Charity Policy Pack | ACNC & Privacy Act 1988

A grant-ready policy pack is a bundle of the operational policies that funders, banks, and insurers routinely request before releasing money or cover. It is not a constitution and it does not replace one. Your constitution or rules set out who governs the organisation and how decisions are made at the member and committee level. A policy pack sits underneath that, governing the day-to-day conduct that a grant agreement cares about: what happens when someone complains, who can approve a payment, and how you look after the personal data of members, donors, and clients.

The three policies in this pack are the ones that appear on almost every funder due diligence template. A complaints handling policy shows you take feedback seriously and resolve disputes fairly, which the ACNC treats as a marker of accountability to members. A privacy policy is a legal obligation for many organisations under the Australian Privacy Principles and a trust signal for everyone else. A financial controls policy covers cash handling, payment approvals, and reimbursements, and it is the single document a grant acquittal officer will look for first. Together they demonstrate that your committee has thought about risk before something goes wrong, not after. That distinction is exactly what separates a funded application from a rejected one.

Three separate regimes shape these policies, and knowing which one applies to your organisation matters. If you are a registered charity, the Charities Act 2013 (Cth) and the six ACNC Governance Standards are your baseline. Governance Standard 2 requires you to be accountable to your members, and the ACNC treats clear processes for raising complaints and disputes as one way to meet it. Governance Standard 3 requires you not to commit serious offences, which pushes toward proper financial oversight, and Governance Standard 5 places duties of care, diligence, and good faith on your Responsible People, the board or committee members who direct the charity. Financial controls and data-handling policies are the practical evidence that those duties are being carried out rather than merely promised.

Privacy is governed federally by the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles. The threshold most NFPs watch is annual turnover: organisations with turnover above A$3 million are bound as APP entities, though many smaller charities are caught anyway if they provide health services or handle certain sensitive information. APP 1 requires a clear, up-to-date and publicly available privacy policy, and APP 11 requires reasonable technical and organisational security. Where the Notifiable Data Breaches scheme in Part IIIC applies, you must assess a suspected eligible breach within 30 days and notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable once serious harm is likely. You can read the regulator's own explanation in the OAIC guidance on the Notifiable Data Breaches scheme.

Financial controls draw on your incorporating law rather than a single statute. Incorporated associations answer to their state or territory Associations Incorporation Act; companies limited by guarantee sit under the Corporations Act 2001 (Cth). Neither prescribes a controls policy word-for-word, but both impose duties that a documented approval-and-reimbursement process helps you discharge. If you want a governance foundation that ties these threads together, our ACNC governance pack aligned to the Charities Act 2013 is the companion piece most committees adopt alongside these operational policies.

The most common trigger is a live grant application. A funder sends through a due diligence checklist, and buried in it is a request for your complaints, privacy, and financial policies, board-approved and dated. Committees that have never written these down suddenly have days to produce them. Adopting the pack in advance means you attach the documents rather than scramble, and it signals to the assessor that governance is business as usual for you, not a fire drill.

The second trigger is a close call that exposes a gap. A reimbursement goes to the wrong account, a member complains and nobody knows who should respond, or a spreadsheet of donor details is emailed to the wrong recipient. In practice, most disputes and losses trace back to a process that was never written down, so people improvised. A policy pack turns improvisation into a repeatable procedure your treasurer and secretary can point to.

Onboarding staff or scaling up volunteers is a third. Once you employ people under the Fair Work Act 2009 (Cth) or run a roster of volunteers with access to funds and personal data, informal habits stop being defensible. Our volunteer agreement and handbook template pairs naturally with a privacy and complaints policy so everyone knows the rules before they start. An edge case worth flagging: a bank tightening its know-your-customer checks can demand a financial controls policy before it will keep your account open, independent of any grant. And insurers pricing a directors and officers policy increasingly ask to see complaints and privacy procedures as part of underwriting.

