General Data Protection Regulation
A law firm in Australia is not subject to the GDPR merely because it practises in Australia. Article 3 can still bring some processing into scope.
Regulation (EU) 2016/679 on the protection of personal data. It can apply to an organisation outside the EU in the cases Article 3 sets out.
MaintainedLast reviewed
Key facts
- Issued by
- European Union
- Sources listed
- 1
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
The General Data Protection Regulation is Regulation (EU) 2016/679. It regulates the processing of personal data. Article 3 sets the territorial scope. It covers processing in the context of an establishment in the Union. It also covers a controller or processor not established in the Union where the processing relates to offering goods or services to data subjects in the Union, or to monitoring their behaviour in the Union, as Article 3(2) states.
Article 5 states the principles, including lawfulness, fairness, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality. Article 32 requires appropriate technical and organisational security. Articles 33 and 34 deal with notifying a supervisory authority of a personal-data breach and, in high-risk cases, communicating with the data subject. Chapter V governs transfers to a third country. Article 28 governs the contract with a processor.
Who it applies to
A law firm in Australia is not subject to the GDPR merely because it practises in Australia. It can be in scope under Article 3 if it is established in the Union, or if it offers goods or services to people in the Union, or if it monitors their behaviour there. A firm that acts for an EU client, or that uses a processor established in the Union, should read Article 3 and Article 28 against the facts. This page does not decide that reading.
Where the GDPR and the Privacy Act both apply, each has to be met. One does not cancel the other. The small-business test in the Privacy Act is not a GDPR test.
What it asks of a law firm using AI
- Identify whether the firm is a controller, a processor, or both, for the processing in question. The labels are in Article 4. A firm that decides why and how client personal data are processed is, in GDPR terms, likely a controller of that processing. A vendor that processes the data for the firm is likely a processor. The contract has to match the facts.
- Article 28 requires a processor contract with specified terms. A privacy policy on a website is not that contract.
- Article 32’s security duty is “appropriate” to the risk. A certificate can be evidence of measures. It is not the duty.
- Article 33 requires notification of a personal-data breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to rights and freedoms. That clock is not the Australian Notifiable Data Breaches test. An incident can trigger one, both, or neither.
- A transfer of personal data outside the Union has to meet Chapter V. Putting data into a tool whose processing is outside the Union is a question under that chapter when the GDPR applies. Standard contractual clauses, an adequacy decision, or another Chapter V ground are the sorts of basis the regulation provides. Which one a vendor claims is a fact to read in the contract.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | Not set here. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | Article 5 requires personal data to be accurate and kept up to date. That is about personal data, not about the legal quality of advice. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | The practical reading is Article 3 (does it apply), Article 28 (what does the processor contract say), Article 32 (what security is described), and Chapter V (on what basis does data leave the Union). A “GDPR compliant” banner is not those documents. |
| Confidentiality Whether client and other confidential information can go into the tool. | Integrity and confidentiality are an Article 5 principle for personal data. Solicitor-client confidentiality is wider, and it is Australian professional law. Meet both where both apply. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | Articles 13 and 14 require privacy information to be given when personal data are collected. Articles 33 and 34 are breach notices. None of those is the Australian rule about telling a client or a court that AI was used. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | Article 42 provides for data-protection certification mechanisms. A vendor’s claim to be “GDPR compliant”, or to hold ISO/IEC 27701, is not an Article 42 certificate unless the document says it is. Record what the document is. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | Chapter V is the residency question when the GDPR applies: on what lawful transfer ground does personal data leave the Union, and what does the contract say about where processing happens. Australian hosting does not answer a Chapter V question about European personal data. European hosting does not answer APP 8. |
Sources
Checked 2026-10-10. Issued by European Union.