"Do I own my website?" has two answers, and people often only ask about one. One is about rights: who the law and your agreement say owns the design, the code and the content. The other is about access: who actually holds the passwords, accounts and files, and can use them without anyone's permission. Both matter, and the second is the one that hurts when it goes wrong.
This guide is general information about practical access. It is not legal advice, and it does not describe the law in any place. Rights depend on your agreement and on the rules that apply to you, so ask a lawyer about contract questions.
Rights and access are different
- Rights come from your agreement and the law. Payment does not always decide who holds the rights, so check what your agreement says. Some material, such as open-source libraries, fonts and stock images, stays under its own licence regardless of what you paid. Your agreement should say what you receive.
- Access is practical. If your domain is registered in a developer's name, or the hosting account is theirs, you may have rights on paper but little ability to move or change anything.
What to check, item by item
| Item | What to confirm | Ideally held by |
|---|---|---|
| Domain name | Who is listed as the registrant, and who can log in to the registrar account? | Your business, with your email address on the account |
| Hosting account | Whose account is it, and who pays? | Your business, with the developer given access if needed |
| Website or admin logins | Do you have an administrator login that you control? | You |
| Code repository | Where is the code kept, and do you have access to a copy? | Your business, or a copy given to you at handover |
| Content and images | Do you have the original files, and the right to use any stock images or fonts? | You, with licence details recorded |
| Third-party licences | Which themes, plugins or fonts are used, and who holds each licence? | Your business where a licence is needed |
| Other services | Email, analytics, payments, form services, AI tools: whose accounts? | Your business |
| Business data | Can you export your customer and booking data in a usable format? | You, with a tested export |
| Documentation | Is there a record of how it is set up and how to change it? | You, as part of the handover |
Questions to settle before work begins
- Will accounts be created in my business's name from the start?
- What exactly will I receive at the end: files, code, data, documents?
- Does the agreement say who owns the work, and what licence applies to any third-party material?
- Can the developer reuse parts of my project for others, and is that acceptable to me?
- How will I get a copy of everything if we part ways, and how long will that take?
- What happens to my data if the developer or a service shuts down?
- Who pays for ongoing services, and in whose name are they?
A handover checklist
When work is finished, and before the final payment if your agreement allows, confirm each of these.
- You can log in to the domain registrar, the hosting and the website administration yourself, using your own email address.
- You have a copy of the website files or code, and the content and images, stored somewhere you control.
- You have an export of your data, and you have opened it to check that it is complete and readable.
- You have a list of every service and licence that the site or app depends on, with renewal dates and who pays.
- You have written notes on how it is set up and how to make common changes.
- Any accounts that remain in the developer's name are listed, with a plan to move them.
- You know who to contact for problems, and what that costs.
Personal information needs thought too
If your site or app holds information about people, you may have privacy responsibilities, depending on your business. The Office of the Australian Information Commissioner publishes guidance on whether the Privacy Act applies to small businesses, and says the Privacy Act may still apply to some small businesses, depending on their circumstances. If you are unsure, read their guidance or ask for advice. It is also a reason to know where the data is held and who can reach it.
Check your own accounts first
- Look up your domain's registrant details and check that they are correct.
- Make a list of every account your site depends on, with who owns it.
- Check that you can log in to each of them.
- Ask your developer for a copy of the files and a data export, and keep them somewhere safe.
When specialist help is worth it
Ask a lawyer about contract terms and intellectual property. Ask a developer for help with practical handover: moving accounts, exporting data and writing the notes for whoever looks after it next. The guide on life after launch covers the ongoing side, and choosing a provider includes questions to ask up front. When to involve a developer sets out how to decide what kind of help you need.
Sources and further reading
- OAIC: Small business and the Privacy Act Checked 3 October 2026.