Privacy Compliance Is Moving From Policy to Proof: Four Lessons for Australian SMEs

Privacy and cybersecurity news this week points to the same business reality: having a policy is no longer enough. Regulators and customers increasingly expect organisations to show how personal information is protected, how automated decisions are explained, and how quickly risks are identified and managed.

For small and mid-sized businesses, that may sound like a problem reserved for large technology platforms. It is not. Australian SMEs often rely on cloud platforms, outsourced IT providers, marketing tools, customer relationship systems and artificial intelligence services. Each connection creates a responsibility to understand what data is collected, where it goes, who can access it and what happens when something fails.

The latest developments also show that privacy and security are becoming inseparable. A phishing campaign that compromises a remote management tool can become a privacy incident. Poor data retention can increase the impact of a breach. An automated decision can create legal and reputational risk if customers cannot understand how it was made.

Here are four developments from the past seven days that business leaders should have on their radar.

1. Australian businesses need to prepare for new AI transparency obligations

The Office of the Australian Information Commissioner has released new resources covering transparency when businesses use artificial intelligence or other computer programs to make, or help make, decisions that significantly affect individuals. The OAIC says Australian Privacy Principle entities must include information in their privacy policies about these arrangements from 10 December 2026. citeturn1search8

This is an important signal for businesses using automated tools in recruitment, lending, insurance, customer screening, fraud detection, pricing, eligibility checks or employee management. The obligation is not limited to companies that build their own AI models. It may also affect organisations that configure or purchase software which makes recommendations or decisions using personal information.

The practical challenge is that many SMEs do not have a complete register of automated decision-making. A team may use an AI screening feature inside a recruitment platform, an automated fraud score in an online payment system, or a customer segmentation tool in a marketing platform without viewing it as an AI system. From a privacy perspective, the label matters less than the effect on the individual.

The OAIC development also reinforces a wider trend. Regulators expect businesses to understand their technology supply chain, not simply rely on a vendor’s general assurance that a product is compliant. If an organisation is responsible for the decision, it needs enough information to explain the role of the system, check that the data is appropriate and respond when a person challenges an outcome.

Practical steps for business leaders:

• Create an inventory of software that makes, recommends or influences decisions about customers, employees, suppliers or applicants.
• Record what personal information each system uses, the purpose of the processing and the business owner responsible for it.
• Ask vendors whether the system uses automated decision-making, profiling, machine learning or generative AI, and request clear documentation.
• Update privacy policies before 10 December 2026 where automated decisions significantly affect people’s rights or interests.
• Establish a human review process for disputed, unusual or high-impact decisions.

A useful starting point is the OAIC guidance on AI and automated decision-making. The most effective response is not to stop using AI. It is to make its use visible, governed and explainable.

2. The Latitude investigation shows why data retention remains a live risk

The OAIC has confirmed that its investigation into the 2023 Latitude data breach is continuing. The investigation is examining whether the company took reasonable steps to protect personal information and whether it took reasonable steps to destroy or de-identify information that was no longer required. The regulator has also noted that enforcement powers may be available if contraventions are substantiated. citeturn1search1

The case is significant for SMEs because it highlights a common weakness: businesses often focus on protecting the data they actively use while overlooking information retained for historical, administrative or convenience reasons.

Old identity documents, archived customer records, former employee files, unused accounts and exported spreadsheets can all increase the impact of an incident. They may sit outside the main business system, receive less monitoring and be accessible to more people than necessary. The longer information is retained, the more opportunities there are for it to be exposed, misused or accessed through a compromised account.

Data retention is also a governance issue. If a business cannot explain why it still holds a category of personal information, it may be difficult to demonstrate that the information is being managed responsibly. Retention schedules do not need to be complicated, but they should be documented and applied consistently.

For Australian businesses, the lesson is not that every old record must be deleted immediately. Some information must be kept to meet tax, employment, legal or contractual obligations. The lesson is to know what must be retained, for how long, where it is stored and how it is securely destroyed or de-identified when the retention period ends.

Practical steps for business leaders:

• Map personal information across production systems, cloud storage, email, backups, paper files and third-party platforms.
• Classify records by purpose and set a documented retention period for each category.
• Remove duplicate exports and old spreadsheets that are no longer needed for a business purpose.
• Review former employee and contractor access, including accounts belonging to outsourced providers.
• Test secure deletion and de-identification processes instead of assuming that pressing delete is enough.

The OAIC update on the Latitude investigation is a reminder that data minimisation is not just a privacy principle. It is a practical security control that reduces the amount of information available to an attacker.

