About Lexora
Independent governance advice, written to be followed.
An advisory firm for privacy, data and AI governance, starting in Australia.
- Independent
- No vendor ties or referral fees
- Not a law firm
- We work alongside your lawyers
- Not a certifier
- We prepare; accredited bodies certify
- Every engagement
- Fixed scope and fee
Who we are
An independent advisory firm for privacy, data and AI governance, starting in Australia.
Lexora helps organisations navigate privacy obligations, govern information responsibly and manage the risks of artificial intelligence. We do that through fixed-scope assessments, practical frameworks built with your people, and a standing advisory cycle that keeps them current.
We focus on organisations that carry real privacy and data obligations but do not have a large in-house privacy or governance function. Our work is designed to be followed, not filed.
Our approach
Four principles behind every engagement
- 01Practice before paperworkWe look at what actually happens to information, then at the documents that describe it.
- 02Status before urgencyWe separate enacted law from proposals, guidance and voluntary standards, so effort goes where obligations really apply.
- 03Scope before workEvery engagement has a written scope, named deliverables and a fixed fee before it starts.
- 04Ownership before handoverYour people help design the framework, approve it and run it. You own everything we produce.
Governance works when the people who run it helped design it.
Boundaries and independence
Where our work ends
- We are not a law firm. We do not provide legal advice, legal opinions or legal representation. Where a finding turns on a legal question, we record the facts and the question for your lawyer, who decides the legal position.
- We are not a certification body. We can help you prepare for ISO/IEC 42001 or ISO/IEC 27701, but certification is given only by accredited certification bodies.
- We are not a cybersecurity implementation provider. We review security at the level of policy, process and accountability. Technical testing should be done by security specialists.
- We do not sell software. We receive no referral fees from technology vendors, and our recommendations are tool-independent.
- We do not guarantee compliance. We identify gaps and build controls. Outcomes depend on how they are implemented and maintained.
- We do not mark our own homework. If we have designed your framework, we will not present an independent opinion on its effectiveness. That should come from someone else.
Who we are
The people on your engagement
Every Lexora proposal names the people who will deliver the work and the experience they bring to it, before you agree to anything.
Based in Australia, working with organisations nationally.
Start with a conversation.
A free 20-minute call to understand your situation and recommend the right first step. Scope and a fixed fee are confirmed in writing before any work starts.