Your firm’s privacy policy makes a promise to every client: what you collect, why you keep it and how you protect it.
This year, that document matters more than it used to. Many law and accounting firms that once sat outside the Privacy Act are now inside it, and financial services firms face sharper enforcement and new rules on automated decisions. On 10 December, privacy policies have to say more than ever about how decisions are made. And the regulator now has faster, cheaper ways to act when the policy and the practice don’t match.
Most firms will respond by updating the wording. That’s the easy part.
The harder question is the one a regulator, an insurer or a client will actually ask: what did you do to protect the information you hold?
What has changed
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. Some of its changes took effect straight away. Others have been phased in through 2025 and 2026. For law, accounting and financial services firms, four matter most.
More firms are now covered. From 1 July 2026, professional service providers such as lawyers, conveyancers and accountants that provide “designated services” under the AML/CTF reforms are brought into the Privacy Act, even if they previously relied on the small business exemption. The Queensland Law Society describes it as a partial withdrawal of the exemption for firms doing that work. If your firm handles property, trusts, company structures or client money, check where you now stand. Financial services firms that are already AML/CTF reporting entities have been covered for that work for years, whatever their size. For them, the bigger change is what the Act now expects, which is the rest of this list.
Identity documents are a new pressure point. The OAIC’s updated guidance says firms should not keep copies of full ID documents for AML/CTF record-keeping, because the regime doesn’t require it. Many firms have years of passports and licences sitting in matter files, client files and inboxes. Every one of those is information you now have to justify holding, and secure.
“Reasonable steps” now spells out what it means. APP 11 has always required reasonable steps to protect personal information. The amendments added APP 11.3, which says those steps include both technical and organisational measures. Technical measures are things like encryption, multi-factor authentication and access controls. Organisational measures are the policies, procedures and staff training that make the technology work.
Enforcement has more tiers. The OAIC can now issue infringement notices for administrative failures, such as not having a clearly expressed, up-to-date privacy policy. A new mid-tier civil penalty of up to $3.3 million for companies sits beneath the existing penalties for serious interferences with privacy.
And there is a date on the calendar. From 10 December 2026, organisations that use computer programs to make, or substantially help make, significant decisions about individuals must explain that in their privacy policy. The OAIC released guidance on these automated decision-making obligations at the end of September. If your firm uses AI or automated tools in client onboarding, conflict checks, credit assessment, risk profiling or recruitment, this applies to more of your work than you might expect.
Where most firms go wrong
The common response to all of this is to treat it as a document problem. Update the privacy policy, add a paragraph about automated decisions, file it and move on.
But a privacy policy is a promise, not paperwork. The law now makes it easier for the regulator to test whether that promise is true.
A policy that says client information is stored securely means very little if staff can open any matter or client file on the network, if old ID scans sit in shared folders, or if nobody can say when the backups were last restored. That gap between what the document says and what the systems do is where the real exposure sits.
Privacy compliance isn’t a wording exercise. It’s an evidence exercise.
What good looks like
The Act doesn’t name a security framework. The OAIC’s question is always what was reasonable in your firm’s circumstances, and for a firm holding identity documents, tax and financial records, investment details and privileged communications, the bar is high.
What firms need is a way to show, at any point, that the reasonable steps are actually in place. That means controls that are documented, maintained and independently checked, rather than assurances given from memory when someone asks.
This is where SMB1001 earns its place.
SMB1001 is an Australian cybersecurity standard designed for small and medium-sized organisations, with five certification tiers from Bronze to Diamond. Each tier sets out specific controls across both sides of APP 11.3: the technical measures (multi-factor authentication, patching, backups, email authentication, access control) and the organisational ones (written policies, staff cyber awareness training and managing supplier risk). The 2026 edition also adds a formal policy for the acceptable and secure use of AI, which speaks directly to the questions behind the new automated decision-making rules.
Certification won’t make a firm compliant with the Privacy Act. Only the firm can do that, with its legal advisers. What it does give you is dated, independent evidence of the security controls you have in place, which is exactly what you need when someone asks what reasonable steps you took.
Six questions for your partners or board before 10 December
These are the questions I’d want answered at a partner or board meeting this month. Each one should be answered with evidence, not just a yes.
- Do we know what personal information we hold, where it sits and who can reach it? Including matter and client files, email, document management and anything stored by third parties.
- Are we still keeping full copies of client ID? If so, why, for how long, and who can open them?
- Can we show our security controls are working? Multi-factor authentication on every account, patching, tested backups and access reviews, with records to prove it.
- Does our privacy policy describe what our systems actually do? Including any AI or automated tools that help make significant decisions about clients or staff.
- Have our people been trained, and do they know which AI tools they’re allowed to use? Organisational measures count as much as technical ones.
- If a breach happened tomorrow, who decides whether it’s notifiable, and how quickly? Under the Notifiable Data Breaches scheme, a suspected breach must be assessed within 30 days.
If any answer is “I think so”, that’s the place to start.
How to get there
Start with the gap, not the policy. Map what you hold, compare your controls against a recognised standard and fix the gaps in order of risk. Then update the privacy policy so it describes a firm you can stand behind.
At Essential Tech, we see this pattern every week: firms that are well protected in practice but can’t evidence it, and firms that have the right documents but not the controls behind them. As an ISO 27001:2022 certified organisation and an SMB1001 Partner, we help firms close both gaps, and our SMB1001 certification program turns that work into evidence you can show a client, an insurer or the regulator.
Your clients trust you with their most sensitive information. The law now expects you to prove that trust is well placed.
If you’d like to know where your firm stands before 10 December, book a Cyber & Compliance Maturity Assessment. My team and I would welcome a conversation.
This article is general information, not legal advice. Speak to your legal adviser about your firm’s specific obligations.
FAQ
Does the Privacy Act now apply to small law and accounting firms?
From 1 July 2026, firms that provide designated services under the AML/CTF reforms, including many lawyers, conveyancers and accountants, are brought into the Privacy Act even if their turnover is under $3 million. Check with your legal adviser how this applies to your practice.
Does this affect financial services firms?
Yes. Many financial services firms were already covered by the Privacy Act, and AML/CTF reporting entities are covered for that work regardless of size. The stronger enforcement, APP 11.3 and the 10 December automated decision-making rules apply to them like any other covered organisation, which matters most where software helps assess credit, profile risk or onboard clients.
What changes on 10 December 2026?
Organisations covered by the Privacy Act must explain in their privacy policy if they use computer programs to make, or substantially help make, significant decisions about individuals using their personal information.
Does SMB1001 certification make us Privacy Act compliant?
No. SMB1001 is a cybersecurity standard, not a privacy compliance certificate. It gives independent evidence of the technical and organisational security measures that APP 11 expects, which supports your compliance but doesn’t replace legal advice.
What does “reasonable steps” mean under APP 11?
APP 11.3 says reasonable steps include technical and organisational measures. What’s reasonable depends on the information you hold and your circumstances. The OAIC’s Guide to securing personal information sets out the factors.