3. The UK TikTok penalty reinforces the cost of weak children’s data controls

The UK Information Commissioner’s Office has confirmed that TikTok has withdrawn appeals and agreed to pay a £12.7 million fine relating to breaches of data protection law involving children’s personal information. The original enforcement action concerned the handling of children’s data, age checks, transparency and the ability of underage users to access the service. citeturn1search5

Most Australian SMEs are not social media platforms, but the underlying lesson is widely relevant. Businesses that collect information from children, families, students or vulnerable customers need stronger controls than a simple age tick box and a generic privacy notice.

This matters to retailers, education providers, health and community organisations, entertainment businesses, membership programs and any company that markets online. Even where children are not the primary audience, a business may still collect their data through customer accounts, bookings, competitions, support interactions or connected household services.

The case also demonstrates why transparency must be understandable. A notice may be technically complete but still fail to help a child, parent or ordinary customer understand what information is collected, why it is used and who receives it. Privacy communication should be designed for the audience, not only for legal review.

Australian businesses should also consider the international reach of online services. A local company can attract customers from overseas, use an overseas platform or process data through a global vendor. That does not automatically mean every foreign rule applies, but it does mean the business should understand its customer base, contractual obligations and exposure in the markets it serves.

Practical steps for business leaders:

• Confirm whether children are likely to use your website, app, service or customer support channels.
• Review age assurance, parental consent and escalation procedures where they are relevant to your service.
• Rewrite privacy notices in plain language and provide versions suitable for young people and parents where appropriate.
• Limit profiling, targeted marketing and unnecessary collection of information about minors.
• Check that vendors handling customer data apply the same controls to deletion, access, consent and incident response.

The UK ICO announcement about the TikTok penalty is a useful benchmark for reviewing whether your privacy controls are genuinely protective or simply documented.

4. Remote access and cloud identities are now privacy controls

A major vendor advisory this week described phishing campaigns that abused remote monitoring and management tools to create persistent access. Microsoft reported that attackers used MSP360 and ScreenConnect in the same intrusion chain, creating more than one route into affected environments. citeturn0search0

Microsoft also reported activity involving compromised cloud service principals, with attackers using stolen identities for reconnaissance, credential access and destructive actions. The details concern larger cloud environments, but the basic risk applies directly to SMEs because small businesses frequently depend on managed service providers, remote support tools and shared cloud administration.

This is where cybersecurity and privacy compliance meet. A business may have a sound privacy policy, but that policy does not protect customer information if an attacker can enter through an unattended remote access account. Likewise, a company may have multi-factor authentication for employees while leaving a service account, administrator account or vendor connection poorly protected.

Remote management tools are valuable and often essential. The answer is not to remove them. It is to treat them as privileged systems that require strong identity controls, careful configuration and continuous review. Businesses should know which provider can access which systems, during what hours, for what purpose and with what level of authority.

Practical steps for business leaders:

• Maintain a current list of all remote access, remote support and monitoring tools connected to business systems.
• Require phishing-resistant multi-factor authentication for administrators and privileged users wherever available.
• Remove inactive vendor accounts and use named accounts instead of shared credentials.
• Restrict remote access by role, device, time and network where practical, and review access logs regularly.
• Include incident notification, access controls, subcontractors and evidence preservation in managed service agreements.

The Microsoft threat intelligence update on remote management tool abuse provides a timely reminder that a supplier connection is also a potential path to business data. Privacy risk assessments should include the people and systems that support the business, not only the applications that store customer records.

What This Means For Your Business

The common thread across this week’s news is accountability. Regulators are asking whether organisations understand their data, their automated systems and their suppliers. Customers are asking similar questions, especially after a breach or an unexpected decision. Businesses that can answer clearly will be better placed to manage cost, reputation and compliance risk.

For most SMEs, the best response is a focused review rather than a large transformation project. Start with the information that would cause the most harm if exposed, the decisions that have the greatest effect on people and the external providers with the broadest access. Then improve the controls around those areas first.

Over the next 30 days, business leaders should aim to complete four practical tasks: create an automated decision register, review unnecessary retained data, test access for remote support providers and confirm how privacy incidents are escalated. These actions are achievable without building a large internal security team, especially when supported by a capable managed service provider.

Privacy compliance is becoming more operational, measurable and connected to everyday technology decisions. The organisations that prepare now will not only reduce regulatory exposure. They will also make it easier to adopt AI, work with trusted suppliers and respond confidently when customers ask how their information is protected.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.