) and the names and addresses of each director and shareholder.

The step that most often trips people up at this stage is business name availability. Finding that your preferred name is already registered — or close enough to cause confusion — after you've designed a logo and built a website is an expensive problem. Run the searches first.

Apply for an ABN through the Australian Business Register

Your Australian Business Number (ABN) is the foundation of your trading identity. You need it to issue invoices, open a business bank account, register for GST, and interact with government agencies. Without an ABN, suppliers may withhold 47% of payments under the PAYG withholding rules.

You register through the Australian Business Register (ABR), which is administered by the ATO. The online application is free and takes around 15–20 minutes if you have your details ready. Key fields include:

Entity type (individual/sole trader, partnership, company, trust, or other)
Business activity description — be accurate; this affects how the ATO categorises your business
Business address (a physical address, not a PO box)
Associate details (directors or partners, depending on structure)

The ABR issues ABNs in real time in most cases, though some applications are referred for manual review, which can add several business days. Once issued, your ABN appears on the public ABR register.

At the same time you apply for your ABN, you can also register your business name and apply for GST through the same portal — doing these together saves time and avoids a second login session.

Register a business name with ASIC

If you will trade under any name other than your own legal name (for sole traders) or your company's registered name, you must register a business name with ASIC. This applies even if the name is a minor variation on your legal name.

Registration is done through ASIC Connect or the Business Registration Service and requires:

An active ABN (the business name is linked to your ABN)
Your chosen business name — ASIC will reject names that are identical to existing registered names or names that are reserved or restricted
A registration period: one year or three years (three-year registration is better value if you intend to trade under the name long-term)

Registration fees are set by ASIC and are payable at the time of application. ASIC will email you a certificate of registration.

What registration does not do: A registered business name gives you the right to trade under that name in Australia's business names register. It does not give you exclusive intellectual property rights to the name. If another business was already using that name as a trade mark, they may still be able to require you to stop using it. Separate trade mark protection — filed with IP Australia — is what creates enforceable exclusivity.

Register for GST if your turnover reaches the threshold

Under the A New Tax System (Goods and Services Tax) Act 1999 (Cth), you must register for GST if your annual GST turnover is $75,000 or more. For not-for-profit organisations, the threshold is $150,000. If you are below the threshold, registration is voluntary but may still make sense if your customers are businesses that can claim input tax credits.

Registration is done through the ATO — either via the ABR portal (if you are registering at the same time as your ABN) or through the ATO's Business Portal. Once registered, you must:

Add GST to your prices or absorb it into your existing prices (10% of the GST-exclusive price)
Lodge Business Activity Statements (BAS) either monthly, quarterly, or annually, depending on your turnover and reporting arrangements
Keep records of all taxable sales and purchases

If you sell digital products or services to Australian consumers and you are a non-resident business, different GST rules for cross-border supplies apply. Conversely, if you sell to overseas customers, those supplies may be GST-free — but the rules depend on the nature of the supply and where the customer is located.

The step that most often causes problems here is crossing the $75,000 threshold partway through the year without noticing. You are required to register within 21 days of the date you first exceed (or expect to exceed) the threshold. Late registration can result in a GST liability calculated from the date you should have registered, plus penalties and interest.

Secure your domain and build a compliant website

Register a domain that matches your brand. If a .com.au is available, secure it alongside .com to prevent others from registering a confusingly similar address. You need an ABN (already obtained) to register a .com.au domain through an ICANN-accredited registrar.

Before your website goes live, it must include:

Website Terms and Conditions: governing use of the site, acceptable behaviour, intellectual property ownership, and limits on liability
Customer Terms (or Online Sales Terms): your contract with buyers covering pricing, payment, delivery, cancellations, returns, and dispute processes
Privacy Policy: explaining how you collect, use, store, and disclose personal information — including cookies, analytics, and any third-party data processors

Under the Privacy Act 1988 (Cth), the small business exemption generally applies to businesses with an annual turnover of $3 million or less. However, the exemption does not apply if your business provides health services, trades in personal information for benefit, is contracted to deliver services to the Commonwealth, or handles other prescribed categories of sensitive information. Even if you are exempt, a clearly written Privacy Policy is expected by customers, required by most payment platforms and app stores, and strongly advisable as a baseline protection. Full guidance on the Australian Privacy Principles is available from the Office of the Australian Information Commissioner.

Cookie consent banners are not universally required under Australian law. However, if you collect data from users in the EU or UK, you must comply with their stricter consent requirements — this is relevant even for Australian businesses if you accept international traffic.

Put your core legal documents in place

Legal documents are not optional extras — they are how you enforce your rights, manage disputes, and demonstrate to customers and platforms that you operate professionally. The standard suite for a small online business includes:

Website Terms and Conditions — covers use of the site or app, intellectual property ownership (your content, your code), acceptable use restrictions, and how liability is limited. Keep these separate from your Customer Terms so that each document does its job cleanly.

