Professional services: accountants, lawyers, conveyancers and agents.
Practices hold exactly what criminals want: client identity documents, bank details and tax records. AML/CTF reform now brings many of them under the Privacy Act as well.
What changed
From 1 July 2026, accountants, lawyers, conveyancers and real estate agents who provide AML/CTF designated services must comply with the Privacy Act for the personal information they handle for those obligations, even if they are under the $3 million small business threshold.
From the same date, the OAIC says these businesses should not keep copies of full ID documents for AML/CTF record-keeping; you record what you checked instead.
The small business exemption still applies to the rest of your business. Sources: OAIC, guidance for reporting entities · OAIC, know your privacy obligations under the AML/CTF Act
What it costs to get wrong
Not having a clearly expressed, up-to-date privacy policy can draw an OAIC infringement notice of up to $21,840 per contravention for a body corporate, and up to $364,000 if it goes to court.
Sources: OAIC, infringement notices (60 penalty units at $364) · OAIC guide, chapter 8 (court maximum of 200 penalty units, up to five times that for a body corporate)
What we do for practices
Privacy Act quick-start
A privacy policy and collection notice for your AML/CTF work, a personal-information map, a Notifiable Data Breach response plan and ID-document retention cleanup advice, fitted to how your practice works and walked through with you, in five business days.
Quoted as a fixed fee, based on your practice size.
What the quick-start coversEssential Eight assessment
The ATO says the most common ways cyber criminals exploit small business owners are by diverting payments, accessing business bank accounts, and fraudulently submitting tax returns in their names, so those are the first things we check, alongside your maturity against each of the eight controls.
What an assessment coversOffboarding and data destruction
When someone leaves: accounts shut down, records you must keep retained, files handed over, and devices holding client data wiped or destroyed with a certificate.
How offboarding worksWhether the Privacy Act applies to your practice is the first thing we check. If it does not, we will tell you rather than sell you a document you do not need. We are not lawyers, and this is not legal advice.
Fixed fee, confirmed in writing before anything starts. We reply within one business day.
Get your quote