Privacy Act for law firms: what changed on 1 July 2026

Does the Privacy Act apply to law firms now?

If your firm provides designated services under the AML/CTF Act, yes. Since 1 July 2026, those firms are AML/CTF reporting entities, and reporting entities lose the small business exemption in the Privacy Act 1988 (Cth). That means the Australian Privacy Principles (APPs) apply to you, whatever your turnover.

Law firms already hold some of the most sensitive personal information in the country. Now customer due diligence means you're collecting and verifying identity information at a scale most firms have never handled, and every extra record is extra exposure if something goes wrong. Privacy risk belongs alongside professional indemnity and AML/CTF compliance in your governance and risk framework. It's a partner-level issue, not a back-office task.

Which legal services are designated services?

The Privacy Act includes a small business exemption that generally excludes businesses with annual turnover of $3 million or less. Many smaller practices have relied on it.

That changed on 1 July 2026. Under section 6E of the Privacy Act, a small business operator that is a reporting entity under the AML/CTF Act must comply with the Privacy Act for its AML/CTF-related activities. The exemption doesn't apply.

Your firm is likely affected if it provides any of the designated services set out in the AML/CTF Act, including:

• managing client money or assets

• acting in the buying, selling or transferring of real estate or a business

• creating and managing trusts, companies or similar structures.

Not every service a law firm provides is a designated service. Litigation, advice work and court advocacy are generally not captured. But if any part of your practice provides a designated service, the Privacy Act obligations follow.

Not sure where you stand? Get advice. AUSTRAC has published a Legal Profession Starter Kit and a Conveyancing Starter Kit, and your state law society has issued guidance for members.

What has changed under the Privacy Act?

1. Much stronger enforcement powers

The Privacy and Other Legislation Amendment Act 2024 expanded the powers of the Office of the Australian Information Commissioner (OAIC). It can now issue infringement notices for certain breaches, use stronger investigation and information-gathering powers, and run public inquiries into systemic privacy practices.

2. Significantly higher penalties

Courts can order penalties of up to $50 million, three times the benefit obtained, or 30% of adjusted turnover, for a company’s serious interference with privacy (Privacy Act s 13G). Lower-tier penalties and OAIC infringement notices now apply to less serious breaches.

3. Individuals can now sue

The statutory cause of action for serious invasions of privacy commenced on 10 June 2025. People can take legal action where an invasion of privacy was intentional or reckless, serious, and where they had a reasonable expectation of privacy. Litigation and class action risk is real and present.

4. New Privacy Act coverage for law firms

Since 1 July 2026, law firms providing designated services under the AML/CTF Act are reporting entities, and every reporting entity is covered by the Privacy Act regardless of turnover. Your privacy obligations sit alongside your other regulatory requirements, not in place of them.

Does legal professional privilege protect you?

No. Privilege protects communications from disclosure. It doesn't exempt your firm from the APPs or from the Notifiable Data Breaches (NDB) scheme, and it doesn't automatically remove your obligation to respond to an access request.

Why are law firms in the regulator's sights?

Most small and mid-sized practices haven't had to comply with the APPs. The AML/CTF Tranche 2 reforms changed that by bringing firms into scope as reporting entities, which brought them into scope under the Privacy Act at the same time.

The risk profile is significant. Firms routinely hold:

• identity documents and financial records

• trust account details

• family and criminal matter files

• in many cases, health and hardship information.

Much of it is collected in person or by email, held for years, and shared with counsel, experts and other providers.

Customer due diligence adds to the pile. Firms are now collecting and verifying identity information on a scale they never have before, and keeping records for seven years.

Two regulators, two different concerns

AUSTRAC has moved from guidance to enforcement. It has begun issuing notices to businesses that appear to be providing designated services without having enrolled, and has said it will prioritise action against those who wilfully ignore their obligations rather than those making a genuine effort.

The OAIC's concern is the flipside: firms collecting more than they need in the name of compliance. Its guidance for AML/CTF reporting entities says collection must be limited to what is reasonably necessary, and clients must be told what is collected and why. You don't need to keep full copies of identity documents for record keeping. Keep the relevant details instead, and destroy or de-identify full copies once you no longer need them. Doing AML badly and doing privacy badly are often the same act.

Which Australian Privacy Principles matter most for law firms?

• APP 1, privacy policy: You need a clear, accurate and accessible privacy policy explaining what personal information you collect, why, how it's used and disclosed, and how people can access or correct it.

• APP 3 and APP 5, collection and notification: Collect only what's reasonably necessary, and tell clients at or before collection why you're collecting it and how it will be handled. Costs agreements and client onboarding are the specific risk points.

