Articles & guides
Plain-English guides to Australia's AML/CTF Tranche 2 reforms for small businesses — every fact checked against AUSTRAC guidance and the AML/CTF Act. General information only, not legal advice.
Privacy Act 2026
Using AI in Your Business? You May Be Making 'Automated Decisions' Under the Australian Privacy Act
If you use AI or software to make decisions about people, you may be caught by Australia's new automated decision-making disclosure rule under the Privacy Act 1988, mandatory from 10 December 2026. What counts as ADM, and what to do. Source-checked.
The Privacy Tort and Your Workplace: Employer Liability Risks You Didn't See Coming (Australia)
How Australia's statutory tort for serious invasions of privacy (in force since 10 June 2025) creates new employer exposure — workplace surveillance, monitoring and handling of staff information. Plain English, source-checked.
The $3 Million Privacy Exemption Explained — And Why It May Not Save Your Australian Business
Australia's $3 million small-business exemption from the Privacy Act 1988, explained for 2026: what it covers, the carve-outs that override it, why the proposed removal is not yet law, and how AML Tranche 2 ends it for ~100,000 firms. Plain English, source-checked.
Privacy Act Compliance Checklist 2026: 12 Things to Fix Before the Deadlines Hit (Australia)
A practical 12-point Australian Privacy Act 1988 compliance checklist for 2026: the in-force statutory tort, the 30-day data-breach clock, the 10 December 2026 ADM disclosure, AML Tranche 2's privacy ripple, and your privacy-policy gaps. Plain English, source-checked, free checklist inside.
Privacy Act Changes 2026: The Complete Australian Business Guide
Every 2026 change to Australia's Privacy Act 1988, on one page: the statutory privacy tort already in force, the 10 December 2026 automated-decision disclosure deadline, the Children's Online Privacy Code, AML Tranche 2's privacy ripple, and the penalties — plain English, source-checked, for Australian businesses.
Privacy Act Changes 2026: Every Date Your Australian Business Needs on the Calendar
A clean timeline of Australia's Privacy Act 1988 changes for 2026: the statutory tort (in force 10 June 2025), AML Tranche 2 (1 July 2026), automated decision-making disclosure and the Children's Online Privacy Code (both 10 December 2026), and the proposed exemption removal. Source-checked.
How to Write a Privacy Policy That Actually Complies in 2026 (Australia, Step by Step)
A step-by-step guide to writing an Australian Privacy Act 1988 compliant privacy policy in 2026 — built around APP 1, with the new automated decision-making disclosure due 10 December 2026. Plain English, source-checked.
Does the Children's Online Privacy Code Apply to Your App or Website? (Australia, 2026)
Australia's Children's Online Privacy Code must be finalised by the OAIC by 10 December 2026. Who it applies to — social media, electronic and internet services likely to be accessed by children — and how to prepare. Plain English, source-checked.
Does the Australian Privacy Act Apply to Your Small Business in 2026? (Take This 2-Minute Test)
A plain-English test for Australian small businesses: does the Privacy Act 1988 apply to you in 2026? Turnover is not the whole story — the statutory tort, sensitive information and AML Tranche 2 can pull you in regardless of size. Free, date-aware checker inside.
Data Breach Response Plan: The Free Template Every Australian Business Needs in 2026
How to build a data breach response plan for the Australian Notifiable Data Breaches scheme — the 30-day assessment clock, the serious-harm test, who to notify, and a first-72-hours action list. Plain English, source-checked, free checklist inside.
Can You Be Sued for Invading Someone's Privacy in Australia? The New Statutory Tort, Explained
Australia's statutory tort for serious invasions of privacy has been in force since 10 June 2025. Who can sue, the two pathways (intrusion upon seclusion and misuse of information), remedies, the damages cap, and why turnover doesn't protect you. Source-checked.
Automated Decision-Making Disclosure: What You Must Add to Your Privacy Policy by 10 December 2026 (Australia)
From 10 December 2026, Australian privacy policies must disclose automated decision-making that significantly affects people. What the new APP 1 obligation requires, which tools trigger it, and how to write the disclosure — plain English, source-checked.
