Expertise 02
Data Protection
Know what you hold, keep only what you need, and be ready on the day something goes wrong.
- Frameworks covered
- 3, each labelled by status
- Related solutions
- 3 fixed-scope engagements
- Last verified
- October 2026
Overview
Data protection is where privacy obligations meet operations: storage, access, retention, suppliers and incident response.
Lexora works at the level of policy, process and accountability. We map personal information across your systems and suppliers, review the controls around it, and prepare and test your breach response.
We are not a cybersecurity implementation firm. Where technical testing is needed, we recommend you engage a specialist and we can help you scope what to ask them for.
The frameworks behind it
Each is labelled by status, so enacted law is never confused with proposals or voluntary standards. Verified October 2026.
APP 11, security of personal information
Status: Law in forceCovered organisations must take reasonable steps to protect personal information and to destroy or de-identify it when no longer needed.
Notifiable Data Breaches scheme (Privacy Act, Part IIIC)
Status: Law in forceIn force since February 2018. Requires assessment of suspected eligible data breaches and notification of affected individuals and the OAIC.
ISO/IEC 27701:2025
Status: Voluntary standardThe privacy information management standard, published as a standalone edition in October 2025. Certification is available only from accredited certification bodies.
The safest personal information is the information you no longer keep.
Questions we help answer
- Where is personal information stored, including copies held by suppliers?
- How long do we keep it, and is anyone actually deleting it?
- Could we assess a suspected breach and decide whether to notify within the expected timeframe?
- Have we rehearsed our breach response with the people who would run it?
Related solutions
- AssessData Protection & Information Handling ReviewFind out where personal information sits, who can reach it, how long it is kept, and whether you are ready to respond to a data breach.
- BuildPrivacy Governance FrameworkDesign and roll out the policies, roles and procedures that make privacy an operating part of your organisation, not a document on a shelf.
- SustainOngoing Privacy & Governance AdvisoryA standing advisory relationship that keeps your privacy, data and AI governance current as your systems, suppliers and obligations change.
Start with a conversation.
A free 20-minute call to understand your situation and recommend the right first step. Scope and a fixed fee are confirmed in writing before any work starts.