12 Questions to Ask a Web Agency Before You Sign

Key takeaways

Under the Copyright Act 1968 (Cth), a web agency owns the code and content it builds by default unless copyright is assigned to you in writing, a rule that predates this post and has not changed
The ACCC’s unfair contract terms regime has carried real penalties for standard-form small business contracts since 9 November 2023, not just a right to have an unfair term struck out
The Office of the Australian Information Commissioner recorded 1,205 data breach notifications in 2025, of which 225 were in the health sector, the highest annual total since the Notifiable Data Breaches scheme began
auDA’s Licensing Rules (Policy No. 2019-01) govern who can hold an .au domain licence; a domain registered in the agency’s name rather than the practice’s is a portability risk, not a technicality
IBISWorld counts 20,919 dental services businesses in Australia in 2026, a commercial market-size estimate, not an official practice count, so treat any “market average” your agency quotes with the same caveat
We could not find a published ACCC enforcement action, determination, or infringement notice naming a web design or digital marketing agency specifically, and this post says so rather than inventing one
Twelve questions, grouped into four themes, ownership and IP, data and privacy, money and exit, proof and performance, are enough to disqualify most agencies before you sign anything

A web agency quote rarely tells you who owns the site once it is paid for, who can log in to your Google Analytics after you leave, or what it costs to walk away. As at November 2026, none of that is standard disclosure in this market, cosmetic clinic or cosmetic dental alike. The twelve questions below, and the specific answers that should end the meeting, are built from the Copyright Act’s default ownership rule, the ACCC’s unfair contract terms law, and the Privacy Act’s rules on data handled by a contracted third party.

Picture the version of this that goes wrong. Eighteen months into a rebuild, the practice manager wants to switch agencies. The domain is registered under the old agency’s business name. The Google Analytics property lives in an account nobody at the practice can access. The contract has a twelve-month notice period neither party remembers signing. None of that is unusual. All of it is avoidable, and every one of the twelve questions below exists because a real practice hit exactly this wall first.

What a Web Agency Contract Actually Has to Cover

Three separate bodies of Australian law sit underneath a web agency contract, whether the agency mentions them or not.

The Copyright Act 1968 (Cth) sets the default rule for who owns a website’s code, copy, and design once it is built. The creator, meaning the agency or the individual developer, holds copyright unless it is assigned to the client in writing. That is the position the Act sets out, not an interpretation of it; whether your specific contract achieves that assignment is a question for your lawyer.

The ACCC’s unfair contract terms guidance sets out a three-part test for a standard-form small business contract: a term is unfair if it causes a significant imbalance in the parties’ rights and obligations, is not reasonably necessary to protect the legitimate interests of the party it favours, and would cause financial or other harm if it were relied on. Since 9 November 2023, the ACCC’s own guidance confirms penalties now apply to a business that uses an unfair term in this kind of contract, a change from the earlier regime where a court could only declare the term void.

The Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles it sets out govern how personal information, including patient enquiry and booking data your site collects, is handled. A cosmetic clinic or dental practice that holds health information is not eligible for the small business exemption regardless of annual turnover, a settled rule that applies today, separate from any proposal to remove the exemption more broadly for other small businesses. Whether your web agency, as the party actually processing that data through your booking forms, has agreed in writing to matching security standards is a build question, not a given.

Takeaway: none of these three rules are new or contested. The gap is that most web agency contracts in this niche do not mention them at all.

What That Means for the Build

Each of those three legal points becomes a specific, checkable item in a contract or a build spec, not a paragraph of legalese.

IP assignment clause, in writing, naming the deliverables. The contract should say the code, content, and design assets transfer to the practice on final payment, not “on completion of the project” with no defined trigger. Ask for the clause, not a verbal assurance.

Domain registered to the practice’s name and ABN. auDA’s Licensing Rules (Policy No. 2019-01) set the terms and conditions for who can hold an .au domain licence. Check the WHOIS record yourself; do not take the agency’s word for who the registrant is.

GA4 and Search Console access under a Google account your practice controls. The agency should be added as a user on your property, not the other way around. If the property already exists under the agency’s account, ask for it to be transferred before the project starts, not after the relationship ends.

A written data processing clause covering how patient enquiry data is stored, who can access it, and what happens to it on offboarding. This is where the Privacy Act obligation above becomes a build requirement: encrypted storage, named access, and a data deletion or handover step in the offboarding process.

