Privacy Audit
Plain · Privacy Act readiness
A short engagement that maps the personal information your business holds, how it moves, and which privacy obligations need specialist confirmation.
The included items, listed plainly. No asterisks, no fine print.
- 01Half-day discovery interview, on site or video
- 02APP-by-APP gap assessment against the 2024–2025 reform
- 03Plain-English report covering data inventory, collection, storage, sharing, deletion
- 04Updated privacy policy and consent flows, drafted without dark patterns
- 05A scoped engagement — no add-ons, no scope creep
Three steps, then quiet.
- Step 01
Discovery interview
We sit with whoever runs your operations for half a day and map the journey of personal data through your business — collection, storage, sharing, deletion. No software install, no agents, no surveillance of your staff.
- Step 02
APP-by-APP gap assessment
We score your handling against each Australian Privacy Principle, with explicit attention to the 2024–2025 reforms — the expanded definition of personal information (now including IPs, cookies and device identifiers), the technical-and-organisational measures requirement, and the obligations small businesses inherit when the exemption lifts.
- Step 03
Plain-English report + remediation
You get a written report — the kind you can actually hand to your lawyer — that names every data flow, flags the new obligations, and ranks remediation by risk and effort. Most reports come with five to fifteen items, sequenced so the cheap, high-impact items are first.
Built for these operators.
- Australian small businesses that need to understand which privacy obligations apply to their work
- Nonprofits, community groups and clubs handling member data, donor records, or health information
- Schools, clinics, and allied-health practices already in scope but unsure about the new obligations
- Any operator who has been asked by a customer "what data do you actually have about me?" and was not sure of the answer
And what it is not.
- A legal opinion. We are not lawyers and the report is not legal advice — but it is plain-English, evidence-based, and your lawyer will thank you.
- A surveillance review. We do not look at staff conduct, browsing, or messaging — only at the data the business collects from third parties.
- A compliance certificate. Privacy is ongoing; the audit is a snapshot, with a recommended cadence for revisiting it.
The questions we hear frequently.
If yours is not here, write to us. We are honest when the answer is "it depends".
- 01
When do the new obligations actually apply to me?
The first tranche of the reform passed Parliament in December 2024 and most provisions are already in force. The exemption removal applies broadly — the government has signalled tailored guidelines and a transition period for small business, but the direction is set. Acting now is cheaper than acting reactively.
- 02
How long does the audit take?
Two weeks from kickoff for most small businesses. The on-site portion is half a day; the rest is us writing.
- 03
What if you find something serious?
We tell you immediately, not at the end. If a notifiable breach has already occurred, we help you walk through the OAIC notification process — that work is included in the engagement, not billed as an extra.
- 04
Do you handle the actual remediation?
We can, by the day, after the audit. Many clients do the small items themselves and ask us back for the harder ones — the report is written so either path works.
- 05
Is my data shared with anyone?
No. The audit data lives only with the engineer doing the work, in an encrypted local store, and is destroyed thirty days after delivery unless you ask us to keep it for the next round.
Curious about Privacy Audit?
Drop us a line. We will set up a friendly, no-pressure conversation and walk you through whether this is a fit for your situation.