Privacy compliance for accounting practices

Savira is an Australian privacy compliance platform for small and growing businesses. It helps you work out what the Privacy Act asks of you, put the basics in place (privacy policy, website consent, breach and request templates, staff training), and keep a record of what you have done. It is a practical starting point, not legal advice.

There is a free Starter plan for up to 1,000 contact records, which covers a lot of small businesses. Growth is $79 a month for up to 15,000 records, and Pro starts at $299 a month. Full details are on the pricing page.

If your practice provides designated services under the AML/CTF Act, yes. Section 6E of the Privacy Act removes the small business exemption for reporting entities, so turnover is no longer the test. If you provide no designated services, the exemption may still hold, but it is worth confirming rather than assuming. A banner on its own is not enough, though. Visitors must be able to decline as easily as they accept, and declining has to actually stop the tracking.

The Privacy Act does not name cookie banners as a requirement. It does require you to tell people what you collect and why, and to get consent before collecting sensitive information such as health details. If your site runs analytics or advertising scripts, a banner that holds them back until people agree is the most practical way to do that. A banner on its own is not enough, though. Visitors must be able to decline as easily as they accept, and declining has to actually stop the tracking.

It does if it no longer describes what you do. A policy has to reflect actual practice, and most practices have added a booking tool, a client portal, a marketing platform and analytics since the policy was written. A policy that describes a different business is worse than a short accurate one.

Only with consent or a compliant opt-out. Information collected to prepare a tax return was not collected for marketing, so using it that way engages APP 6 and APP 7. Every marketing email also needs a functional unsubscribe under the Spam Act 2003.

Yes. Every account includes your compliance logs: consent records, the notices and emails you have sent, and your published policies, ready to export.