Practice area

Privacy, Data Protection & Cyber

Establish the actual information, processing activity and incident facts before choosing a response. Verify applicable duties and time limits, and keep access, training use, retention and disclosure conditions distinct.

Key facts

Tasks covered: 32
Tasks with a step-by-step checklist: 17
Local differences: 3 jurisdictions where this area changes

Jurisdiction

Tasks

GreenLawyer reviewYellowClose supervisionRedLawyer-led

Tasks in Privacy, Data Protection & Cyber
Task	How AI is used	Human involvement	What the lawyer must review
Build a privacy-law gap table against the principles that applyStart this task See suggested levels	Map the client's described practices and policies to the privacy principles the lawyer has listed, and mark missing notices, security measures and retention rules.	YellowClose supervision	Confirm whether the client is in scope of the statute Do not treat a template gap as a finding until the facts are verified
Map a US privacy file to the statutes that actually applyChecklist Start this task See suggested levels	From the client’s data map, list possible triggers: HIPAA PHI, GLBA financial information, CCPA consumer personal information, Colorado ADMT, Rule 1.6 client information.	YellowClose supervision	Name the statute that applies; there is no general federal privacy law Open the California AG CCPA page and the HHS HIPAA page Open Colorado SB26-189 if consequential decisions are in scope
Map a New Zealand client's privacy duties to the IPPsChecklist Start this task See suggested levels	Produce an IPP-by-IPP issues list from the client's described data flows.	YellowClose supervision	Map duties to the Privacy Act 2020 IPPs, not APP numbers Include IPP 3A (indirect collection), in force since 1 May 2026 Complete a privacy impact assessment before any generative-AI use
Draft or review a privacy policy and collection noticeStart this task See suggested levels	Produce a first-draft policy or notice mapped to the required disclosure headings, using only the processing facts the client has supplied.	YellowClose supervision	Delete claims the client cannot stand behind Match automated-decision, overseas-disclosure and retention statements to actual practice
Assess a suspected data breach and draft the notification packStart this task See suggested levels	The statement to the regulator and the notice to individuals are the lawyer's to write and the tool writes no part of either. Organise the incident record into a source-referenced assessment table — what was accessed, whose information and which systems, every row referenced to the document or log it comes from and set beside the statutory serious-harm factors with a column for each factor — and list the facts that still need a source, the notification route chosen, and whether any other entity is being treated as covered by this notification. Check the lawyer's own statement against each prescribed content item and the regulator's notification form, compare the notice to individuals against that statement and flag anything the statement says that the notice does not carry, and flag anything the drafts assert that the incident record does not support, or that the two drafts say differently.	RedLawyer-led	Decide whether the incident is notifiable under the current statute. Deadlines and 'serious harm' are lawyer calls, and so are the notification route and whether any other entity is covered by this notification. The lawyer writes the statement to the regulator and the notice to individuals, and confirms every fact and every remediation step asserted in them is true at the moment of issue.
Assess a notifiable data breach and draft the OAIC notification packChecklist Start this task See suggested levels	Build an NDB table (access, personal information, likely serious harm), draft OAIC and individual notices, note the 30-day assessment and any 72-hour ransomware report.	RedLawyer-led	Decide serious harm yourself; check 30 days from awareness of a suspected breach Check the s 27 Cyber Security Act 2024 ransomware report: 72 hours; turnover over $3m Note the ransomware penalty is civil, 60 penalty units Check SOCI reports to the ACSC in 12 or 72 hours Check privilege (Optus v Robertson; McClure v Medibank [2025] FCA 167) Check state health records Acts (Vic, NSW, ACT)
Assess a notifiable privacy breach under the Privacy Act 2020Checklist Start this task See suggested levels	Extract what was disclosed, to whom, and the categories of people affected.	RedLawyer-led	Decide whether serious harm is caused or likely If so, notify the Commissioner and affected people as soon as practically able Do not file an OAIC NDB form Call Police first if harm is imminent
Handle a US health-privacy incident as HIPAA plus Rule 1.6Checklist Start this task See suggested levels	Sort the incident facts into covered-entity / business-associate / other, and list data elements that may be PHI.	RedLawyer-led	Open the HHS covered-entity and business-associate pages Check whether the firm needs a BAA to handle PHI Do not put the incident file into a public generative tool