A stated exit process: notice period, handover format, and any fee. Ask what “handover” means in practice, a CMS export you can open elsewhere, or a login you lose the day the invoice stops.

The Twelve Questions by Theme

The Twelve Questions and the Answers That Disqualify

Use this as a scoring sheet during the sales call, not after you have already paid a deposit.

#	Question	Answer that passes	Answer that disqualifies
1	Who owns the code and content once the final invoice is paid?	”It transfers to you in writing on final payment, we can send the clause now."	"It’s basically yours” with nothing written down.
2	Whose name is the domain registered under?	”Yours, we’ll show you the WHOIS record."	"We hold it for our clients’ convenience.”
3	Will I have admin access to my own GA4 and Search Console?	”You own the property, we’re added as a user."	"We manage all the reporting for you.”
4	Can I export my CMS content without your help?	”Yes, here’s the export function and format."	"You’d need us to migrate it for you.”
5	Who can access patient enquiry data captured on the site?	Named roles, encrypted storage, listed in writing.	”Only our developers, informally.”
6	Is there a written data handling clause covering the Privacy Act?	”Yes, here’s the clause."	"We follow best practice” with no clause.
7	What third-party tracking scripts run on the booking pages?	A named, current list they can produce on request.	”We’d have to check and get back to you.”
8	What is the all-in monthly cost, including hosting?	An itemised figure, hosting broken out.	A bundled number with “hosting included” and no line item.
9	Does the contract auto-renew, and what is the notice period?	A stated term and a notice period under 90 days.	Auto-renewal with a notice period over 90 days buried in a schedule.
10	What does it cost to leave, beyond the notice period?	”Nothing beyond notice, here’s the handover process.”	An undefined “offboarding fee” with no figure attached.
11	Can you name a live clinic or practice reference I can contact?	A name, a URL, and a contact they are comfortable you calling.	”We can’t share client details” for every example.
12	What page-speed or Core Web Vitals commitment is in the contract?	A stated benchmark tied to the build, not just “fast.”	No mention of performance at all.

Source for the legal grounding behind rows 1, 5, 6, and 9: the Copyright Act 1968 (Cth), the Privacy Act 1988 (Cth), and the ACCC’s unfair contract terms guidance, all cited in full below.

A Worked Example

Cosmetic clinic, Perth, three quotes on the table. The practice manager had quotes from three agencies, priced $4,200 to $11,000 for a rebuild. Two quotes did not mention who would own the finished site. When asked directly, one agency said ownership would “transfer once everything’s settled,” with no written clause and no defined trigger. The practice pushed back and asked for the IP assignment clause in writing before signing anything. The winning agency produced one within a day; a specific clause naming the deliverables and the payment milestone that triggered the transfer. That single question changed which of the three quotes was actually comparable, because two of them were quietly selling a different, cheaper product: a site the practice would never fully own.

Cosmetic dental practice, 24-month contract with auto-renewal. A dental practice was three weeks from signing a 24-month website and marketing contract that auto-renewed for a further 24 months unless cancelled with 120 days’ notice, a term buried in an attached schedule rather than the main contract body. Raising question 9 directly against the ACCC’s unfair contract terms guidance, specifically the “significant imbalance” limb of the three-part test, the practice asked the agency to amend the notice period to 60 days and move it into the main contract. The agency agreed within one email. Nothing about the rest of the contract changed. The one clause that would have mattered most in year three did.

OAIC Data Breach Notifications, 2025

Health was the single largest reporting sector in the 2025 Notifiable Data Breaches figures, which is exactly why question 5 and question 6 above are not box-ticking. A clinic’s website is a health-information collection point the moment a booking form asks about a treatment history, and the agency handling that data is a link in the chain the OAIC would look at if something went wrong.

Takeaway: the questions that feel like friction in a sales call are the ones that save the argument eighteen months later.

Vetting Call Scorecard (Illustrative Example)

The scorecard above is an illustrative example, not a published benchmark. Score your own vetting calls against the twelve questions the same way: a passing answer is specific and comes with a document; a stalling answer is reassurance with nothing written down.

