For law firms
Privacy compliance for Australian law firms
Law firm privacy compliance changed on 1 July 2026: firms that provide AML/CTF designated services now follow the Australian Privacy Principles and hold more client identity documents than ever.
Why businesses trust Savira
- Australian owned
- Account data and consent records hosted in Australia
- Built for the Australian Privacy Principles
Why it matters for your firm
What makes law firms different
The small business exemption may fall away
Firms providing designated services can be covered whatever their turnover.
More identity data than ever
Verification adds documents you must store and protect.
Privilege is not a privacy plan
Client privilege does not replace Privacy Act obligations.
A partner-level issue
Privacy decisions sit with the partners.
Want the detail? Read: Privacy Act for law firms: what changed on 1 July 2026
What Savira does for your firm
Your policy, consent and records in one place
- A privacy policy template for firms
- Collection notices for client intake
- Breach templates and a response plan
- Staff training for front office and paralegals
Tom's journey
Follow one person through your firm
- 1 · Intake
Tom books a consult.
Savira: A collection notice on intake.
- 2 · Verify
You collect his ID.
Savira: Your policy says why and how long.
- 3 · Store
Files go to your practice software.
Savira: Providers named in your policy.
- 4 · Ask
He asks for a copy of his data.
Savira: A response template and log.
- 5 · Prove
A complaint is made.
Savira: Records show each step.
Your action plan
What to do, and when
- 0 to 3 months
Start here
- Run the free website scan
- Update your privacy policy
- Hold tracking until consent works
- 3 to 12 months
Then
- Write a breach response plan
- Train your team
- List who holds your customer data
- 12 to 18 months
Keep it current
- Review overseas providers
- Prepare for automated decision rulesLegal review
- Review your policy every year
Law firms privacy checklist
A three page PDF you can work through this week. Download it free.
Do law firms have to comply with the Privacy Act?
Firms with more than $3 million turnover always have. Since 1 July 2026, any firm that provides an AML/CTF designated service must too, because section 6E removes the small business exemption for reporting entities.
How should law firms store client ID documents?
In one secure system with access limited to the people who need it, kept for the seven years the AML/CTF rules require, then destroyed. Not in email attachments or shared drives.
Does legal professional privilege cover us for privacy purposes?
No. Privilege protects communications from compelled disclosure. It does not exempt a firm from the APPs, the Notifiable Data Breaches scheme or an individual's right to access their information.
Our website only has a contact form and some articles. Is there anything to do?
Probably. Most firm websites run analytics and often ad scripts that collect personal information before anyone agrees, and the enquiry form needs a collection notice.
Does our privacy policy need updating now that we are a reporting entity?
Almost certainly. Customer due diligence means collecting identity information you did not collect before and keeping it for seven years. The policy has to say so.