If you’re ready to accept credit card payments, you’re probably thinking about the practical side first: getting paid faster, improving customer experience, and increasing sales (especially online).
But once you start taking credit card payments, you also step into a set of legal and compliance obligations that many small businesses don’t think about until something goes wrong - like a disputed transaction, a privacy complaint, a surcharge issue, or a data breach.
The good news is that you don’t need to be a legal expert to set this up properly. You just need to understand where the key risks sit and put a few sensible protections in place before you start processing card details.
Below, we walk you through what to consider when you accept credit card payments in Australia, including the main legal areas, the documents that help protect you, and a practical checklist you can use.
Why Accepting Credit Card Payments Changes Your Legal Risk Profile
When you accept credit card payments, you’re not just adding a new way for customers to pay - you’re adding a new set of relationships and responsibilities:
- You and your customer (what happens if they dispute a payment, want a refund, or allege you didn’t deliver?)
- You and your payment platform (their rules, fees, chargeback processes, and account limitations)
- You and regulators (privacy, consumer law, pricing rules, and marketing laws)
It’s also a shift in the types of risks you face. Cash sales rarely come with “chargebacks”, but card payments do. A customer can dispute a card transaction, and you may need to prove the transaction was authorised and the goods/services were delivered as agreed.
Common Legal Pain Points When Businesses Take Credit Card Payments
- Chargebacks and disputes: a customer claims they didn’t authorise the payment or didn’t receive what they paid for
- Surcharges: charging a card fee incorrectly (or presenting it unclearly) can trigger complaints
- Refund misunderstandings: “no refunds” policies that conflict with Australian Consumer Law (ACL)
- Data handling: collecting or storing customer card details or personal data without adequate safeguards
- Subscription billing: recurring payments that aren’t clearly disclosed or aren’t easy to cancel
These issues are usually avoidable if you set expectations clearly (in your customer terms) and handle data properly (through privacy and security measures).
Choosing How You’ll Take Credit Card Payments (And What That Means Legally)
Before we get into the legal rules, it helps to be clear about how you want to accept credit card payments. Your compliance obligations will look different depending on whether you’re taking payments in person, online, or over the phone.
In-Store Card Payments (POS / Tap-And-Go)
For in-person transactions, your biggest legal focus is usually:
- clear pricing and surcharges (so customers know what they’ll be charged)
- consumer law compliance (refunds, returns, quality issues)
- record-keeping and dispute handling (in case a transaction is questioned)
Even though you’re not “collecting card details” in the same way you would online, disputes can still happen - so it’s worth having a consistent process for receipts, proof of supply, and customer communications.
Online Card Payments (Website Checkout Links, Invoices, Or An App)
If you take credit card payments online, you’re usually collecting more customer information (names, emails, addresses, phone numbers, order details).
That means privacy compliance and website legal documents become much more important. Most businesses that accept credit card payments online will need a Privacy Policy and clear website terms, particularly if you’re selling direct to consumers.
Card Payments Over The Phone Or By Email (High Risk Area)
Taking card details over the phone or via emailed forms can create extra risk because:
- it’s easier for someone to later claim the transaction wasn’t authorised
- you may inadvertently store card details in places you shouldn’t (email inboxes, notes apps, spreadsheets)
- it increases your exposure if staff are handling sensitive information
If your business model requires this, it’s worth putting a strict process in place (including who is authorised to take payments, where details can be recorded, and how to avoid storing card data unnecessarily).
What Laws Apply When You Accept Credit Card Payments In Australia?
There isn’t one single “credit card payments law” in Australia. Instead, when you accept credit card payments, several legal frameworks can apply at once - depending on your business model.
Australian Consumer Law (ACL): Refunds, Returns, And Disputes
If you sell products or services to consumers, ACL will be central to how you handle payments. It affects:
- refunds, replacements, and repairs
- what you can and can’t say in your returns policy
- what happens if your goods/services are not as described, not delivered, or faulty
A common mistake is relying on a blanket “no refunds” policy. Even if you accept credit card payments with a “no refunds” statement on your website or receipt, ACL consumer guarantees can still apply in many cases.