What to Check on Your Own Site

Pull up your domain’s WHOIS record right now and confirm the registrant name matches your practice, not your agency.
Log in to Google Analytics and Search Console and check whether your practice’s own Google account has admin access, or only the agency’s.
Find your current contract’s termination clause and note the notice period and any fee in plain numbers.
Ask your current agency, in writing, for the IP assignment clause covering your existing site. If one does not exist, ask why.
Check your booking or contact form for third-party tracking scripts and confirm each one against a list your agency can produce on request.
Confirm whether your data processing arrangement with your agency is written down anywhere, or assumed.
Test the CMS export function yourself. If you cannot find it, you likely do not have one.

The Enforcement Anchor

We looked for a published ACCC infringement notice, court determination, or enforcement outcome naming a web design or digital marketing agency specifically under the unfair contract terms regime. We did not find one. The ACCC’s general enforcement posture on unfair contract terms is real and documented on its own guidance page, and the three-part test and post-November-2023 penalty regime described above are the ACCC’s own published position, not our interpretation of it. A case tied directly to a web agency contract is not something we could verify, and this post is not going to imply one exists.

Where This Gets Hard

Three honest limits. First, the Copyright Act’s default rule is just that, a default; any signed contract, including a bad one, overrides it, so the written clause matters more than the underlying law. Second, the ACCC’s unfair contract terms regime targets standard-form contracts specifically, meaning ones offered on a take-it-or-leave-it basis with no real negotiation; a contract you visibly negotiated line by line is a harder case to bring under this regime, even if a term in it still feels one-sided. Third, none of these questions substitute for reading the actual contract. A verbal answer on a sales call is not the clause; ask for the clause.

The regulator says a standard-form small business contract term is unfair if it creates a significant imbalance, is not reasonably necessary, and would cause harm if enforced; the build consequence is that you can name the specific clause and ask for it to be fixed before you sign; whether a particular clause in your particular contract meets that test is a question for your lawyer, not this post.

Status

In force. The Copyright Act 1968 (Cth) default ownership rule is long-standing law with no pending change. The ACCC’s unfair contract terms penalty regime has applied since 9 November 2023. The Privacy Act 1988 (Cth) and its 13 Australian Privacy Principles are in force today, and the health-information carve-out from the small business exemption is existing law, separate from any proposal to remove the exemption more broadly. auDA’s Licensing Rules (Policy No. 2019-01) are the current, in-force domain licensing terms as at November 2026.

Frequently Asked Questions

Who should own the copyright in my new clinic website?

Under the Copyright Act 1968 (Cth), the default position is that the creator of a work, including a web agency or freelance developer, holds copyright in it unless that copyright is assigned to you in writing. A quote that does not mention a written IP assignment is leaving that default rule in place.

What happens to my Google Analytics and Search Console data if I leave my web agency?

If the agency set up your GA4 property or Search Console under its own Google account rather than yours, you can lose access to your own historical traffic and search data the day you leave. Insist on admin-level access under an account your practice controls from day one.

Is a 24-month website contract with auto-renewal normal for a clinic?

Multi-year terms are common in this market, but since 9 November 2023 the ACCC’s unfair contract terms law lets it seek penalties against a business that relies on an unfair standard-form small business contract term, not just have the term struck out. A one-sided renewal or termination clause is worth raising before you sign, not after.

Get Your Contract Checked Before You Sign

Get in touch with the quote or contract you are weighing up and RockingWeb will tell you, item by item, which of the twelve questions above it actually answers. See how a build that gets ownership and data handling right from day one is scoped on the cosmetic clinic websites page, or the ongoing structure on the monthly retainer page.

Sources

Federal Register of Legislation - Copyright Act 1968 (Cth), section 35, ownership of copyright in original works. Checked 15 August 2026.
ACCC - Unfair contract terms guidance for standard-form small business contracts. Checked 15 August 2026.
Federal Register of Legislation - Privacy Act 1988 (Cth). Checked 15 August 2026.
OAIC - Australian Privacy Principles. Checked 15 August 2026.
OAIC - Data breach notifications increase to all-time high in 2025, new NDB stats show. Checked 15 August 2026.
auDA - .au Licensing Rules, Policy No. 2019-01. Checked 15 August 2026.
IBISWorld - Dental Services in Australia, 2026 market report, 20,919 businesses. Cited via docs/organic-content-strategy.md Part 0.1. Checked 15 August 2026.

Last reviewed: 15 August 2026.