Questions we are asked most.
Straight answers, with a source wherever a law or a regulator is involved. If yours is not here, ask us and we will answer it plainly, including when the answer is that you do not need us.
The Privacy Act quick-start
Does the Privacy Act now apply to every small business?
No. The $3 million small business exemption still exists. What changed is that a small business which is an AML/CTF reporting entity must comply with the Privacy Act for the personal information it handles for its AML/CTF obligations. The OAIC is explicit that small businesses are not covered for their other activities unless they are covered for a different reason. Source: OAIC guidance for reporting entities.
How do we know if we are covered?
Coverage follows the service you provide, not your job title. It is the first thing we check on the kickoff call, and if the answer is no, we will tell you rather than sell you a document you do not need. The quick-start page sets out who is covered in more detail.
Are bookkeepers covered?
Usually not. Bookkeepers are not one of the named tranche 2 sectors, and AUSTRAC's own example says a bookkeeper processing routine payments is less likely to be providing a designated service. It changes if you provide one, such as business address services or arranging for someone to act in a role in a company or trust. Source: AUSTRAC, professional designated services.
What should we do with the copies of client ID we already hold?
It depends on when they were made. Copies made before 31 March 2026 are AML/CTF records that must be kept for 7 years after the business relationship ends or after the last occasional transaction, then destroyed or de-identified. After the new laws commence, the AML/CTF Act does not require copies at all, and the OAIC says businesses should not keep copies of full ID documents for AML/CTF record-keeping. Other laws can still require copies, which is why this is a review rather than a bulk delete. Source: OAIC guidance for reporting entities.
Is this legal advice?
No. We are not lawyers. The quick-start is operational work against published OAIC guidance: documents written for how your practice actually runs. Where a question is genuinely legal, such as whether a particular service is a designated service, you need your own adviser, and we will say so.
The free security check
What does the free security check involve?
A passive external check of what your business already exposes to the internet: DNS and mail authentication (SPF, DKIM, DMARC), TLS and certificate configuration, login portals reachable from the open internet, and credentials for your domain that already appear in known public breach data.
You get a one-page result in plain English, yours to keep. If you want to talk it through, there is an optional 30-minute call afterwards. There is no follow-up sequence and no mailing list.
For a quick first look yourself, our free email spoofing check shows in plain English whether someone could send fake email from your domain.
Will you scan or log in to our systems?
No. Everything in the free check is read from public records and public-facing services, the same way anyone on the internet could. We do not scan, probe or log in to your systems, and we never will without your written authorisation.
Assessments, destruction and monitoring
Is an Essential Eight assessment a certification?
No. It is not a certification, an accreditation, or an ASD endorsement. oowl holds none of those and cannot issue them. An Essential Eight maturity assessment from us is a professional opinion supported by evidence, useful for your board, your insurer and your own planning. If a tender demands an IRAP assessor or an ISO 27001 certificate, you need a certified body and we will tell you so. What an assessment covers.
What evidence do we get when data is destroyed?
One certificate of destruction per asset, not one per pickup, together with the reconciled manifest, so the count you handed over matches the count you have evidence for. Our certificates are a record of work we performed and can evidence; they are not a certification issued under an accreditation scheme. oowl is not NAID AAA certified. If your contract or regulator requires a certified destruction provider, we will tell you plainly. How data destruction works.
Is oowl shield monitoring a 24/7 security operations centre?
No. Detection is automated and runs 24 hours a day, and people at oowl review alerts in business hours. You get a short monthly report checked by a person. How we contact you about a confirmed urgent issue is still being built and tested, so we promise no response time yet. It is not a 24/7 staffed security operations centre and not a managed IT service. If your situation needs round-the-clock staffing, we will tell you so. oowl shield is in internal testing and not yet available to clients. How oowl shield works.
Pricing and working with us
How much does it cost?
oowl shield monitoring (in internal testing, not yet available to clients) starts from $490, $890 or $1,490 ex GST per month depending on the plan, plus a one-off setup fee equal to one month. The final price depends on how many devices you have (computers, phones, tablets and handhelds) and is confirmed in your written quote. Assessments, the Privacy Act quick-start, advice, offboarding and data destruction are quoted to your business as a fixed fee, through the online quote form. Every fee is confirmed in writing before any work starts. All services and prices.
Is there a lock-in contract for monitoring?
The contract term for oowl shield is set out in your written quote, before you sign anything. If you stop, we remove the agents with your IT provider, raw monitoring data is deleted automatically within 90 days, and we confirm the deletion in writing.
Do you sell software or take commissions?
No. We resell no products. No commissions, no vendor partnerships, no licences marked up. What we recommend is what we would do ourselves, and the assessment is not a sales pitch for a managed-IT contract.
Where are you, and do you work outside Melbourne?
oowl is based in Melbourne and serves small and medium businesses across Australia.
Why are there no testimonials or client logos on this site?
We publish no client logos or testimonials. When clients are willing to be named, they will appear with their permission and not before.
Still have a question?
Ask it on the enquiry form or email [email protected]. We reply within one business day.