Home » Meet your privacy obligations and write your policy

Meet your privacy obligations and write your policy

We check what you actually do with personal information, then write the policy that matches it.

If your business holds personal information about customers or staff, there are rules about how you handle it. They cover how you collect it, use it, store it and pass it on. Most businesses have a privacy policy. Fewer have one that describes what they actually do. That gap is what turns a small incident into a reportable one.

Speak to a lawyer What is included

A policy that is true

The document describes what your business actually does with personal information, which is what it will be measured against.

You know where the data goes

Collection points, systems, suppliers and retention practices mapped, usually for the first time.

Decisions made before the breach

A response plan means the notification questions are answered in advance rather than in the first hour.

What privacy compliance actually requires

Privacy compliance means handling personal information the way the Privacy Act 1988 (Cth) and the Australian Privacy Principles require. Personal information covers customer records, employee files, health information and financial details.

The principles run to thirteen. They cover collection, use, disclosure, storage, direct marketing, sending data overseas, and an individual’s right to see and correct what you hold. On top of them sits the Notifiable Data Breaches scheme. It requires you to tell the regulator and the affected people when a breach is likely to cause serious harm.

Speak to a lawyer

Does the Privacy Act apply to my business?

It applies to most organisations with an annual turnover above $3 million, and to some regardless of turnover. Private health providers, credit reporting bodies and businesses that trade in personal information are covered either way. State legislation can apply below the threshold. If you are not sure, it is worth checking rather than assuming.

What are the Australian Privacy Principles?

Thirteen principles governing how organisations handle personal information. They cover collection, use and disclosure, direct marketing, sending information overseas and data security. They also cover the right of individuals to access and correct what you hold. One of them requires you to keep a current privacy policy.

What is the Notifiable Data Breaches scheme?

It requires covered organisations to notify both the regulator and the affected individuals. That applies when a data breach is likely to cause serious harm. Notification has to happen as soon as practicable. Failing to notify when required is itself a breach, which is why the plan should exist beforehand.

What has to be in a privacy policy?

What kinds of personal information you collect and hold, how you collect and hold it, and what you use and disclose it for. Also how someone can access or correct their information, how you handle complaints, and whether information goes overseas. It has to be available free of charge, normally on your website.

The first document anyone reads after an incident is your policy

It should describe what your business actually does with personal information, because that is the comparison that will be made.

A policy that does not describe what you do is not protection

Most privacy policies were written once, from a template, and have not been read since. Meanwhile the business has added a new collection channel, a new analytics tool, a new overseas supplier.

None of that matters until something goes wrong. Then the first document anyone reads is the policy, and the question is whether what it promised is what you did.

We will advise whether the Privacy Act 1988 (Cth) applies to your business and which obligations attach.
We will map what personal information you collect, where it is held and who else receives it.
We will review your privacy policy and rewrite it to match your actual practices.
We will advise on your obligations under the Notifiable Data Breaches scheme.
We will prepare the internal procedures and a breach response plan.

When you hold personal information and are not sure what that obliges you to do

Your business collects personal information as a matter of course. There is a privacy policy somewhere, though you are not confident it reflects current requirements or describes how you actually handle data. Perhaps you are planning a new product or a data-sharing arrangement and want to understand the implications first. You want specific advice about your business rather than a summary of the law.

What's included in your privacy compliance service

Speak to a lawyer

Most privacy problems are inadequate practice, not bad intent

Businesses that end up in a privacy complaint or a breach investigation rarely did anything deliberate. A policy that does not mention a collection channel added two years ago. Employee records kept long past any reason to keep them. A supplier receiving data that customers were never told about.

These are ordinary gaps and they create real exposure. Under the Notifiable Data Breaches scheme a serious breach has to be reported to the regulator and to every affected person. That notification is the part most businesses find hardest, because it is the moment customers learn what was held and what happened to it.

From a template policy to practices that match the document

We start with where the data actually is. What you collect, at which points, into which systems, who else gets it and how long it stays. Most of the findings surprise the business, because no one person has ever seen the whole picture.

Then we write the policy against that reality and fix the practices that cannot be defended. We also put a breach response plan in place. If something happens, the decisions about notification are made in advance rather than in the first frightening hour.

How the privacy work runs

From a template policy to documented, defensible practice.

Map the data

We work out what personal information you collect, where it is stored, who else receives it and how long it is kept.

Write the policy

We rewrite your privacy policy against what we found and fix the practices that cannot be defended.

Plan for a breach

We prepare a response plan so the notification decisions are made before you need them.

Privacy obligations mapped to what your business actually does with data

Privacy compliance is easy to treat as a document exercise, which is why so many policies describe a business nobody recognises. The work that matters is finding out where the data actually goes.

We map your collection points, your systems, your suppliers and your retention practices, then write the policy against what we find. We also advise on the Notifiable Data Breaches scheme, because the worst time to work out your obligations is during the breach. Where a new product or data-sharing arrangement is planned, we would rather look at it before it is built.

Our great lawyer guarantee

Six principles we hold to, whatever you bring us and however long it takes.

Take the time

We listen carefully to understand what you want to achieve, then step you through the advice and the documents.

Share our knowledge

We pass on as much as we can, so you can make your own informed decisions.

Stick to our knitting

We only do what we are good at, so you never pay for our learning.

Work as one team

Someone is always available to answer your question or point you the right way.

Fair pricing

A fixed or capped quote for advice and documents, so you do not carry the price risk.

It is your show

We are in it for a front row seat to witness your success, not for our egos.

Get your privacy position sorted before something forces it

The hardest time to work out your privacy obligations is during a breach. Before one, this is a contained piece of work. Tell us what your business collects and where it goes, and we will tell you what applies and what has to change.

Speak to a lawyer 1300 654 590