Most law firm principals know the Privacy Act exists. Fewer are clear on which obligations actually bind their practice, and how those obligations stack on top of professional conduct duties and the regulatory changes now arriving. The rules sit in several places. This article puts them in one view so you can work out what applies to you.
Does the Privacy Act cover your practice?
The Privacy Act 1988 and the 13 Australian Privacy Principles apply to organisations with annual turnover above $3 million. Many small firms assume they fall under the threshold and stop there. That is a mistake, because turnover is only one of the tests.
A practice under $3 million is still covered if it provides a service under a Commonwealth contract. Legal Aid work and government legal panel appointments often bring a firm into that category. The Act also applies to any business that handles tax file numbers, which most firms do through staff payroll and through client matters. In practice, a large share of Australian legal practices are bound by the Act regardless of size.
If you are covered, the 13 Australian Privacy Principles set out how you collect, hold, use and secure . APP 11 requires you to take reasonable steps to protect that information from misuse, interference and loss, and from unauthorised access. For a law firm, the security of client files is part of meeting that duty.
Why legal files almost always meet the serious harm threshold
The requires you to notify the and affected individuals when a breach is likely to result in serious harm. The question for any firm after an incident is whether that threshold is met.
Legal files are some of the most sensitive records a business holds. Family law matters, criminal defence, estate documents, commercial disputes, financial settlements and personal identity documents all sit in your systems. A breach involving that material is far more likely to cross the serious harm line than a breach of, say, a marketing mailing list. For most legal practices, the working assumption should be that a breach of client files will be notifiable.
Notification is not just a form. Once a breach is notifiable you face a short timeline, communication with affected clients, and scrutiny from the OAIC. The cost of getting the response right is far lower if you have planned for it in advance.
When a cyber failure becomes a conduct matter
Confidentiality is a core professional duty, not an optional extra. Under the Legal Profession Uniform Law in New South Wales and Victoria, practitioners owe duties of competence and of confidentiality to their clients. A cyber failure can put both in question.
If a practice holds client information on systems with no basic protection, and that information is exposed, a regulator may ask whether the firm acted competently and whether it took reasonable care of confidential material. A serious lapse can move beyond a privacy issue and become a matter before the Legal Profession Conduct Commissioner. The reputational weight of that is significant, and it is a risk that sound security controls reduce.
The Law Society guidance points to the Essential Eight
The Law Societies of New South Wales and Victoria have both published cyber security guidance for members. That guidance points firms toward the , the set of mitigation strategies maintained by the and the .
The Essential Eight covers application control, patching of applications and operating systems, configuration of Microsoft Office macros, user application hardening, restriction of administrative privileges, and regular backups. It is the most widely recognised baseline in Australia, and it gives a firm a clear, measurable standard to work toward rather than a vague instruction to improve security.
AML/CTF Tranche 2 from 1 July 2026
The AML/CTF Amendment Act 2024 brings a significant change for legal practices. From 1 July 2026, Tranche 2 reforms extend Australia's anti-money laundering and counter-terrorism financing regime to a range of legal services.
Firms that provide designated services such as conveyancing, company and trust formation, and estate administration will fall within the regime overseen by AUSTRAC. That brings obligations around customer due diligence, record-keeping and reporting. Those obligations sit alongside your privacy and security duties, and the systems that hold client identity and transaction information will need to be secured to a standard that matches the new scrutiny.
What a practice should do
The starting point is clarity. Know which frameworks actually apply to your firm: the Privacy Act and the APPs, the NDB scheme, your conduct duties under the Uniform Law, your Law Society's guidance, and, where relevant, the coming AML/CTF obligations. Once you know the map, the work becomes manageable.
From there, baseline your practice against the Essential Eight so you have a recognised standard to measure against. Then build and test a data breach response plan, so that if an incident occurs you can act inside the timelines the NDB scheme expects rather than working it out under pressure.
IronSights works with Australian legal practices to make these obligations concrete: mapping which rules apply, measuring a firm against the Essential Eight, and preparing a breach response that holds up under regulatory scrutiny. A security review is a sensible first step to see where your practice stands and what to address first.