Pricing And Surcharges: Be Clear And Don’t Overcharge
If you charge customers an extra fee for paying by card (a surcharge), you need to ensure it’s:
- disclosed clearly before the customer pays, and
- not more than what it costs you to process the payment (as a general rule)
It’s also important that your overall price displays are accurate and not misleading, including how fees are presented at checkout. Getting pricing displays right is part of broader compliance with advertising and pricing rules, including advertised price laws.
Tip: Pricing and GST can get technical depending on what you sell and how you invoice. If you’re unsure, consider getting tailored advice (including tax advice where needed) so your checkouts and invoices match your obligations.
Even if you don’t store card numbers, you will likely collect personal information when you take credit card payments (like names, contact details, delivery addresses, and purchase history).
If your business is covered by the Privacy Act 1988 (Cth) (or you choose to adopt privacy best practice), you should take privacy seriously from day one. Practically, that means:
- telling customers what information you collect and why
- storing customer information securely
- only giving access to staff who need it
- having a process for privacy complaints or access requests
This is where having a properly tailored Privacy Policy helps - not just for compliance, but also to build customer trust when you ask them to enter payment and delivery details.
PCI DSS And Security Requirements: What Most Businesses Need To Know
When you accept credit card payments, you’ll also need to consider the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS isn’t an Australian “law”, but it is an industry security standard that is typically enforced through your agreements with your payment gateway/acquirer and card schemes.
In practical terms, PCI DSS is one of the main reasons many businesses choose reputable payment providers and avoid handling card details directly. If your systems or processes involve capturing, transmitting, or storing card data, your PCI DSS obligations (and risk) can increase significantly.
Storing Credit Card Details: Be Extremely Careful
Many small businesses ask, “Can we store customer card details for convenience?” Sometimes it’s possible, but it’s also where businesses can accidentally take on serious security and compliance risk.
As a general rule, if you can avoid storing card details yourself, you usually should. There are also legal and practical issues with keeping card details “on file”, which we cover in more detail in storing credit card details.
If you do need to keep card details for recurring billing or deposits, you should treat that as a high-risk area and get advice on the safest approach.
Recurring Payments (Subscriptions, Memberships, Payment Plans)
If your business takes recurring payments, you’ll want to get the legal foundations right early - because subscription disputes can quickly become reputational issues (and chargeback magnets).
Key issues include:
- clear consent: the customer must understand they’re signing up to ongoing charges
- easy cancellation: the process should be clear and fair
- accurate descriptions: your invoices and descriptors should match your business and the service provided
It’s worth noting that recurring card payments are not the same as “direct debits”. Direct debits (typically via a customer’s bank account using BSB/account number) often involve different rules and arrangements than card-on-file payments.
If you’re taking payments from a customer’s bank account (rather than charging their card), it’s also worth understanding how direct debit laws can apply to your set-up.
Marketing Follow-Ups After Payment: Spam Rules And Email Compliance
Once you accept credit card payments, you’ll often want to follow up with customers - order confirmations, review requests, special offers, abandoned cart emails, newsletters.
Just remember: marketing messages are regulated too. If you’re collecting customer emails during checkout, make sure your email practices align with email marketing laws, including consent and unsubscribe requirements.
What Legal Documents And Policies Should You Have In Place?
One of the most practical ways to protect your business when you accept credit card payments is to put the right documents in place. These documents help you:
- set expectations with customers upfront
- reduce misunderstandings about refunds, cancellations, and delivery timeframes
- handle disputes and chargebacks more confidently
- show you take privacy and security seriously
Not every business needs every document, but the following are common for small businesses that take credit card payments.