Draft a data-breach incident response planStart this task See suggested levels	Produce a plan covering detection, containment, assessment, notification and post-incident review, with a RACI and template notices.	YellowClose supervision	Align the plan to every reporting stream that applies Include the privacy regulator, cyber authority, insurers and sector rules Do not rely on one 30-day clock
Build a vendor AI and subprocessors risk questionnaireStart this task See suggested levels	Generate a questionnaire covering residency, subprocessors, training on client data, retention, deletion and audit rights, and score the returned answers into a table.	YellowClose supervision	Read the vendor's current terms, not the sales deck Decide whether an overseas disclosure is occurring
Assess a generative-AI vendor against Rule 1.6 before any client inputChecklist Start this task See suggested levels	Extract retention, training-use, subprocessors and breach-notice terms from the vendor documents into a table.	YellowClose supervision	Check whether the tool learns from or shares prompts If it does, do not input client information without informed consent and reasonable security Apply Opinion 512, Florida 24-1, Texas 705 and D.C. 388
Draft a privacy or data-protection impact assessmentStart this task See suggested levels	Structure a PIA or DPIA from the project description: information flows, risks, mitigations and sign-off questions.	YellowClose supervision	Check the flow map matches the actual architecture Do not sign off a generic template
Draft a privacy impact assessment against the OAIC PIA guideChecklist Start this task See suggested levels	Structure a PIA from the project description using the OAIC five-stage guide (description, flows, analysis, solutions, sign-off), with questions for each APP.	YellowClose supervision	Match the flow map to the real architecture Flag sensitive and children's data (APP 3; 2024 Act) Cover ADM transparency (December 2026) Use the current OAIC guide Mark the PIA as prepared on legal instructions if privilege is intended
Build a privacy-tort and misuse-of-information issues tableStart this task See suggested levels	From the facts, list candidate elements of a privacy tort, misuse of information or statutory interference claim, with the documents that support each row.	YellowClose supervision	Apply the cause of action that exists in the governing law Do not import a neighbouring country's new tort
Map automated decisions that use personal informationStart this task See suggested levels	From the system description, list decisions that use personal information, whether a human reviews them, and what the privacy notice currently says.	YellowClose supervision	Decide what transparency, access or human-review duties apply Check the current instrument; commencement dates change
Advise on automated decision-making under Colorado SB26-189Checklist Start this task See suggested levels	Identify whether the system materially influences a consequential decision and whether the client is a developer or a deployer.	YellowClose supervision	Apply SB26-189 (signed 14 May 2026), which repealed and re-enacted SB24-205 Confirm duties start 1 January 2027 Open coag.gov/ai/ and the enrolled bill, not the 2024 text
Build a cross-border transfer mechanism tableStart this task See suggested levels	List destinations, recipients, transfer tools (clauses, adequacy, other) and residual risks from the DPA and architecture papers.	YellowClose supervision	Apply the transfer rule of the governing privacy law Do not mix GDPR adequacy lists with another statute's test
Build a cross-border transfer table under APP 8Checklist Start this task See suggested levels	List destinations, recipients and APP 8 pathways (APP 8.1 reasonable steps or an APP 8.2 exception) from the DPA and architecture, and draft binding-scheme clauses.	YellowClose supervision	Do not rely on an adequacy list; Australia has none Confirm APP 8.2(a) is met by a binding scheme or contract Remember the discloser stays accountable for the recipient under APP 8.1 Flag offshore AI and cloud use Check the My Health Records Act 2012, state health laws and current OAIC guidance
Check overseas disclosure against IPP 12 before a tool processes client dataChecklist Start this task See suggested levels	Extract the vendor's stated storage locations and subprocessors from the contract.	YellowClose supervision	Check IPP 12 for any disclosure outside New Zealand, including AI prompts Do not apply APP 8 or an EU adequacy finding as the test Keep personal data out if the destination is unclear
