Cybercraft
← Back to Strategic services Strategic

Privacy is not a sprint — it is an ongoing programme. Here is what that looks like for your organisation.

A one-time compliance sprint gets you ready for a deadline. A privacy framework keeps you compliant as your organisation, your data flows, and the regulatory environment change. If you handle personal information at scale — or want to — this is the longer-term commitment.

What's involved

If you need to get compliant before 1 July 2026, that is the Privacy Act Compliance sprint. This engagement is the next step: the ongoing management structure your organisation needs once the foundation is in place.

A privacy framework establishes how you manage personal information as a continuous business function — covering the Australian Privacy Act 1988 and, for organisations with NZ operations, the NZ Privacy Act 2020. It formalises data management practices, embeds Privacy Impact Assessments into project and procurement processes, and builds a breach response capability.

For organisations that need it, we provide ongoing Privacy Officer services — maintaining your framework, conducting PIAs, handling complaints, and keeping your practices aligned with evolving regulatory expectations on both sides of the Tasman.

Deliverables

  • Privacy framework aligned to the Australian Privacy Principles and NZ Privacy Act 2020
  • Data management policy and procedures
  • Privacy Impact Assessment (PIA) methodology and templates
  • Data breach response plan and OAIC/OPC notification procedures
  • Third-party privacy assessment framework
  • Privacy awareness training for staff
  • Ongoing Privacy Officer services (optional retainer)

Business benefits

  • Privacy compliance that scales with your organisation — not just for right now
  • PIAs embedded into project and procurement processes before problems arise
  • Reduced risk of notifiable data breaches through better data governance
  • Credible response to regulatory enquiries, client due diligence, and audit requests

Engagement process

AssessmentCurrent privacy practices assessed against the Privacy Act and APPs. Data flows mapped, gaps identified.
Framework designPrivacy management structure, policies, and procedures designed for your organisation's context and complexity.
ImplementationFramework rolled out, PIA processes established, staff trained, third-party arrangements reviewed.
Breach readinessData breach response plan developed and tested. Notification procedures aligned with OAIC requirements.
Ongoing managementIf retained, Privacy Officer services maintain the framework, conduct PIAs, and manage privacy obligations on an ongoing basis.
Build your privacy programme

Ready to move beyond the one-time sprint?

Tell us how you handle personal information today, which jurisdiction you operate in, and what is prompting the conversation. We will help you understand what a privacy programme looks like at your scale.

Build your privacy programme

Kaurna Acknowledgement

We acknowledge and pay our respects to the Kaurna people, the traditional custodians of the ancestral lands on which we work. We acknowledge the deep feelings of attachment and relationship of the Kaurna people to country and we respect and value their past, present and ongoing connection to the land and cultural beliefs.

Kaurna Acknowledgement

We acknowledge and pay our respects to the Kaurna people, the traditional custodians of the ancestral lands on which we work. We acknowledge the deep feelings of attachment and relationship of the Kaurna people to country and we respect and value their past, present and ongoing connection to the land and cultural beliefs.