Privacy, data and compliance

If you suspect an eligible data breach, s 26WH of the Privacy Act 1988 (Cth) gives you 30 days to assess it. Thirty days is the outer limit, not the standard — remedial action taken before serious harm occurs can mean there is no notifiable breach at all.

Call 1300 992 219 See the fees

What we do here

A live breach or suspected breach
Privacy policies and collection notices
Data handling and records reviews
Breach response plans
Businesses unsure whether the Act applies to them

What it costs

Privacy work is rarely one document. It covers what you collect, where it is stored, who can access it, how long you keep it, and your breach response. The fee depends on what you already have in place.

Most engagements start with a conference to work out the scope, followed by a written proposal. Both are at no charge.

How long it takesA live breach is same-day. The assessment under the Notifiable Data Breaches scheme has a thirty-day outer limit and should take days, not weeks. A policy or a data handling review is one to three weeks.

Privacy policy and collection noticesAustralian Privacy Principles, including APP 8 cross-border disclosure where you use offshore hosting.

$2,750

Employee and contractor data provisionsHandling, access and destruction obligations written into the contracts you already use.

$1,650

Data handling and records reviewWhat personal information you hold, where it is hosted, who has access, and how long you keep it. Written findings and a remediation list.

$4,400–$7,700

Data breach response planRoles, decision points, notification templates and the 30-day assessment path under s 26WH of the Privacy Act 1988 (Cth).

$3,300

Compliance program, ongoingAnnual review, policy updates, training and a point of contact. Quoted as a monthly retainer.

Retainer

Eligible data breach assessmentAssessment under the Notifiable Data Breaches scheme and, where required, notification to the OAIC and to affected individuals.

$3,300

Indicative ranges for common matters, including GST, disbursements extra. Your fee is confirmed in writing before work begins. Full list for this area.

Questions people ask

Not necessarily. Health service providers, businesses that trade in personal information, TFN recipients and contracted service providers under a Commonwealth contract are covered regardless of turnover.

Contain it, then preserve the logs. They are the evidence of scope. Then record what was accessed, whose information, when, and how it came to light.

Guides on this

Notifiable data breachesThirty days to assess, and what s 26WK requires.

No charge

What's happened?

Describe it in your own words.

Not sure where you stand?

The assistant works out the area of law and whether a time limit is running, then sends it to the solicitor the same day.

Free and low-cost options

Free and low-cost services that may be able to help.

See the list