General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.
The deadline that should have your attention
- Tranche 2 designated services commenced 31 March 2026. Conveyancers, and in WA licensed settlement agents, are named reporting entities alongside lawyers, accountants and real estate agents. The obligations themselves started 1 July 2026, and an AML/CTF program had to be in place by that later date. Read: AML Tranche 2 for conveyancers.
- AUSTRAC enrolment: the cut-off for firms already providing designated services at commencement is 29 July 2026, a date fixed by the amending Act's application provisions rather than counted from when your firm began. A firm whose first designated service comes later enrols within 28 days of that service. Confirm your firm's exact date with AUSTRAC. Your privacy obligation attaches from the moment you are providing designated services and are a reporting entity, not the day you enrol.
If you are reading this in mid-2026, you are likely mid-enrolment. The privacy side does not wait for a second deadline. It applies now.
The exemption that sheltered you has a hole in it now
Most conveyancing firms turn over under A$3 million and have relied on the small-business exemption (s 6D), which meant they never had to comply with the Australian Privacy Principles. Becoming an AUSTRAC reporting entity changes that. Via Privacy Act s 6E, you are treated as an organisation for the activities you carry on in connection with the AML/CTF Act. So the Privacy Act applies to the personal information you handle for AML/CTF purposes: the identity, verification, beneficial-ownership and source-of-funds data you collect for customer due diligence, even below the $3 million threshold. The rest of your practice is not automatically swept in. Read: what personal information is caught.
For most conveyancers this is not an upgrade to an existing privacy setup. It is a first-ever privacy obligation, and nobody told you it came attached to AML.
Why conveyancing data is squarely in scope
Assisting a client to buy, sell or transfer real estate is the core service that pulls conveyancers into the regime. It is the whole of the work, so there is no ancillary edge to sit on. And the data you now hold as a regulated entity is unusually sensitive:
- Verification of identity (VOI): passport, driver's licence, Medicare and other identity documents collected to verify your client, including under the ARNECC "reasonable steps" identity standards used for e-conveyancing. Read: VOI vs AML customer due diligence.
- AML customer due diligence: customer identification, beneficial-owner details, and PEP or sanctions screening results. Read: beneficial ownership.
- Source of funds and source of wealth: where settlement money comes from, including bank statements and gift or loan evidence.
- PEXA / ELNO settlement data: workspace and trust-account details identifying the parties, the property and the flow of funds.
- Trust-account records: client banking details and disbursement records you hold to settle.
This is a concentrated bundle of identity and financial data. That is exactly the kind of information that makes a data breach serious and a privacy claim viable. Read: your data-breach response plan.
Two further pressures you should know about
- A direct right to sue for serious invasions of privacy commenced on 10 June 2025. Individuals can bring a claim directly, no regulator needed, for intentional or reckless conduct. Conveyancers hold precisely the high-sensitivity identity and financial data that makes such a claim concrete.
- From 10 December 2026, automated-decision-making transparency: if you use software that makes, or substantially and directly supports, a decision that significantly affects a person (some electronic VOI, IDV or PEP/sanctions-screening tools may qualify), your privacy policy will need to disclose it. A forward-dated change worth building in now rather than retrofitting later. Read: automated decision-making and your privacy policy.
What conveyancers actually need to do
At a minimum, a conveyancer drawn into the Privacy Act needs:
- A compliant privacy policy (APP 1) that reflects conveyancing (VOI, source of funds, trust records, PEXA/ELNO data), not a generic fill-in. Read: the conveyancer privacy policy.
- Collection notices (APP 5) that tell clients what you collect and why, including your VOI and AML customer-due-diligence collection. Read: consent to collect ID for AML.
- A data-breach response plan for the notifiable-data-breach scheme, tuned to the real conveyancing exposure: compromised settlement credentials, misdirected VOI packs, and payment-redirection fraud.
- Retention, access and complaint procedures, including reconciling the AML records-retention floor with the Privacy Act's "destroy when no longer needed" principle. Read: how long to keep records.
The AML platforms do not give you these. Free generic templates usually are not written for conveyancing, and most do not keep pace as the law changes.
What the Conveyancer Kit gives you
A dedicated, conveyancer-specific privacy document set, written for conveyancing and WA settlement work, and kept current as the law changes. Not a one-off free download, and not an AML platform bolt-on: the privacy-focused answer to the obligation Tranche 2 just handed you.
