For law firms
Privacy compliance for Australian law firms
More client identity data means more to protect. Keep your policy, notices and records in order.
10 minutes. No account needed for the score.
Why businesses trust Savira
- Australian owned
- Data hosted in Australia
- Built for the Australian Privacy Principles
- ABN 53 273 071 022
Why it matters for your firm
What makes law firms different
The small business exemption may fall away
Firms providing designated services can be covered whatever their turnover.
More identity data than ever
Verification adds documents you must store and protect.
Privilege is not a privacy plan
Client privilege does not replace Privacy Act obligations.
A partner-level issue
Privacy decisions sit with the partners.
Want the detail? Read: Australian Privacy Principles explained
What Savira does for your firm
Your policy, consent and records in one place
- A privacy policy template for firms
- Collection notices for client intake
- Breach templates and a response plan
- Staff training for front office and paralegals
Tom's journey
Follow one person through your firm
- 1 · Intake
Tom books a consult.
Savira: A collection notice on intake.
- 2 · Verify
You collect his ID.
Savira: Your policy says why and how long.
- 3 · Store
Files go to your practice software.
Savira: Providers named in your policy.
- 4 · Ask
He asks for a copy of his data.
Savira: A response template and log.
- 5 · Prove
A complaint is made.
Savira: Records show each step.
Your action plan
What to do, and when
Start here
- Run the free website scan
- Update your privacy policy
- Hold tracking until consent works
Then
- Write a breach response plan
- Train your team
- List who holds your customer data
Keep it current
- Review overseas providers
- Prepare for automated decision rulesLegal review
- Review your policy every year
Law firms privacy checklist
A one page PDF you can work through this week. We email it to you.
FAQ
What law firms businesses ask us
We are a small firm under the $3 million threshold. Does this apply to us?
If your firm provides designated services under the AML/CTF Act, yes. Section 6E of the Privacy Act removes the small business exemption for reporting entities. Litigation, advice work and court advocacy are generally not designated services, but if any part of the practice provides one, the obligations follow.
Does legal professional privilege cover us for privacy purposes?
No. Privilege protects communications from compelled disclosure. It does not exempt your firm from the Australian Privacy Principles, the Notifiable Data Breaches scheme, or an individual's right to seek access to their personal information.
We missed the AUSTRAC enrolment deadline. What now?
Enrol as soon as you can. Enrolment closed on 29 July 2026 and AUSTRAC has begun issuing notices to businesses that appear to be providing designated services without enrolling. It has indicated it will focus on those wilfully ignoring their obligations rather than firms making a genuine effort. Enrolment is free through AUSTRAC Online Services.
Our website only has a contact form and some articles. Is there anything to do?
Probably. Most firm websites run analytics and often advertising scripts, and those collect personal information before anyone has agreed to it. Your enquiry form also needs a collection notice, because a prospective client filling it in is handing over information about a legal problem before they are even a client.
Does our privacy policy need updating now that we are a reporting entity?
Almost certainly. Customer due diligence means you are collecting identity information you were not collecting before, from people you may never act for, and keeping it for seven years. If the policy does not say that, it does not reflect your practice.
Get the foundations in place this week
Free forever on Starter. No credit card. Built for the Australian Privacy Principles.