Draft a response pack for a privacy-regulator investigationStart this task See suggested levels	From the Commissioner's notice and the incident file, the tool schedules every question, document category and due date the notice sets, and maps the file's documents, system logs and policy versions against each item so what is held, what is missing and what may be privileged is visible. It writes no part of the response: the lawyer drafts the submission, and the tool only compares that draft against the notice's questions and the underlying documents and lists assertions the file does not support.	RedLawyer-led	Read the draft response against the notice question by question: confirm nothing concedes a serious or repeated interference with privacy, or any other characterisation of the entity's conduct, beyond what the file compels, and that every date, log reference and remediation step matches its source document. Confirm privilege is claimed consistently with how each forensic report was commissioned and used, check that the schedule of documents produced answers every category in the notice, and settle who signs the response and the date it must be served.
Draft a response pack for an OAIC investigationChecklist Start this task See suggested levels	From the OAIC’s notice, schedule every question, document category and due date it sets, and index the file’s documents, system logs and policy versions against each item, flagging what is missing and what may be privileged. The tool writes no part of the response to the OAIC: no draft, no first draft, no skeleton, no outline, no suggested paragraphs. Once the lawyer has written the submission, check it against the notice question by question and list every assertion the file does not support.	RedLawyer-led	Draft and sign everything that goes to the OAIC yourself Verify every citation Do not admit a serious interference (s 13) Check privilege (Optus v Robertson; McClure v Medibank [2025] FCA 167) and 2024 Act powers Use ACL (No 2) [2025] FCA 1224, $5.8m, as the penalty anchor
Map employee-monitoring and workplace-surveillance dutiesStart this task See suggested levels	From the proposed monitoring description, list the surveillance, privacy and employment rules the lawyer has named and the notice or consent steps already taken.	YellowClose supervision	Check the state surveillance device statute that applies; they differ Do not extend employee-records exemptions to applicants or contractors unless the statute says so
Map employee-monitoring duties under the APPs, Fair Work Act and state surveillance lawChecklist Start this task See suggested levels	List the state surveillance, APP employee-records and Fair Work Act rules the lawyer has named and the notice or consent steps taken, and draft a monitoring policy.	YellowClose supervision	Do not apply the s 7B(3) exemption to applicants, contractors or unrelated monitoring Apply each state Act (Vic SDA 1999, NSW WSA 2005, SA SDA 2016) Check employee scoring against ADM rules (December 2026) and discrimination law now Confirm notices meet APP 5 Treat dismissal advice as Red
Map critical-infrastructure cyber reporting duties for the assetStart this task See suggested levels	From the asset description, line the client's systems up against the infrastructure classes and reporting clocks the lawyer has listed, and mark gaps.	YellowClose supervision	Confirm the asset is in the regime before you draft a report Check the class definitions; they are technical
Map SOCI Act cyber-reporting duties and CIRMP gaps for the assetChecklist Start this task See suggested levels	Match systems to the 22 asset classes under the SOCI Act 2018 (Cth), list reporting clocks, and draft a CIRMP for cyber, personnel, physical and supply-chain hazards.	YellowClose supervision	Confirm the asset class Report critical incidents to the ACSC within 12 hours and others within 72 Keep SOCI reports separate from NDB and the Cyber Security Act report Check telco assets, which moved into SOCI in April 2025 Send CIRMP annual reports to the sector regulator, not ASD
Build a record of processing from the interviews and system listStart this task See suggested levels	Turn the interview notes and system inventory into a processing record: purposes, categories, recipients, locations, retention and security measures.	YellowClose supervision	Check each row with the business owner Watch for invented purposes and default 'global' locations
Assemble an access, deletion or correction response packStart this task See suggested levels	From the request and the systems list, draft a search log, a proposed response and a list of items that may be withheld, with reasons to check.	YellowClose supervision	Confirm identity, scope and exemptions Do not release another person's information or privileged material
Draft a data-processing agreement from the processing factsStart this task See suggested levels	Produce a first-draft DPA covering instructions, security, subprocessors, deletion and audit from the processing description and the client's precedent.	YellowClose supervision	Match the DPA to the actual processing Check controller and processor labels; they are easy to get backwards
