A Canberra health practice had a genuinely well-written Charter of Patient Rights, better than most in the sector, but it predated several 2026 requirements. The gaps: no privacy notice on the online contact form, no stated data retention period, no disclosure covering the third-party booking platform in use. None of it required starting over. All of it was fixable within a week.
Digital risk & compliance
I find the gaps in your digital operations that put you at legal and financial risk.
For small and mid-size Australian businesses that need to know where they stand on privacy, accessibility and security, and be able to prove it.
- Assessed against published standards
- Fixed price, quoted upfront
- Canberra-based, with specialist advisers on call
$50m
Maximum penalty for a serious or repeated interference with privacy under the Privacy Act, or three times the benefit obtained, whichever is greater.
10 Dec 2026
When the next round of privacy obligations takes effect, including transparency about automated decisions.
6
Areas I assess, each against a published standard, so you know exactly what “done” looks like.
Why this matters now
A lot has changed in a short time
Australian privacy law has moved further in the last four years than in the previous twenty. Here is the short version.
Penalties were raised sharply
The maximum penalty for a serious or repeated interference with privacy moved to the greater of $50 million, three times the benefit obtained, or 30 per cent of adjusted turnover for the relevant period. The regulator also gained broader information-gathering powers.
Most small businesses never noticed, because nothing about their own obligations changed that day. What changed was the consequence of getting it wrong.
The reform package passed
A package of amendments introduced a statutory cause of action for serious invasions of privacy, created criminal offences for doxxing, and required a Children’s Online Privacy Code to be developed. It also set the clock running on new transparency requirements for automated decision-making.
This is the point at which the obligations arriving in 2026 were actually locked in.
Individuals gained a right to sue
The statutory tort for serious invasions of privacy commenced. For the first time an individual can bring an action directly, rather than relying on the regulator to act on a complaint.
For a small business the practical effect is simple: privacy exposure is no longer only a regulatory question, it is a litigation question too.
10 December 2026
Businesses that use automated decision-making affecting individuals will need to say so in their privacy policy, and explain what information is used and how. The Children’s Online Privacy Code is also due to be in place, which can apply to a service that under-18s could reasonably access even when they are not the intended audience.
Whether these apply to you is usually answerable in an afternoon. The expensive version is finding out afterwards.
What I do
Six areas where gaps tend to hide
Each one is assessed against a published standard, so you know exactly what “done” looks like.
Privacy Act compliance
Get ready for the privacy reforms taking effect from 10 December 2026.
Read moreChildren’s Online Privacy Code
New obligations if under-18s could use your service, even if they’re not your audience.
Read moreEssential Eight readiness
Show insurers, panels and clients real evidence of your cyber security maturity.
Read moreWeb accessibility audits
A manual WCAG 2.2 audit of your website, with a clear list of fixes.
Read moreAI app security review
A security check for apps and tools built with AI coding platforms.
Read moreHiring integrity verification
A practical process for spotting fake and AI-generated job candidates.
Read more
60-second self-check
How exposed are you, roughly?
Five questions. Answers stay in your browser, and nothing is sent anywhere unless you decide to ask me to look properly.
Question 1 of 5
Does your contact form tell people why you are collecting their details, right there on the form?
A link to a privacy policy in the footer is not the same thing.
Your result
This is a rough indicator, not an assessment. It is not legal advice.
Sample finding
What a finding looks like
Every report starts by naming what’s already working. Most businesses have more right than wrong.
Common questions
The questions I get asked most
Does the Privacy Act apply to my small business in Australia?
Usually not, if your annual turnover is $3 million or less. But several exceptions override that regardless of turnover, including health service providers, businesses that trade in personal information, and contractors delivering Australian Government contracts. Full guide to the small business exemption.
What is changing on 10 December 2026?
Businesses using automated decision-making that significantly affects people will need to disclose it in their privacy policy, and a Children’s Online Privacy Code is due to be registered. Read the plain-English guide.
Do I need a privacy notice on my contact form?
If the Australian Privacy Principles apply to you, yes. APP 5 expects people to be told why their information is being collected at the point of collection. A privacy policy linked in the footer does not meet this on its own, because nobody opens a policy before typing their name into a form.
How much does a compliance assessment cost?
Every engagement is quoted as a fixed price in writing before any work starts, so there are no hourly surprises. The initial external check is free and carries no obligation.
Do you only work with businesses in Canberra?
No. NarwhAI is based in Canberra, ACT, and works with small and mid-size businesses across Australia. Assessments are run remotely, so location makes no difference to the work.
Are you a law firm, and is this legal advice?
No and no. We assess your systems and documents against published standards, identify the gaps, and give you documentation showing what was found and fixed. Where a matter needs legal advice, you should get it from a qualified legal practitioner.
Get a free check
Find out where you stand
Tell me a little about your business and I’ll run a short external check on your website or privacy policy, then send you what I find. No obligation.
- hello@narwhai.com.au
- Phone
- 0414 270 214
- Based in
- Canberra, ACT. Working with businesses across Australia