Free readiness check
Twelve questions. No email required.
Work through these honestly. If you answer "no" or "I'm not sure" to more than three, you have a program to build — and you'd know that before you spoke to anyone, including us.
Section one — Are you in scope?
Scope.
1. Do you provide any designated service under the AML/CTF Act?
Brokering the sale or purchase of real property, conveyancing, forming companies or trusts, managing client money, or acting as a nominee director or trustee. If yes, you're a reporting entity and the small business exemption no longer covers the personal information you handle in that work.
2. Can you say, in one sentence, which parts of your business are captured and which aren't?
Almost nobody can. The obligation attaches to the service, not to the ABN, so most businesses are partly in scope. Writing that line down is the first deliverable of any real program.
3. Have you enrolled with AUSTRAC?
Separate obligation, separate regulator — but if you've enrolled and haven't touched your privacy program, that's the gap this page is about.
Section two — Do you know where the data is?
Data.
4. Is there a written list of every system that holds personal information?
Including email, phones, personal cloud storage, the scanning folder, and the archive boxes. If it only exists in someone's head, it isn't a data map.
5. Do you know which of your service providers store data outside Australia?
Under APP 8 you stay accountable for personal information you disclose to an overseas recipient. "The vendor handles compliance" is not the same as knowing where your clients' documents physically sit.
6. Do you have a retention schedule that says when things get destroyed?
Not a habit — a document, with categories and periods. APP 11.2 requires you to destroy or de-identify personal information you no longer need. "We keep everything" is the most common failure we find.
7. Have you removed access for everyone who has left?
Former staff, former contractors, the bookkeeper you stopped using, the shared login that three people know.
Section three — Could you demonstrate it?
Documents and people.
8. Does your privacy policy reference the Australian Privacy Principles and describe what you actually do?
A generic template downloaded years ago is a contravention risk in itself — the OAIC can issue infringement notices of up to $66,000 per contravention for failures at this level.
9. Do your intake forms carry a collection notice?
Tenancy applications, client onboarding, fact finds, website enquiry forms. APP 5 requires notification at or before the point of collection.
10. Is there a written data breach response plan, and does a named person own it?
You have 30 days to assess a suspected eligible data breach. Deciding who's in charge on day one is not a plan.
11. Have your staff had privacy training in the last twelve months?
The most likely breach in your business is a person sending the right file to the wrong recipient. No control fixes that except training.
12. If the OAIC wrote to you next week, could you produce evidence of all of the above?
This is the real question. Compliance you can't demonstrate is indistinguishable from non-compliance when someone asks.
Reading your answers
What the result means.
Zero to two gaps. You're in reasonable shape. Fix the specific items and get on with your day — you probably don't need us, and we'd tell you the same on a call.
Three to six gaps. Typical for a business that came into scope this year. This is a four-week build, not a crisis, and it's exactly what privacy foundations covers.
Seven or more. Worth moving on. Not because anything is about to happen, but because the cost of doing this calmly over four weeks is a fraction of doing it in the 30 days after an incident.
Want the same assessment in writing?
The call is free and can end with us telling you you're fine. If you want it documented properly — a written findings memo against the Australian Privacy Principles you can put in front of a partner or an insurer — that's the $750 privacy health check, credited in full if you go on to foundations.