Assess · Solution 01
Privacy Compliance Review
A fixed-scope review of how your organisation handles personal information against the Australian Privacy Principles, with a ranked gap register and a 90-day plan.
- Stage
- Assess
- Timeframe
- Typically three to four weeks from receipt of documents.
- You receive
- 5 named deliverables
- Fee
- Fixed, agreed in writing first
- Who it is for
- Organisations covered by the Privacy Act that do not have a dedicated privacy specialist, or that are unsure whether their privacy policy still matches what they actually do.
- The problem
- You have a privacy policy, but no clear view of whether day-to-day practice meets the 13 Australian Privacy Principles. From 10 December 2026, privacy policies must also explain certain automated decisions that affect individuals.
- Scope
- Interviews with up to six people who handle personal information or own the processes that collect it.
- Review of your privacy policy, collection notices and consent points.
- Mapping of up to five key personal-information flows, from collection to disposal.
- A check for automated or computer-assisted decisions that significantly affect individuals.
- Review against each of the 13 Australian Privacy Principles.
- You receive
- APP gap register, each gap rated high, medium or low with the reasoning shown.
- Marked-up recommendations for your privacy policy and collection notices.
- Automated decision-making disclosure checklist.
- Prioritised 90-day action plan with suggested owners.
- A 60-minute readout with your leadership team.
- Timeframe
- Typically three to four weeks from receipt of documents.
- Fee
- Every engagement is fixed-fee. We confirm scope and fee in writing after a free scoping call, before any work starts.
- Not included
- No legal advice or legal opinion. Where a finding turns on a legal question, we set out the facts and the question for your lawyer.
- No technical security testing.
- No guarantee of compliance. The review identifies gaps; closing them depends on implementation.
The review is built around the Australian Privacy Principles because they are the obligations most Australian organisations are measured against. It looks at what actually happens to personal information, not just at the documents that describe it.
How it runs
- 01
Scoping call
A free 20-minute call to confirm the review fits and agree what is in scope. Fee confirmed in writing.
- 02
Document request
We send a short list of documents and systems to look at. Nothing is collected that the review does not need.
- 03
Interviews and review
Interviews with your nominated people and a review of the documents against each principle.
- 04
Findings and readout
You receive the gap register, recommendations and action plan, then walk through them with us.
What usually comes next. Most organisations move to a Privacy Governance Framework to close the gaps the review finds.
Most privacy risk sits in the gap between the policy on the website and what happens on a Tuesday afternoon.
Questions
Does my organisation need to comply with the Privacy Act?
Most Australian Government agencies and businesses with annual turnover above $3 million are covered, and some smaller businesses are covered because of what they do, for example health service providers. The scoping call confirms whether and how the Act applies to you.
What do we need to prepare?
Your current privacy policy and collection notices, and access to the people who run the processes in scope. We will send a short checklist.
Will the review make us compliant?
No review can do that on its own. It tells you where you stand and what to fix first. Many clients ask us to help close the gaps through a Privacy Governance Framework.
Start with a conversation.
A free 20-minute call to understand your situation and recommend the right first step. Scope and a fixed fee are confirmed in writing before any work starts.