Privacy & Compliance
Last updated: 26 September 2026
Privacy, and where I stand on it
I'm not a lawyer. Nothing on this site, and nothing said during a diagnostic or an implementation, is legal advice.
What I do
Every process we map gets assessed for what personal information it touches, where that information travels, and who can see it. Where a recommendation would move personal or health information into a new system, offshore, or through a third party, you're told before anything is built, in writing. If that's a problem for your business, we design around it.
What I don't do
I don't certify that a recommendation complies with the Privacy Act 1988 or the Australian Privacy Principles. Compliance isn't a property of a recommendation. It depends on how your business runs the thing once it's live, what you tell your own customers, and obligations specific to your industry. That assessment belongs with your lawyer, not with me.
What you should know
Privacy obligations for Australian businesses are shifting.
From 10 December 2026, organisations covered by the Privacy Act that use automated decision making significantly affecting a person's rights or interests must disclose it in their privacy policy. If you build something that screens enquiries, triages leads or ranks applicants, and you're covered by the Act, that reaches you.
If you provide health services, you're covered regardless of turnover.
It's a transparency requirement, not a ban. It's legislated with a fixed commencement date.
What that means for our work together
If a process we map involves an automated decision about a person, you'll be told at the diagnostic, before anything is built, and it goes on the map. What you then do about your own privacy policy is a matter for you and your adviser.
If any of that applies to you, get legal advice before implementing what we recommend. I'd rather you spent that money than skipped it.
Contact