Expertise 01
Privacy Advisory
Privacy obligations, translated into decisions your organisation can actually make.
- Frameworks covered
- 4, each labelled by status
- Related solutions
- 3 fixed-scope engagements
- Last verified
- October 2026
Overview
Most organisations covered by the Privacy Act have a privacy policy. Fewer can show that the policy reflects how information is really collected, used and shared across their teams and suppliers.
Lexora’s privacy advisory work starts with that gap. We look at how information moves through your organisation, compare it with the Australian Privacy Principles, and give you a ranked, practical set of changes.
The Privacy Act is in the middle of a multi-year reform program. We separate what is already law, what has a commencement date, and what is still only proposed, so you spend effort on obligations that apply to you.
The frameworks behind it
Each is labelled by status, so enacted law is never confused with proposals or voluntary standards. Verified October 2026.
Privacy Act 1988 and the Australian Privacy Principles
Status: Law in forceThe 13 principles govern how covered organisations collect, use, disclose, secure and give access to personal information.
Automated decision-making disclosures (APP 1.7 to 1.9)
Status: Law, commencing laterFrom 10 December 2026, privacy policies must describe certain decisions made or substantially assisted by computer programs that significantly affect individuals.
Statutory tort for serious invasions of privacy
Status: Law in forceIn effect since 10 June 2025, giving individuals a cause of action for serious invasions of privacy.
Privacy Amendment (Personal Data Protection) Bill 2026
Status: Exposure draftThe second tranche of reforms, released for consultation on 31 August 2026. Not yet before Parliament and not yet law.
Privacy is a promise you make every time you collect a name.
Questions we help answer
- Does our privacy policy describe what we actually do with personal information?
- Are our collection notices given at the right time, in the right words?
- Which of our systems make decisions about people that we will need to disclose from December 2026?
- Who in our organisation is accountable for privacy, and do they know it?
Related solutions
- AssessPrivacy Compliance ReviewA fixed-scope review of how your organisation handles personal information against the Australian Privacy Principles, with a ranked gap register and a 90-day plan.
- BuildPrivacy Governance FrameworkDesign and roll out the policies, roles and procedures that make privacy an operating part of your organisation, not a document on a shelf.
- SustainOngoing Privacy & Governance AdvisoryA standing advisory relationship that keeps your privacy, data and AI governance current as your systems, suppliers and obligations change.
Start with a conversation.
A free 20-minute call to understand your situation and recommend the right first step. Scope and a fixed fee are confirmed in writing before any work starts.