• APP 6, use and disclosure: Personal information should generally only be used for the purpose it was collected for. Using client details for marketing, cross-selling or referrals without consent can breach this principle.

• APP 7, direct marketing: You can't use personal information for direct marketing without consent or a compliant opt-out. Seminar invitations, newsletters and client alerts all count. The OAIC can issue infringement notices for certain direct marketing breaches.

• APP 11, security: Take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access. That covers practice management, email, document management and any remote access.

• APP 12 and APP 13, access and correction: People must be able to access and correct their personal information. There are limited exceptions, and privilege doesn't automatically remove the obligation to respond.

What should your law firm do now?

First, if you provide designated services and haven't enrolled with AUSTRAC, do it now. Enrolment closed on 29 July 2026, and AUSTRAC has begun issuing notices to businesses that appear to be providing designated services without enrolling. Enrolment is free and done through AUSTRAC Online Services.

Then work through privacy in three stages. Fix the critical gaps first, build governance next, and embed privacy into how your practice runs over the longer term.

Not sure where you stand on each principle? Work through the Privacy Act checklist, 13 yes or no questions, one per APP.

Immediate: 0 to 3 months

1. Confirm whether your practice provides designated services and is a reporting entity.

2. Draft or update your privacy policy so it reflects how your firm actually collects, uses and stores personal information.

3. Add a privacy collection notice to costs agreements and client onboarding documents.

4. Review which identity documents you're keeping from customer due diligence, and stop retaining full copies where they aren't required.

5. Tighten basic security, including multi-factor authentication and removing dormant system accounts.

Medium term: 3 to 12 months

1. Appoint a privacy lead, and consider whether the role sits with your AML/CTF compliance officer.

2. Document a privacy management plan.

3. Map where personal information lives across practice management, document management, trust accounting and email.

4. Set retention periods for closed matters, deceased estate files and customer due diligence records.

5. Review terms with barristers, experts, costs consultants and outsourced providers for confidentiality and data handling cover.

6. Run annual privacy training using legal-specific scenarios.

Strategic: 12 to 18 months

1. Integrate privacy processes with your AML/CTF program rather than running them as separate workstreams.

2. Run privacy impact assessments for higher-risk activities, particularly client onboarding and any AI-assisted document review or drafting tools.

3. Add privacy risk to partner meeting reporting and the firm's risk register.

4. Review your professional indemnity and cyber insurance cover.

5. Treat privacy capability as a point of difference when pitching to clients in regulated sectors.

Privacy compliance checklist for law firms

Use this to keep the team accountable. Give each item an owner and track progress.

• Privacy policy: Draft or update it and publish it now. Next, schedule an annual review.

• Collection notices: Add privacy disclosures to costs agreements and onboarding now. Next, standardise templates across all practice areas.

• Identity documents: Audit what you hold from customer due diligence now. Next, set and enforce retention and destruction periods.

• Matter files: Audit what is stored and where now. Next, set retention for closed matters and estate files.

• Marketing: Confirm consent and opt-out on all client communications now. Next, review governance of your CRM and mailing lists.

• Security: Enforce multi-factor authentication and remove dormant accounts now. Next, commission a periodic risk assessment.

• Training: Run an initial all-staff session now. Next, build an annual refresher into the calendar.

• Governance: Appoint a privacy lead now. Next, build privacy into the partner reporting cycle.

A one page PDF you can work through this week. Download it here.

Get the checklist

How Savira helps law firms

Your firm is now holding more identity information than it ever has, under two regulators with different concerns. Getting collection, retention and consent right once, at the process level, means every matter after it starts from a compliant baseline.

Savira handles the parts of privacy compliance that are ongoing rather than one-off. Generate and maintain a privacy policy that reflects what your firm actually does, collect and record consent through your website, and keep an auditable record of who agreed to what and when, so you can answer a client or a regulator without digging through inboxes.

Whether you're a sole practitioner or a national firm, you get the compliance foundations without needing a consultant or a developer. See how Savira works for law firms.

This guide was last updated 29 August 2026 to reflect the commencement of AML/CTF Tranche 2 on 1 July 2026 and the OAIC's privacy guidance for reporting entities. Australian privacy law keeps evolving, so we'll keep it current as the rules change.

This is general information, not legal advice. Every business handles information a bit differently, so if you're not sure how this applies to yours, it's worth checking with a lawyer or privacy adviser.

Source: Privacy guidance for reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act (OAIC). To see where your firm stands, get my risk score.