Build a 48-hour incident chronology from the tickets and emailsStart this task See suggested levels	Extract times, systems, actors and decisions from the incident tickets and correspondence into a chronology, marking gaps.	YellowClose supervision	Verify times against the source systems Use the chronology for the lawyer's assessment, not as a notification
Run a privacy impact assessment before a client deploys a commercial AI productChecklist Start this task See suggested levelsWritten for AustraliaAustralia only	Draft a PIA structure from the vendor documents and data flows: personal information in, outputs, APP 1, 5, 6, 8, 10 and 11 touchpoints.	YellowClose supervision	Confirm what personal and sensitive information actually flows; decide whether the use is necessary and lawful.
Audit a client privacy policy for AI disclosures and chatbot labellingChecklist Start this task See suggested levelsWritten for AustraliaAustralia only	Compare the policy and collection notices to the client's AI uses and list gaps, including unlabelled public-facing chatbots.	GreenLawyer review	Check each gap against the actual system and approve wording.
Assess whether a client may use held personal information to train or fine-tune a modelChecklist Start this task See suggested levelsWritten for AustraliaAustralia only	Organise the original collection notices and purposes into a primary/secondary-purpose table for APP 6 analysis.	RedLawyer-led	Decide reasonable expectations and whether consent or opt-out is needed.
Prepare an ADM disclosure for a privacy policy by 10 Dec 2026Checklist Start this task See suggested levelsWritten for AustraliaAustralia only	Identify automated decisions and draft disclosure.	YellowClose supervision	Lawyer confirms against APP 1.
Conduct AI product due diligence for privacyChecklist Start this task See suggested levelsWritten for AustraliaAustralia only	Assess a commercial AI product's data handling.	YellowClose supervision	Ongoing review, not set-and-forget.
Advise on client-data exposure from consumer AI toolsChecklist Start this task See suggested levelsWritten for AustraliaAustralia only	Assess exposure and remediation.	YellowClose supervision	Lawyer settles.
Update collection notices for AI chatbotsChecklist Start this task See suggested levelsWritten for AustraliaAustralia only	Draft chatbot notices.	GreenLawyer review	Check APP 5.
Build an AI privacy impact assessmentChecklist Start this task See suggested levelsWritten for AustraliaAustralia only	Draft PIA for an AI system.	YellowClose supervision	Lawyer confirms.
Assess privacy compliance of a commercially available AI productStart this task See suggested levelsWritten for AustraliaAustralia onlySource basis: Area-specific AU source in links	Apply OAIC guidance to the product terms.	YellowClose supervision	Lawyer advises.
Draft a law firm policy against putting client data into free AI toolsStart this task See suggested levelsWritten for AustraliaAustralia onlySource basis: Area-specific AU source in links	Draft rules on data security.	GreenLawyer review	Principal approves.
Draft a notifiable data breach assessment involving AI toolsStart this task See suggested levelsWritten for AustraliaAustralia onlySource basis: Area-specific AU source in links	Assess serious harm.	RedLawyer-led	Lawyer settles.
Draft the statement to the OAIC about a notifiable data breach from the incident logStart this task See suggested levelsWritten for AustraliaCommonwealth only	Draft the statement using only facts written in the incident log.	YellowClose supervision	Match every affected group and every step to the log and to the OAIC notifiable data breaches page.
Compare a privacy-policy draft with the OAIC's APP 1 chapterStart this task See suggested levelsWritten for AustraliaCommonwealth only	List policy clauses beside the headings in the APP 1 chapter.	YellowClose supervision	Open the APP 1 chapter and decide which clauses meet it. Do not rely on a generated summary of the chapter.
List the personal information a client-intake chatbot would collect and check it against the Privacy Act 1988Start this task See suggested levelsWritten for AustraliaCommonwealth only	List the fields the chatbot asks for.	YellowClose supervision	Read the Privacy Act compilation before advising whether the collection is allowed. The list is not that advice.
Prepare the file note deciding whether an AI-tool incident is a notifiable data breachStart this task See suggested levelsWritten for AustraliaCommonwealth only	Set out the incident facts from the log. Do not decide whether notification is required.	RedLawyer-led	The lawyer decides, using the incident log and the OAIC notifiable data breaches page.
Draft the transparency paragraph of a privacy policy and check it against the OAIC APP 1 chapterStart this task See suggested levelsWritten for AustraliaCommonwealth only	Draft a transparency paragraph from the client's description of the tool.	YellowClose supervision	Check the paragraph against APP 1 as the chapter explains it, and against what the tool actually does.

