ADM Disclosure Sprint
Know which automated decisions your privacy policy must describe, with draft wording ready for your lawyer.
See what is includedPrivacy, Data & AI Governance Advisory
Know where you stand on privacy, data and AI.
Lexora helps Australian organisations navigate privacy obligations, govern information responsibly and manage the risks of artificial intelligence, with fixed-scope assessments, practical frameworks and ongoing advice.
Where to start
Start with the problem in front of you.
Each engagement begins with a defined scope, named deliverables and a fixed fee agreed before any work starts.
- 01“We are not sure our privacy practices meet the Australian Privacy Principles.”Start with Privacy Compliance Review
- 02“Staff are using AI tools and we have no rules, register or owner.”Start with AI Governance Readiness Assessment
- 03“Nobody can say who owns our data or whether it can be trusted.”Start with Data Governance Assessment
- 04“We hold sensitive information and are not sure we are breach-ready.”Start with Data Protection Review
- 05“We need someone to keep our governance current, quarter after quarter.”Start with Ongoing Advisory
The regulatory horizon
What is law, what is coming, and what is only proposed.
Every date below is taken from the primary source and labelled by status. Nothing proposed is presented as law.
days until automated decision-making disclosures commence
10 Jun 2025
Status: Law in forceStatutory tort for serious invasions of privacy
Australia
2 Aug 2026
Status: Law in forceEU AI Act transparency duties (Article 50), with a grace period to 2 Dec 2026
European Union
10 Dec 2026
Status: Law, commencing laterPrivacy policies must describe automated decisions (APP 1.7 to 1.9)
Australia
10 Dec 2026
Status: Being finalisedChildren's Online Privacy Code due to be registered; commencement not yet set
Australia
Not set
Status: Exposure draftSecond tranche of Privacy Act reforms; consultation closed September 2026
Australia
2 Dec 2027
Status: Law, commencing laterEU AI Act obligations for high-risk (Annex III) systems
European Union
Good governance is ordinary decisions, made deliberately and written down.
Expertise
Five areas. One way of working.
Privacy, data and AI governance rest on the same foundations: knowing what information you hold, who owns it, and who decides how it is used. We work across all five so nothing falls between them.
- 01Privacy AdvisoryUnderstanding and meeting your obligations under the Privacy Act and the Australian Privacy Principles, including the reforms now arriving.
- 02Data ProtectionSecuring, retaining and disposing of personal information properly, and being ready to respond when something goes wrong.
- 03Data GovernanceClear ownership, definitions, classification and quality controls for the data your organisation relies on, including for AI.
- 04AI GovernancePractical rules, ownership and oversight for the AI your organisation uses, built on Australian guidance and existing obligations.
- 05Regulatory ComplianceKeeping track of privacy, data and AI obligations as they change, and knowing which ones actually apply to you.
How engagements work
Assess. Build. Sustain.
- I
Assess
A fixed-scope review that tells you where you stand and what to fix first. Three to four weeks for most organisations.
Privacy Compliance ReviewData Protection ReviewAI Governance Readiness
- II
Build
We design and roll out the frameworks, roles and procedures that close the gaps, with your team, so they are followed.
- III
Sustain
A quarterly cycle of review, regulatory briefings and support that keeps governance current as things change.
Entry packages
Start small. Get one thing done properly.
Focused packages with a fixed scope and a defined finish, from five business days.
Privacy Policy Health Check
A marked-up policy and a short, ranked list of what to fix.
See what is includedAI Use Policy Starter
Clear rules for staff, a named owner and a register of the AI tools in use.
See what is includedIndependent advice
Clear about what we do, and what we don’t.
Lexora is an advisory firm. We assess, design and maintain governance. We tell you plainly where our work ends.
- Not a law firm. We do not give legal opinions. Where a question turns on the law, we set out the facts for your lawyer.
- Not a certification body. We can prepare you for ISO/IEC 42001 or 27701; only accredited bodies can certify.
- Not a software vendor. Our recommendations are tool-independent.
- No guaranteed outcomes. We identify gaps and build controls. Compliance depends on how they are implemented.
Trust Centre
We practise what we advise.
- No tracking. No analytics, advertising cookies or third-party scripts.
- Published AI rules. How we use AI, and what we never do with it.
- Open registers. Service providers, overseas disclosures and retention periods.
- Unbundled consent. Downloads never sign you up for marketing.
Lexora Regulatory Intelligence
What has changed, and what it means.
Dated, sourced briefings that separate enacted law from proposals, consultations, guidance and voluntary standards.
Lexora Regulatory Intelligence
The changes that matter, explained once a month.
Australian privacy, data and AI regulation, with every item labelled as law, proposal or guidance. Plain English, primary sources, no noise.
Start with a conversation.
A free 20-minute call to understand your situation and recommend the right first step. Scope and a fixed fee are confirmed in writing before any work starts.