Privacy Policies That Actually Protect You: Beyond Automated Decision-Making

Most privacy policies are copied from a template and never checked against what the business actually does.

That gap is where the risk sits. Individuals have been able to sue for serious invasions of privacy since June 2025, regulators can now issue infringement notices for privacy failures, and a policy that doesn’t match your practices can be misleading on its own. Sahil Bhandula, Senior Lawyer at Lawpath, walks through who the Privacy Act actually covers, the sections most policies get wrong, and how to keep your policy accurate as your tools, vendors and markets change. Clause by clause, and practical throughout.

10th November, 2026, 12:00 PM AEDT

RSVP now

In this session, Sahil will cover:

  • Who is actually covered: How the $3 million small business exemption works, and the exceptions, like health services, trading in personal information and AML/CTF reporting, that catch businesses who assume they’re out
  • Matching policy to practice: Why a policy that describes what a template says rather than what you do creates risk, and how to audit the gap
  • Third parties and overseas storage: How to disclose who you share data with, from platform users to subprocessors, and name the countries your data actually goes to
  • Retention, deletion and complaints: Setting deletion timeframes you can meet, the exceptions you need to keep, and a complaints process with a clear response time
  • Marketing consent and overseas users: Where opt-in consent is required, why you can’t contract out of GDPR, and when an international schedule is worth adding
 

Why Attend?

The automated decision-making changes add one new section. This session covers the rest of the policy that has to hold up.

Know whether you’re actually covered

The small business exemption is narrower than most people think. Leave knowing exactly where your business sits.

Get your policy ready for 10 December

Pair your automated decision-making disclosures with a full refresh, so you only update your policy and notify users once.

Close the gap between your policy and your practice

Most problems aren’t missing clauses. They’re clauses that don’t reflect how data is really handled. Learn how to spot them in your own policy.

Ask Sahil your specific questions live

Bring your current policy, your platforms and your vendor list. Sahil will work through what applies to your business directly.

 

 

Limited seats available, register today!

 

 

 

Note for accountants and lawyers: this session isn't CPD accredited and doesn't count towards your annual points or units.

By clicking on 'Register now' you are agreeing to the Lawpath Terms & Conditions