Customer Terms (Online Sales Terms) — your enforceable contract with buyers. Must address pricing, payment methods, delivery timeframes, subscription renewal cycles (if applicable), cancellation rights, returns and refund processes, and how disputes are handled. Your terms can add clarity around consumer rights, but they cannot strip away the mandatory guarantees that apply under the Competition and Consumer Act 2010 (Cth) Schedule 2 (the Australian Consumer Law). Any clause that purports to exclude or limit those rights is void.

Privacy Policy — required in practice even where legally optional. Should explain what personal information you collect, why, how it is stored, who it is disclosed to, how individuals can access or correct their information, and how to make a privacy complaint.

Supplier and contractor agreements — written contracts for anyone who helps you deliver your product or service. Key provisions are scope of work, deliverables, payment terms, IP ownership and assignment, confidentiality, and termination. IP assignment is the clause people most often skip: if you commission a developer, photographer, or designer and there is no written IP assignment, the default position under Australian copyright law is that the creator retains ownership of the work.

Employment contracts — if you hire employees (including remote staff), you must comply with the Fair Work Act 2009 (Cth). Minimum entitlements include pay at or above the applicable modern award rate or the National Minimum Wage (as reviewed annually by the Fair Work Commission), leave entitlements, and superannuation contributions at the rate required under the Superannuation Guarantee — currently 12% of ordinary time earnings as of 1 July 2025. A properly drafted employment contract sets expectations and reduces disputes, but it cannot contract out of these statutory minimums.

Set up payment processing and comply with the Spam Act

Choose a payment gateway (such as Stripe, Square, or PayPal) rather than attempting to process or store raw card data yourself. Card payment processing in Australia must comply with the Payment Card Industry Data Security Standard (PCI-DSS), and reputable gateways handle the technical compliance burden on your behalf. Your Customer Terms should clearly explain your refund, chargeback, and recurring billing practices.

If you send marketing emails or SMS messages to customers or prospects, the Spam Act 2003 (Cth) applies. The three requirements are:

Consent: the recipient must have consented, either expressly or by clear inference from their conduct
Identification: the message must clearly identify who sent it and include accurate contact details
Unsubscribe: every commercial message must contain a functional unsubscribe mechanism, and unsubscribe requests must be actioned promptly

Breaching the Spam Act 2003 (Cth) can result in significant civil penalties. The Australian Communications and Media Authority (ACMA) enforces the Act and has imposed multi-million dollar penalties against repeat or high-volume offenders.

Where Artificer Legal can help

Navigating the registration sequence and drafting the right documents is straightforward in theory — in practice, it's easy to register in the wrong entity name, use generic template terms that don't reflect how you actually operate, or miss an IP assignment that causes a dispute later. An Artificer Legal practitioner can:

Advise on the right business structure before you register, so you don't have to restructure once you're trading
Review your chosen business name and trade mark availability and, where appropriate, file a trade mark application with IP Australia to protect your brand
Draft tailored Website Terms, Customer Terms, and a Privacy Policy that reflect your actual products, payment model, and delivery arrangements
Prepare supplier and contractor agreements with IP assignment clauses that ensure you own what your business creates
Draft employment contracts that comply with the applicable modern award and the Fair Work Act 2009 (Cth), and advise on superannuation obligations
Review your GST registration status and BAS obligations as your turnover grows

If you are buying an existing online business rather than building from scratch, Artificer Legal can also assist with contract review, due diligence on domain and IP ownership, and structuring the acquisition to limit your exposure to the seller's historical obligations.

The step that determines whether you succeed

The single most consequential thing you do in this process is choosing the right business structure before you register. Everything else — your ABN, your business name, your contracts, your tax registrations — is linked to the entity you first register. Changing structure after you've started trading requires new registrations, contract variations, potential stamp duty, and a restart of the brand and IP paper trail. Founders who incorporate too late often discover the cost when they seek investment or face a dispute and find their IP is held by the wrong entity, or not held at all.

To summarise: apply for your ABN through the Australian Business Register and simultaneously register your business name with ASIC if you need one. Register for GST once your annual turnover reaches (or is expected to reach) $75,000. Build a compliant website with Website Terms, Customer Terms, and a Privacy Policy before you take your first payment. Use written agreements with suppliers and contractors — especially IP assignment clauses. If you hire staff, comply with the Fair Work Act 2009 (Cth) minimum entitlements and the Superannuation Guarantee. Set up a reputable payment gateway rather than processing card data yourself. And comply with the Spam Act 2003 (Cth) for any marketing communications. Done in order, this process gives you a trading foundation that can scale without being rebuilt.