Threshold assessment
Go/no-go screen: does this project need a full PIA? Document the decision as your go-live gate.
Privacy impact assessment
Privacy Impact Assessment before you ship
Australian small businesses are launching AI tools, CRM migrations, and customer data projects without a privacy impact assessment. OAIC-aligned PIAs catch APP gaps while you can still change the design, not after a complaint or a client security questionnaire lands in your inbox.
Framework adoption
OAIC Privacy Impact Assessment deliverables
Privacy impact assessment services scoped as fixed-quote engagements: threshold reviews, full PIAs, and APP compliance checks aligned to OAIC guidance for Australian organisations.
Stakeholder consultation
Identify who is affected and who needs input before you commit to a design.
Information flow mapping
Visual map of what personal information is collected, where it goes, and who can access it.
Privacy risk analysis
Likelihood and impact rated with mitigations tied to each material risk.
APP compliance review
Structured check against Australian Privacy Principles relevant to your project.
PIA report
Board-ready summary with recommendations, owners, and implementation priorities.
Implementation tracking
Follow-up to confirm mitigations landed before launch. No sign-off without evidence.
Privacy register support
For serial project teams, templates and registers so adoption compounds across the organisation.
Fit
Who this is for
Teams turning on AI without a data review
ChatGPT, Copilot, or a custom model processing customer emails and documents. If personal information is leaving your control, you need a threshold assessment before go-live, not a post-incident scramble.
SMBs answering client security schedules
Enterprise clients and government tenders increasingly ask for PIAs in supplier questionnaires. A documented assessment shows due diligence and keeps deals moving.
Businesses who think they are too small
Turnover under $3 million does not mean you are exempt. Health data, sensitive information, and notifiable data breach obligations still apply. A threshold review costs less than retrofitting privacy after launch.
Government suppliers and agencies
High privacy risk projects require a PIA under the Australian Government Agencies APP Code. We follow the OAIC ten-step process.
Industries
Where we show up most
Healthcare and allied health
Patient data, referrals, and telehealth platforms where APP 11 security and APP 3 collection limits need documented analysis before systems go live.
Retail and ecommerce
Loyalty programmes, personalisation, and payment flows with clear information flow maps for marketing and ops teams.
Professional services
Client portals, document automation, and AI drafting tools assessed before client data enters a new pipeline.
Outcomes
What you walk away with
Cheaper before launch than after a breach
Retrofitting privacy controls, notifying affected individuals, and answering OAIC enquiries costs far more than assessing risk while the project is still on paper.
Notifiable Data Breaches are not theoretical
If personal information is lost or disclosed without authorisation, the NDB scheme may require notification to the OAIC and affected individuals. A PIA documents what you checked before that happens.
Privacy Act reforms are raising expectations
Ongoing legislative changes strengthen privacy obligations for Australian organisations. PIAs are how you show you assessed impact before collection, not after regulators ask.
How it works
A process without black boxes
Threshold
Quick screen: does this project need a PIA, and at what depth?
Map
Document flows, systems, vendors, and overseas disclosures.
Analyse
Privacy risks and APP gaps with mitigations proposed.
Report
Deliver the PIA report and agree what must happen before go-live.
Get a scoped quote before any work starts
Request a Discovery Session. We will scope your environment and send a fixed quote before any work starts.
Request a Discovery SessionProof
Work that backs the pitch
Real builds, not stock screenshots. See how the craft lands for clients like you.
Case study
One Line Loop Journaling App
Case study: One Line Loop, an email-first daily journaling app.
View project
Case study
AutoSizer Marketplace Resizer
Case study: AutoSizer, a browser-first image resizer for marketplaces.
View project
Case study
Clean Fridays Marketplace
Case study: Clean Fridays, an Australian cleaning marketplace.
View projectQuestions
Straight answers
What is a Privacy Impact Assessment (PIA) in Australia?
A Privacy Impact Assessment is a structured review of how a project collects, uses, discloses, or stores personal information, aligned to OAIC guidance and the Australian Privacy Principles. It identifies privacy risks and mitigations before go-live, not after a breach or complaint.
What happens if we skip a PIA?
You may launch with undisclosed privacy risks, face harder remediation after go-live, and struggle to answer client or OAIC questions if something goes wrong. A threshold assessment is the minimum due diligence step and often takes one to two weeks.
Does the $3 million turnover threshold mean we are exempt?
Not necessarily. Many small businesses handle health information, employee records, or other triggers that bring Privacy Act obligations regardless of turnover. Even when not legally mandated, enterprise clients increasingly require PIAs in supplier forms.
My client asked for a PIA in their supplier form. What do we provide?
A documented threshold or full PIA report aligned to OAIC guidance, with information flow maps and APP compliance notes. We scope the depth to match what the questionnaire asks for.
We are about to turn on an AI feature next month. Is it too late?
No, but the window is closing. A threshold assessment can complete in one to two weeks if stakeholders are available. Delaying until after launch means changing live systems instead of fixing the design.
Is a PIA mandatory for private sector businesses?
Not always by law, but federal agencies must conduct PIAs for high privacy risk projects. Private sector organisations are strongly encouraged by the OAIC, and Privacy Act reforms continue to strengthen expectations.
Do we need a PIA for an AI project?
Often yes. AI features usually involve new collection, inference, or third-party model processing. A threshold assessment confirms whether a full PIA is warranted.
How long does a PIA take?
Threshold reviews can complete in one to two weeks. Standard PIAs for a single project often run three to six weeks depending on stakeholder availability.
PIA vs privacy policy?
A privacy policy tells customers how you handle data generally. A PIA analyses a specific project before you build it. You need both, but they serve different purposes.
Is this legal advice?
No. We provide privacy and compliance advisory aligned to OAIC guidance. Your lawyer should review anything that needs formal legal sign-off.
Official guidance
Authoritative sources
Next step
Assess privacy risk before your next project ships.
Request a Discovery Session. We will scope a threshold or full PIA and send a fixed quote before any work starts.