Privacy and Data Protection Lawyers

It can. The UK and EU GDPR can apply to businesses outside Europe that offer goods or services to people in the UK or EU, or monitor their behaviour. We can tell you quickly whether it applies to you and what that means in practice.

If you use automated systems or AI to make decisions that significantly affect people, yes. From 10 December 2026, your privacy policy must explain what those systems decide and what personal information they use. We can review your policy and update it before the deadline.

Not without checking first. Under the Privacy Act, putting personal information into a third-party AI tool is a use or disclosure, so it needs to fit the purpose you collected it for (APP 6), and APP 8 applies if the provider holds it overseas. The OAIC’s guidance is to avoid entering personal information, especially sensitive information, into publicly available AI tools. If the GDPR applies, you may also need a lawful basis, a DPA with the provider and a DPIA for higher-risk uses. We check the tool’s terms, write the rules into an AI use policy and make sure your privacy policy matches what your team actually does.

Usually not if your annual turnover is $3 million or less. There are exceptions, though, such as health service providers, businesses that trade in personal information and some contractors to government. Since 1 July 2026, businesses newly regulated under the anti-money-laundering (AML/CTF) laws, such as lawyers, accountants and real estate agents, are also covered. The draft reform bill released on 31 August 2026 keeps the $3 million exemption for now, but it remains under review, so it’s worth planning ahead.

Yes. We review the agreement, explain the obligations and risks in plain English, and negotiate the changes worth making so the deal is not held up.

Contact us straight away. In Australia, if you suspect an eligible data breach you have up to 30 days to assess it. If it is likely to cause serious harm, you must notify the OAIC and the people affected as soon as practicable. Under the UK and EU GDPR, the regulator usually needs to be told within 72 hours. Early advice on containment, assessment and notification matters.

Yes. We offer an outsourced Data Protection Officer service covering privacy advice, DPIAs, training and regulator contact, without the cost of a full-time hire.

Yes. We work alongside your auditor on the policies, legal and contractual requirements and supplier terms needed for audit readiness.

You can, but a template describes a generic business, not yours. Under APP 1, your privacy policy has to set out the personal information you actually collect, how you collect, use and disclose it, whether it goes overseas, and how people can access or correct it or make a complaint. A policy that doesn’t match what you really do can mislead customers, and the OAIC has begun checking privacy policies against these requirements. We draft or fix your policy around how your business handles data in practice.

Most reviews are turned around within 5 business days, with the timeframe confirmed alongside your fixed fee.

It depends on what you need, but you won’t be guessing. Every matter is quoted as a fixed fee or monthly retainer, agreed in writing before any work starts.