Firm-wide obligations

Firm-wide obligations
Obligation	What it covers
Trust accounting & handling client money	Checks that apply across files.
Costs, billing & litigation funding	Checks that apply across files.
Client-facing & access-to-justice AI tools	Checks that apply across files.
Incoming evidence — deepfakes & synthetic documents	Checks that apply across files.
AI decision systems	Checks that apply across files.
Confidentiality & client information	Checks that apply across files.
AML/CTF — the practice as a reporting entity	Checks that apply across files.

What changes in Australia

What changes in Australia
Topic	What changes
Legal sources	Privacy Act 1988 (Cth) and its 2024 amendments, the APPs, the Notifiable Data Breaches scheme, the Cyber Security Act 2024 (Cth) and the Security of Critical Infrastructure Act 2018 (Cth).
Moving law	The regime is layered and changing fast, so an invented authority flows straight into compliance advice.
Client data	Putting client data into an AI tool can itself be the breach the firm is advising on. Treat tool use as a confidentiality and governance question.

What changes in New Zealand

What changes in New Zealand
Topic	What changes
Governing law	Privacy Act 2020 and the information privacy principles, not the APPs. IPP 12 covers disclosure outside New Zealand.
IPP 3A	Notification of indirect collection, in force since 1 May 2026.
Breaches	If a breach has caused or is likely to cause serious harm, notify the Privacy Commissioner and affected people as soon as practically able. Not the OAIC NDB scheme.
Commissioner's AI expectations	Privacy impact assessment before use; human review before acting on output; no personal input unless the provider confirms it will not retain or disclose it.
Limits on AI assistance	Do not enter personal information into a public generative tool unless the provider has confirmed it will not retain or disclose the input.

What changes in United States

Known here as: Privacy, data protection and cyber

What changes in United States
Topic	What changes
No general statute	No federal equivalent of the Privacy Act 1988 (Cth). Start with Rule 1.6, then the sector statute that covers the data.
Sector statutes	HIPAA for PHI; GLBA for non-public financial data; CCPA as amended by the CPRA (know, delete, correct, opt out of sale or sharing, limit sensitive data).
Colorado	SB26-189 (signed 14 May 2026) repeals and re-enacts SB24-205; ADMT duties from 1 January 2027. HB26-1263 (signed 1 July 2026) adds chatbot duties from the same date.
Vendor AI	Formal Opinion 512: understand retention, training use and access before you input client information.
Limits on AI assistance	Do not assume ‘US privacy law’ is one instrument. Name the statute that covers the data.

Precedents for this area

All precedents for Privacy, Data Protection & Cyber. Signed-in accounts can read the full text.

Related jurisdictions

Australia New Zealand United States