Customer Terms And Conditions (Or Terms Of Sale)
Your customer terms are the backbone of how you manage payment issues. They can cover:
- what the customer is buying (and what’s included/excluded)
- pricing, deposits, and when payment is taken
- delivery timeframes (and what happens if there are delays)
- refund and cancellation processes (aligned with ACL)
- dispute handling and chargeback cooperation
If you run an online store or take payments through your website, your terms should integrate cleanly with your checkout experience. Many businesses use Website Terms and Conditions as the legal framework for orders and payments.
Cancellation And Refund Policy
Customers don’t just care about what they’re buying - they care about what happens if plans change.
If you charge cancellation fees, have booking deposits, or run events/appointments, your cancellation and refund policy should be clear and consistent with ACL. This is particularly important where you take credit card payments upfront.
For businesses charging fees for cancellations or late changes, it’s worth checking your approach against cancellation fees requirements.
Privacy Policy (And Collection Notices Where Needed)
If you accept credit card payments online, you will almost always collect personal information.
A Privacy Policy explains (in plain English) how you handle personal information - including what you collect, why you collect it, who you share it with (for example, service providers), and how customers can contact you about privacy.
Internal Policies For Staff (Especially If Staff Handle Payments)
If you have staff taking payments, you’ll reduce risk by having simple internal rules around:
- who can process refunds
- how to verify customer identity for phone payments
- what to do if a customer disputes a charge
- how to handle receipts, invoices, and records
- what not to do (for example: writing down card numbers)
If you hire staff, having clear contracts in place also helps set expectations and reduce disputes. Depending on your business, an Employment Contract can form part of your overall compliance foundation.
Practical Compliance Checklist For Small Businesses
If you want a simple way to sanity-check your set-up before you start to accept credit card payments, use the checklist below.
1) Make Your Prices And Fees Clear
- Are your prices displayed clearly (including GST where required)?
- If you charge a card surcharge, is it disclosed before payment?
- If you charge extra fees (booking fees, admin fees), are they explained upfront?
2) Set Up A Refund And Dispute Process
- Do you have a documented approach for refunds that aligns with ACL?
- Do you keep records that help defend chargebacks (proof of delivery, service logs, signed acceptance)?
- Do staff know who handles disputes and what steps to follow?
3) Review Your Customer Terms Before You Take Payments
- Do your terms explain what the customer gets, and when payment is processed?
- Do your terms cover cancellations, rescheduling, and refunds (if relevant)?
- Do your terms match what your sales page or staff say (no contradictions)?
4) Minimise Handling And Storage Of Card Details
- Can you avoid storing card numbers entirely?
- Are staff trained not to store card details in emails, notes, or spreadsheets?
- If you must store anything sensitive, have you assessed the risks and safeguards (including any PCI DSS implications)?
5) Get Your Privacy And Marketing Settings Right
- Do you have a Privacy Policy if you’re collecting personal information online?
- Do your checkout forms only ask for information you actually need?
- If you send promotional emails, do you follow email marketing laws (including unsubscribe options)?
6) Put Subscriptions And Recurring Billing In Writing
- Is it obvious to customers that payments are recurring (not a one-off)?
- Is the cancellation process easy to find and follow?
- If you use a direct debit arrangement (bank account debits), are your terms and customer authorisations set up to align with direct debit laws where applicable?
If you’re unsure about any of the above, it’s often quicker (and cheaper) to fix the set-up upfront than to deal with a dispute after you’ve already taken payment.
Key Takeaways
- When you accept credit card payments, you take on extra legal and practical risks - especially around chargebacks, refunds, and handling customer data.
- The way you take credit card payments (in-store, online, or by phone) changes what you need to focus on from a compliance perspective.
- Australian Consumer Law (ACL) affects how you handle refunds, returns, and disputes, even if your policy says “no refunds”.
- Clear pricing (including any card surcharge) helps you avoid complaints and reduce dispute risk.
- If you’re collecting personal information during checkout, having a Privacy Policy and secure data-handling practices (including PCI DSS considerations where relevant) is essential.
- Strong customer terms and policies are one of the most practical tools to protect your business when you take credit card payments.
If you’d like help setting up the right legal documents and compliance foundations before you accept credit card payments, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.
