Privacy and compliance
Privacy compliance and audit readiness for organisations without a privacy team
Policies don’t fail, evidence does. We help mid-sized organisations work out where they stand against the Privacy Act, fix what matters most and produce the evidence regulators, auditors, boards and clients expect.
Typical triggers
Audit or tender
A client, funder or auditor asks for evidence
Reform
Privacy Act changes, including automated decisions from 10 Dec 2026
Incident
A near miss or breach exposes gaps
Why this matters now
Regulators expect evidence, not intent. Gaps usually surface late: during audits, incidents or board scrutiny, when time and options are limited.
What we review
Our review follows the Australian Privacy Principles and the way your organisation actually works. It is designed for teams where privacy is one of many jobs for legal, risk, compliance or IT.
- privacy policy and collection notices (APP 1 and APP 5), including automated decision-making disclosures
- what personal information you hold, where it is and how it flows
- use, disclosure and direct marketing practices
- overseas disclosures and vendor arrangements (APP 8)
- security of personal information (APP 11) and retention and disposal
- access, correction and complaint handling
- data breach response plan and Notifiable Data Breaches readiness
- privacy impact assessment practice and staff training
Privacy and Compliance Foundations
From policy intent to defensible compliance
A practical uplift that maps your obligations to controls and produces evidence-ready artefacts you can stand behind.
This gave us a realistic plan we could defend, and execute.
Privacy Officer
How it works
Understand your obligations
Confirm which privacy laws and contracts apply, including the APPs, state privacy schemes, health records laws and GDPR where relevant.
Find the personal information
Interviews and data discovery to map what you hold, where it lives and who can access it.
Assess controls and evidence
Test whether policies and controls operate in practice and whether you could show it.
Prioritise
A risk heatmap that separates quick wins from longer-term work, sized for a small team.
Build the evidence pack
Updated policies and notices, registers, procedures and templates ready for audit or client due diligence.
Keep it current
Optional ongoing support from a fractional privacy officer.
Frequently asked questions
We don’t have a privacy team. Where do we start?
Start with a review that shows where you stand and what matters most. Most organisations find a handful of priorities (an accurate privacy policy, a breach response plan, vendor checks and retention) reduce most of the risk.
What evidence do auditors and clients usually ask for?
A current privacy policy and notices, a register of personal information holdings, privacy impact assessments for significant projects, a tested data breach response plan, training records and evidence that access and retention controls operate.
Does the review cover the new automated decision-making rules?
Yes. We check whether any of your systems meet the APP 1.7 to 1.9 tests that apply from 10 December 2026 and draft the privacy policy wording. See our automated decision-making guide.
Do you also do privacy impact assessments?
Yes. See privacy impact assessments for how we run them.
Is this legal advice?
Our work is practical governance and compliance support. Where formal legal advice is needed we work alongside your lawyers or specialist privacy lawyers.
Be ready before you’re tested
Get clarity before an audit, a client or a breach forces the conversation.