The Privacy Act quick-start for AML/CTF reporting entities.
For accountants, lawyers, conveyancers and real estate agents brought into the AML/CTF regime on 1 July 2026. A privacy policy, collection notice, personal-information map and breach response plan, delivered within five business days. A fixed fee, quoted online before you commit.
Templates give you documents. We give you finished documents fitted to how your practice actually works, walked through with you, in five business days.
Who is covered
From 1 July 2026, AML/CTF obligations apply to certain “designated services” typically provided by real estate professionals, dealers in precious stones and metals, and professional service providers such as lawyers, conveyancers, accountants, and trust and company service providers. Once a business is a reporting entity, the OAIC states that the Privacy Act applies to its personal information handling in connection with those obligations, regardless of whether it would otherwise be a small business. Source: OAIC, privacy guidance for reporting entities under the AML/CTF Act.
Two limits matter. Coverage follows the service you provide, not your job title, so not every accountant or agent is a reporting entity. And the small business exemption still applies to the rest of your business: the Privacy Act reaches your AML/CTF work, not everything you do. Whether you are covered is the first thing we check with you, and if the answer is no, we will say so rather than sell you a document you do not need.
What the law asks for
- A privacy policy. A clearly expressed and up-to-date policy about how you manage personal information (APP 1.3), with the contents APP 1.4 lists. Source: OAIC, the Australian Privacy Principles.
- Collection notices. Telling clients why their information is collected and how it will be used, at or before the time you collect it (APP 5), unless giving the notice would breach the tipping-off rules. Source: OAIC, know your privacy obligations under the AML/CTF Act.
- No copies of full ID documents for record-keeping. From 31 March 2026 for existing reporting entities and 1 July 2026 for tranche 2, the OAIC says businesses should not retain copies of full ID documents for AML/CTF record-keeping purposes. You record what you checked instead. Source: OAIC, know your privacy obligations under the AML/CTF Act.
- Automated decision-making, where it applies. From 10 December 2026, APP entities must include information in their privacy policy where they have arranged for a computer program to make or inform decisions that significantly affect individuals’ rights or interests. Source: OAIC, transparency for AI and automated decision-making.
- A plan for a breach. If you suspect an eligible data breach you must take reasonable steps to complete an assessment within 30 days. Source: OAIC, the Notifiable Data Breaches scheme.
What it costs to get wrong
The OAIC can issue an infringement notice for not having a clearly expressed, up-to-date privacy policy, or for leaving required content out of it: up to 60 penalty units per contravention for a body corporate, currently $21,840. Source: OAIC, infringement notices.
If the same contravention goes to court instead, the maximum is 200 penalty units, and up to five times that for a body corporate: $364,000 at the current $364 penalty unit. Sources: OAIC guide to privacy regulatory action, chapter 8 and OAIC, infringement notices, note 7.
What we deliver
Privacy policy and collection notice
A privacy policy covering your AML/CTF personal information handling, and the collection notice for your client intake, with the tipping-off exception handled. Where your decisions need it, the automated decision-making disclosure that applies from 10 December 2026, so the policy does not need rewriting in December.
Personal-information map
What you collect for customer due diligence, where it lives, who can reach it, who you share it with, and how long you keep it. This is the document that makes every later privacy question answerable in minutes instead of days.
Notifiable Data Breach response plan
Named roles, decision criteria, notification templates and a timeline that fits inside the 30-day assessment obligation, written so the person reading it at 9pm on a Friday knows what to do next.
ID-document retention cleanup advice
Where copies of client ID sit today, in inboxes, shared drives and scanners, which ones you still have to keep and until when, and how to stop making new ones. Advice and a plan; the clean-up itself can be done by your staff, your IT provider, or us under the offboarding and data destruction service.
How it works
Five business days from the kickoff call to handover.
Book
Choose a time for the kickoff call. The fixed fee is confirmed in writing before anything else happens.
30-minute kickoff call
Which services you provide, how clients are onboarded, which systems hold their details, and whether the Privacy Act reaches you at all.
Document request
A short list: your current policy if you have one, client intake forms, and the systems you use. Send what exists; missing documents are what we are here to write.
Delivery and handover
Within five business days of the kickoff call, the documents arrive and we walk through them on a call with whoever makes the decisions.
Price
Privacy Act quick-start, 1 to 3 staff
Privacy policy and collection notice, personal-information map, Notifiable Data Breach response plan and ID-document retention advice. Kickoff and handover calls included. Not legal advice; we are not lawyers.
Privacy Act quick-start, 4 or more staff
The same documents and calls, for a practice with more people, systems and client files to map.
When you are ready for more, the security assessment covers Essential Eight and Privacy Act readiness together, quoted the same way.
Get your quoteQuestions
Does the Privacy Act now apply to every small business?
No. The $3 million small business exemption still exists. What changed is that a small business which is an AML/CTF reporting entity must comply with the Privacy Act for the personal information it handles for its AML/CTF obligations. The OAIC is explicit that small businesses are not covered for their other activities unless they are covered for a different reason. Source: OAIC guidance for reporting entities.
We turn over less than $3 million. Does this still apply to us?
If you provide an AML/CTF designated service, yes, for that part of your work. The OAIC states the Privacy Act applies to personal information handling in connection with AML/CTF obligations regardless of whether the entity falls within the definition of a small business. Source: OAIC guidance for reporting entities.
Are bookkeepers covered?
Usually not. Bookkeepers are not one of the named tranche 2 sectors, and AUSTRAC's own example says a bookkeeper processing routine payments is less likely to be providing a designated service. It changes if you provide one, such as business address services or arranging for someone to act in a role in a company or trust. Source: AUSTRAC, professional designated services.
Does our privacy policy have to cover the whole business?
Not if the AML/CTF work is the only reason the Privacy Act applies to you. The OAIC says the policy need only cover your personal information handling for the purposes of your AML/CTF obligations. If you are covered for another reason as well, the policy covers that too. Source: OAIC guidance for reporting entities.
What should we do with the copies of client ID we already hold?
It depends on when they were made. Copies made before 31 March 2026 are AML/CTF records that must be kept for 7 years after the business relationship ends or after the last occasional transaction, then destroyed or de-identified. After the new laws commence, the AML/CTF Act does not require copies at all, and the OAIC says businesses should not keep copies of full ID documents for AML/CTF record-keeping. Other laws can still require copies, which is why this is a review rather than a bulk delete. Source: OAIC guidance for reporting entities.
Do we need the automated decision-making disclosure?
Only if it applies to you. From 10 December 2026, the policy must explain where a computer program makes, or does something substantially and directly related to making, a decision that could reasonably be expected to significantly affect someone's rights or interests, using their personal information. Many small practices will have nothing to disclose. If you do, it goes in the policy we write. Source: OAIC, transparency for AI and automated decision-making.
Is this legal advice?
No. We are not lawyers. The quick-start is operational work against published OAIC guidance: documents written for how your practice actually runs. Where a question is genuinely legal, such as whether a particular service is a designated service, you need your own adviser, and we will say so.
We already have the OAIC or law society templates. Why pay?
The templates are a good start, and we use them. But the OAIC’s AML/CTF resources include a template collection notice and no template privacy policy or data breach response plan, and law society kits are written for law practices and left for you to fill in. Source: OAIC guidance for reporting entities.
We fit the documents to your client intake, your systems and how you handle ID, build the personal-information map and breach response plan from how your practice actually works, and walk you through all of it on the handover call.