Privacy Policy (APP 1)
Explains how your practice collects, uses, holds and shares personal information, and how people can access it or complain.
OAIC: privacy policy guidancePrivacy readiness / Free self-check
Are you ready for the Privacy Act?
Check four practical privacy documents for your AML/CTF work. You will get a list of what you report having, what needs preparation and what needs checking. Free, no signup required. This does not assess every privacy obligation or verify your documents.
Step 1 of 3
What is your industry?
Start with your practice. We will ask about your reporting status next; industry alone does not decide your obligations.
Select an industry to continue.
Understand the scopeWhy privacy belongs
Why privacy belongs
in your AML work.
Section 6E(1A) of the Privacy Act covers a small business reporting entity or its authorised agent for activities connected with AML/CTF obligations, regardless of turnover. For newly regulated Tranche 2 entities this applies from 1 July 2026. Other grounds for Privacy Act coverage may also apply.
Read the OAIC guidanceThe four documents below are a useful starting point. Having them is not the same as putting privacy practices into operation.
Four documents. Four different jobs.
Collection Notice (APP 5)
Explains the relevant collection matters at or before collection, or as soon as practicable afterwards. Check any tipping-off restriction.
OAIC: collection notice templateData Breach Response Plan (NDB)
Sets out who contains and assesses a suspected breach, and who decides whether notification is required.
OAIC: preparing a breach response planRetention & Destruction Schedule (APP 11)
Records retention periods, their starting events, and secure disposal when information is no longer needed or legally required.
AUSTRAC: record keeping requirementsPrivacy Act and Tranche 2: common questions
Does becoming an AML/CTF reporting entity remove the Privacy Act small business exemption?
For AML-connected activities, yes. Section 6E(1A) covers small business reporting entities and their authorised agents regardless of turnover. Your profession alone does not decide whether you are a reporting entity.
OAIC: reporting entities and privacyWhen did this start for Tranche 2 firms?
Newly regulated Tranche 2 businesses are covered once they become reporting entities from 1 July 2026. Existing small business reporting entities already had privacy duties; the 31 March 2026 AML reforms changed aspects of their information handling.
OAIC: reporting entities and privacyDoes the Privacy Act now cover my whole business?
Not automatically through the AML connection alone. Other grounds for coverage can apply, so a No answer here is not an exemption decision for the rest of your business.
OAIC: small business coverageWhat privacy documents does a Tranche 2 firm need?
This check covers a privacy policy, collection notice, breach response plan and retention schedule. They support different duties and practices; four Yes answers do not establish compliance or replace a wider review.
OAIC: reporting entities and privacyDo I have to keep copies of client ID documents for seven years?
The reformed AML/CTF record-keeping rules do not require copies of the ID documents themselves. Keep the required CDD information and verification records for seven years after the relationship ends or the occasional transaction is completed. Before deleting copies, check whether another lawful purpose, law or order requires retention, including rules for older records.
AUSTRAC: record keeping requirementsAre the documents AML Mate generates legal advice?
No. Privacy Pack provides starting-point drafts to review and tailor using your business details. You remain responsible for their accuracy and implementation. Free accounts can explore examples; generation and export require an eligible subscription.
Sources checked .
This is a self-reported document check, not a legal coverage decision or a finding of compliance. Documents must reflect what your practice actually does. Seek qualified advice where your obligations are unclear.
Read the Privacy Act background Compare AML Mate plans