Practice 01 · Privacy & Data Protection
Privacy isn't just compliance. It's how you keep the trust of the people whose information you hold.
Meeting your obligations under the Privacy Act and the Australian Privacy Principles, from the first point of collection to secure disposal, and being ready when something goes wrong.
The business problem
Most organisations covered by the Privacy Act have a privacy policy. Far fewer can show that it matches how personal information is really collected, used, shared, stored and deleted across their teams and suppliers. That gap is where complaints, breaches and regulatory attention start.
- 13
- Australian Privacy Principles govern how covered organisations handle personal information.
- 30 days
- The period within which a suspected eligible data breach should be assessed under the NDB scheme.
- 10 Dec 2026
- Privacy policies must start describing certain automated decisions about individuals.
Lexora’s privacy work starts with the gap between what your policy says and what your organisation does. We look at how information moves through your teams and suppliers, compare it with the Australian Privacy Principles, and give you a ranked, practical set of changes.
The Privacy Act is in the middle of a multi-year reform program. We separate what is already law, what has a commencement date, and what is still only proposed, so you spend effort on obligations that apply to you.
We work at the level of policy, process and accountability. We are not a law firm and do not provide legal advice; where formal legal interpretation is needed, we prepare the material for your lawyers. We are not a cybersecurity firm; where technical testing is needed, we help you scope what to ask a specialist for.
The life of a name
Every record has a journey. The APPs follow it.
We map how personal information actually moves through your organisation, stage by stage, and test each one against the Australian Privacy Principles.
Collect
APP 3 · APP 5
Only what you need, collected fairly, with a notice given at or before the time of collection.
Use & disclose
APP 6
Used for the purpose it was collected for, or a permitted secondary purpose.
Share overseas
APP 8
Reasonable steps before disclosing personal information to an overseas recipient.
Secure
APP 11.1
Reasonable steps to protect it from misuse, interference, loss and unauthorised access.
Access & correct
APP 12 · APP 13
Individuals can ask to see it and have it corrected.
Destroy
APP 11.2
Destroyed or de-identified once it is no longer needed.
APP references are a guide to where each obligation sits. Whether and how they apply depends on your organisation; formal interpretation remains with your lawyers.
Australian regulatory context
What applies, labelled by status.
Law in force is never confused with proposals, and voluntary guidance is never presented as mandatory. Verified October 2026.
Privacy Act 1988 and the Australian Privacy Principles
Status: Law in forceThe 13 principles govern how covered organisations collect, use, disclose, secure and give access to personal information.
Notifiable Data Breaches scheme (Privacy Act, Part IIIC)
Status: Law in forceIn force since February 2018. Requires assessment of suspected eligible data breaches and notification of affected individuals and the OAIC.
Automated decision-making disclosures (APP 1.7 to 1.9)
Status: Law, commencing laterFrom 10 December 2026, privacy policies must describe certain decisions made or substantially assisted by computer programs that significantly affect individuals.
Statutory tort for serious invasions of privacy
Status: Law in forceIn effect since 10 June 2025, giving individuals a cause of action for serious invasions of privacy.
Privacy Amendment (Personal Data Protection) Bill 2026
Status: Exposure draftThe second tranche of reforms, released for consultation on 31 August 2026. Not yet before Parliament and not yet law.
Privacy is a promise you make every time you collect a name.
Services & deliverables
What you receive.
- 01
Personal information map
Where personal information is collected, where it goes, who can see it and when it is destroyed, including suppliers.
- 02
Gap assessment against the APPs
Each principle assessed against your practice, with findings ranked by risk and effort.
- 03
Policy and notice updates
Marked-up privacy policy and collection notices, including automated decision-making wording, ready for your lawyer to confirm.
- 04
Breach response plan and exercise
Roles, decision points and templates aligned to the Notifiable Data Breaches scheme, tested in a facilitated tabletop.
Engagement process
How the work runs.
- 1
Discover
Interviews and document review to see how information really moves through your organisation.
- 2
Map
A personal information map across systems, teams and suppliers.
- 3
Assess
Practice compared with the Australian Privacy Principles, with gaps ranked.
- 4
Remediate
Updated policies, notices, retention rules and a tested breach plan.
A way to start
Privacy Health Check
A short, fixed-scope review of your privacy policy, collection notices and breach readiness, with a ranked list of what to fix first.
Fixed scope and fee, confirmed in writing after a free call. This is an advisory engagement, not legal advice.
Typical timeframeAbout two weeks
What it includes
- Review of your privacy policy and key collection notices
- Check against the APPs and the 10 December 2026 changes
- Breach readiness snapshot
- Walkthrough call with ranked recommendations
Questions we help answer
If you are asking these, we should talk.
- Does our privacy policy describe what we actually do with personal information?
- Are our collection notices given at the right time, in the right words?
- Where is personal information stored, including copies held by suppliers, and is anyone deleting it?
- Could we assess a suspected breach and decide whether to notify within the expected timeframe?
Related insights
Reading for this practice
Discuss your governance needs.
A free 20-minute call to understand your situation and recommend the right first step. Scope and a fixed fee are confirmed in writing before any work starts.