For accounting practices
Privacy compliance for accounting practices
Since 1 July 2026, accounting practices that provide AML/CTF designated services must follow the Privacy Act, whatever their turnover. Here is what changes and what to put in place first.
Why businesses trust Savira
- Australian owned
- Account data and consent records hosted in Australia
- Built for the Australian Privacy Principles
Why it matters for your practice
What makes accounting different
The small business exemption may fall away
Practices that become AML/CTF reporting entities can be covered whatever their turnover.
Over-collection is a red flag
Collect only the client information you need.
Online conduct matters
Your website, forms and portals collect personal information.
A partner-level issue
Privacy decisions sit with the people who run the practice.
Want the detail? Read: Privacy Act for accountants: what changed on 1 July 2026
What Savira does for your practice
Your policy, consent and records in one place
- A privacy policy template for practices
- Collection notices for client onboarding
- Breach templates and a response plan
- Staff training on handling client data
Priya's journey
Follow one person through your practice
- 1 · Onboard
Priya becomes a client.
Savira: A collection notice at onboarding.
- 2 · Verify
You check her ID.
Savira: Your policy explains why.
- 3 · Share
Her data goes to your software.
Savira: Providers named in your policy.
- 4 · Breach
A laptop is lost.
Savira: A step by step response template.
- 5 · Prove
She asks what you did.
Savira: Records show each step.
Your action plan
What to do, and when
- 0 to 3 months
Start here
- Run the free website scan
- Update your privacy policy
- Hold tracking until consent works
- 3 to 12 months
Then
- Write a breach response plan
- Train your team
- List who holds your customer data
- 12 to 18 months
Keep it current
- Review overseas providers
- Prepare for automated decision rules
- Review your policy every year
Accounting privacy checklist
A three page PDF you can work through this week. Download it free.
Do accountants have to comply with the Privacy Act?
If your practice provides AML/CTF designated services, yes. Section 6E of the Privacy Act removes the small business exemption for reporting entities, so turnover is no longer the test.
What are the AML/CTF Tranche 2 privacy obligations for accountants?
Follow all 13 APPs for the information you hold, including the identity documents collected for customer due diligence. That means an accurate privacy policy, secure storage, a breach response plan and access on request.
Our website is just a brochure with a contact form. Do we need a cookie banner?
If the site runs analytics or ad scripts, yes in practice: hold them until visitors agree. The contact form also needs a short collection notice.
Our privacy policy came from a template years ago. Does that matter?
Yes, if it no longer describes what you do. Most practices have added a client portal, e-signing, a marketing platform and analytics since then.
Can we email clients about other services we offer?
Only with consent or a valid opt-out. Information collected to prepare a tax return was not collected for marketing, and every marketing email needs a working unsubscribe under the Spam Act 2003.
How much does Savira cost?
Starter is free for up to 1,000 contact records. Growth is $79 a month for up to 15,000 and Pro is $299 a month for up to 50,000, all in AUD excluding GST and month to month. See the pricing page.