• The complaints handling procedure sets out how a complaint is received, acknowledged, investigated, and closed, with realistic timeframes and a clear escalation path to the committee where the first responder cannot resolve it. It records who owns each stage so a complaint does not stall, and it includes a confidential channel for sensitive matters involving vulnerable people, which the ACNC's safeguarding expectations treat as essential.
• The privacy policy is drafted to APP 1 and describes what personal information you collect, why, how it is stored and secured, when it is disclosed, and how an individual can access or correct their record. It names a contact point for privacy queries and complaints, which the Australian Privacy Principles require, and states your position on overseas disclosure where you use cloud tools hosted offshore.
• The data breach response plan operationalises the Notifiable Data Breaches scheme, mapping the 30-day assessment window, the harm test, and the notification steps to the OAIC and affected individuals. It assigns a responsible person so the clock does not start running while everyone waits for the board to meet.
• The financial controls policy covers cash handling at events, the dual-approval threshold for payments, delegation limits, and the reimbursement process for volunteers and staff. It ties spending back to the committee's authority and gives your treasurer a defensible line to hold when someone asks for an out-of-process payment.
• The conflict of interest handling built into the approval workflow requires declarations and proper abstentions to be recorded, which the ACNC looks for when it reviews how a charity manages related-party transactions.

Because incorporated associations are regulated at state and territory level, the financial controls and complaints elements should sit comfortably alongside your specific Associations Incorporation Act rather than contradict it. In New South Wales, associations operate under the Associations Incorporation Act 2009 (NSW), administered by NSW Fair Trading, which sets financial reporting tiers by revenue and expects committee members to manage funds responsibly. A financial controls policy that reflects your tier's audit or review obligations reads as deliberate rather than boilerplate.

In Victoria, the Associations Incorporation Reform Act 2012 (Vic) is administered by Consumer Affairs Victoria and includes model rules that many associations adopt; your complaints and grievance procedure should dovetail with the dispute resolution mechanism in those rules rather than duplicate or override it.

In Queensland, the Associations Incorporation Act 1981 (Qld), overseen by the Office of Fair Trading, sets its own reporting levels and grievance procedure requirements, and the model rules there also address internal dispute handling. If your constitution already contains a dispute clause, your standalone complaints policy must complement it, not conflict with it, or you risk a member arguing the wrong process was followed.

Charities registered with the ACNC face the same Commonwealth Governance Standards regardless of which state they incorporated in, so the privacy and financial elements travel unchanged across borders. What shifts state to state is the incorporating law layer beneath them. If your not-for-profit is a company limited by guarantee, the state Associations Acts fall away entirely and the Corporations Act 2001 (Cth) governs, which changes the reporting and audit context your financial controls policy should reference. Our incorporated association constitution aligned to the state Acts is the document to check your policy pack against before you adopt it.

You begin by telling the form what structure you are: an incorporated association, a company limited by guarantee, or an unincorporated group planning to formalise. From there the pack adjusts the financial reporting language and the statutory references so an incorporated association in Queensland does not end up citing the Corporations Act. You then indicate whether you are ACNC-registered, which switches on the Governance Standards framing and the safeguarding language in the complaints procedure.

Next you set your financial control thresholds. You choose the dollar figure above which a second signatory is required, name the roles that hold delegated authority, and confirm how reimbursements are claimed and approved. The privacy section asks what categories of personal information you actually collect and whether you use any overseas-hosted software, so the APP-facing clauses match your real practice rather than a generic template. The last step is the part committees skip and regret: you take the pack to a properly convened meeting, record the resolution adopting each policy, and date it. A funder wants to see not just the policy but the minute approving it. Our AGM minutes and resolutions pack gives you the resolution wording to do that cleanly, and the full Australian non-profit and charity document library rounds out anything the pack does not cover.

The mistake that costs the most is adopting a policy that describes an organisation you are not. A privacy policy promising encryption and access logs you do not have is worse than none, because the OAIC actively checks whether a policy reflects actual practice, and a funder who catches the mismatch stops trusting the rest of your application. Write the policy to what you genuinely do, then improve the practice. The second recurring error is treating the pack as a filing exercise. Policies that are never approved at a meeting, never dated, and never communicated to volunteers carry no weight when a grant officer asks for evidence they are in force. The document and the minute adopting it are a pair; one without the other proves little.

A third mistake is letting the complaints policy and the constitution's dispute clause drift apart. When they prescribe different steps, a disgruntled member will argue you followed the wrong one, and the ambiguity alone can sink a resolution or a registration. The fourth is underestimating the data breach clock. Committees assume they can wait until the next board meeting to decide whether a breach is serious, but the Notifiable Data Breaches scheme runs a 30-day assessment window from awareness, and stalling for a quorum is not a defence. Assign one responsible person now. Finally, avoid the temptation to lift a corporate policy off the internet. A twenty-page enterprise privacy policy confuses a five-volunteer op-shop and signals to a funder that the committee does not understand its own scale.