Australian Privacy Act Penalties 2026: What Non-Compliance Actually Costs (From $66K to $50M)
The three-tier civil penalty regime under Australia's Privacy Act 1988, explained for 2026 — the low tier (up to $330k, $66k infringement notices), the mid tier (up to $3.3M) and the high tier (up to $50M / 3x benefit / 30% turnover). Kept separate, source-checked.
AML Tranche 2 Just Dragged Your Agency Into the Australian Privacy Act — Here's What That Means
From 1 July 2026, AML/CTF Tranche 2 makes real estate, legal, accounting, conveyancing, TCSP and precious-metals firms reporting entities — and the moment you collect KYC, the Privacy Act 1988 applies to that information regardless of turnover. What that means, and what to do.
Privacy Act 2026 — by industry
Privacy Policy for Real Estate Agencies: The 2026 Australian Compliance Guide
What an Australian real estate agency's privacy policy needs in 2026 under the Privacy Act 1988 — including AML Tranche 2's KYC collection from 1 July 2026 and the 10 December 2026 automated decision-making disclosure. Plain English, source-checked.
Privacy Policy for Law Firms: The 2026 Australian Compliance Guide
What an Australian law firm's privacy policy needs in 2026 under the Privacy Act 1988 — including AML Tranche 2 KYC from 1 July 2026 and the 10 December 2026 automated decision-making disclosure, alongside your existing confidentiality duties. Plain English, source-checked.
Privacy Policy for Conveyancers: The 2026 Australian Compliance Guide
What an Australian conveyancing business's privacy policy needs in 2026 under the Privacy Act 1988 — including AML Tranche 2 KYC from 1 July 2026 and the 10 December 2026 automated decision-making disclosure. Plain English, source-checked.
Privacy Policy for Accounting Firms: The 2026 Australian Compliance Guide
What an Australian accounting or bookkeeping firm's privacy policy needs in 2026 under the Privacy Act 1988 — including AML Tranche 2 KYC from 1 July 2026 and the 10 December 2026 automated decision-making disclosure. Plain English, source-checked.
By profession
What real estate agents need for AML/CTF compliance
From 1 July 2026, real estate agents and buyer's agents are AML/CTF reporting entities for brokering property sales. Here's what AUSTRAC actually requires — the trigger, the program, CDD, reporting and records — in plain English.
What accountants need for AML/CTF compliance
Accountants are captured by AML/CTF Tranche 2 for far more than handling client money. Here's the full list of designated services that bring an accounting practice into scope from 1 July 2026, and exactly what AUSTRAC requires — in plain English.
How-to guides
What is NOT a designated service — common AML/CTF exclusions
Knowing when you're OUT of scope matters as much as knowing when you're in. Here are AUSTRAC's common AML/CTF Tranche 2 exclusions and carve-outs — so you don't over-comply — with the primary sources.
How to do an ML/TF risk assessment (step by step)
A money-laundering and terrorism-financing risk assessment is the foundation of your AML/CTF program. Here's a plain-English, step-by-step way to do one that matches AUSTRAC's reformed requirements — proportionate to a small business.
Tranche 2 essentials
Tranche 2 key dates: 1 July and 1 October 2026
Every AML/CTF Tranche 2 deadline a small business needs: enrolment opening, the 1 July 2026 commencement, the 29 July 2026 enrolment cut-off, the compliance-officer notification rule, and where 1 October fits in — checked against AUSTRAC.
Is my business an AUSTRAC reporting entity? (lawyers, accountants, real estate, conveyancers, jewellers)
AML/CTF capture is about the service you provide, not your job title. Here's how to tell whether your law, accounting, real estate, conveyancing or precious-metals business is an AUSTRAC reporting entity — checked against AUSTRAC guidance.
AML/CTF Tranche 2, explained for small businesses (2026)
What Australia's AML/CTF Tranche 2 reforms mean for small businesses: who's captured, the key 2026 dates, what you actually have to do, and where to start — in plain English, checked against AUSTRAC.