- Written for conveyancers and WA settlement agents: VOI, source of funds, trust accounts, PEXA/ELNO.
- Practical, plain-English documents you tailor to your firm, with guidance built in.
- Kept current: while your subscription is active, we monitor the law and aim to provide updated versions as it changes, including the 10 December 2026 ADM change. This is not a guarantee of compliance, and does not replace your own legal advice.
These are compliance tools and templates you tailor to your own business. For advice on your specific circumstances, consult a qualified Australian legal practitioner.
Keep up with the changes
Not buying today? Get the plain-English updates as the privacy rules change, and the notes on what they mean in practice. No cost, no obligation.
✓ You’re on the list. We’ll email you as the changes land.
We never sell your data. See our Privacy Policy.
Keep reading
- AML Tranche 2 for conveyancers: what changed on 1 July 2026
- Privacy obligations for conveyancers, state by state
- WA settlement agents and privacy
- What the AML/KYC personal information includes
- VOI vs AML customer due diligence
- Beneficial ownership: what you collect and why
- Overseas disclosure and offshore providers (APP 8)
- The conveyancer privacy policy
- Your data-breach response plan
- Consent to collect ID for AML
- Automated decision-making and your privacy policy (from 10 Dec 2026)
- How long to keep records
- What non-compliance can cost
- The cost of AML-driven privacy compliance
- What your collection notice must say (APP 5)
- The minimum to be privacy compliant
General information and compliance tools, not legal advice. Privaproof is not a law practice and does not provide legal advice. This page does not assess your obligations under the AML/CTF Act itself, which are administered by AUSTRAC, and it does not replace advice on your specific circumstances. The Privacy Act 1988 (Cth) and related guidance change over time, so check you are working from a current version.
The Conveyancer Kit
Thirteen editable Word documents, built around what a conveyancing practice actually holds and does.
Handle information properlyPolicy, collection, VOI and AML identity data, and retentionView 4 documentsHide documents
- Privacy Policy
- Collection Notice
- Verification-of-Identity and AML/CTF Collection Notice
- Document Retention and Destruction Schedule
Give your team clear directionTraining, roles, and what you holdView 3 documentsHide documents
- Staff Privacy Training Outline and Confidentiality Agreement
- Privacy Officer Role and Internal Privacy Procedure
- Data Inventory / "What We Hold" Map
Respond when something happensBreach, access and complaintsView 3 documentsHide documents
- Data Breach Response Plan
- Access & Correction Request Procedure
- Privacy Complaint Handling Procedure
As your practice changesSuppliers, offshore, consent and marketingView 3 documentsHide documents
- Service Provider and Overseas Disclosure Clauses
- Consent Form & Consent Clauses
- Direct Marketing & Opt-Out Handling
A$449 / year incl GST
When the privacy rules change, the updated documents are in your account. You do not write them again.
Includes the updates we make to the kit while your membership is active. Those track the Privacy Act, the Australian Privacy Principles and the AML/CTF record-keeping rules that sit alongside them. See what has changed
Get the Conveyancer Kit →Written for conveyancing and WA settlement work, not adapted from a generic small-business set. The VOI and AML collection notice is the document no generic template carries.
Thirteen documents. Not thirteen projects.
Four documents carry most of the tailoring. The rest use recurring firm details, clear prompts and the order in the Start Here sheet.
- 1
Two decisions, before you open a document
Who your Privacy Officer is, and which of your work is the designated service that brings the firm in. For most conveyancing practices assisting a client to buy, sell or transfer real estate is the whole of the work, so the second decision is usually short. The Start Here sheet settles it in one table.
- 2
Nine details, filled in once
Your firm name, ABN, Privacy Officer and contact details are among the nine that recur across the kit. Fill them in once, then find and replace carries them through all thirteen documents in a few minutes.
What the work actually looks like
13 documents
The Start Here sheet gives you the order to work in and an indication of the time involved. You receive the complete kit.
Three privacy checks for your firm
You can check all three today.
Collect
At engagement, can you tell a client why you need their identity documents and source-of-funds evidence, and what happens to them afterwards?
Protect
Could you list every place VOI packs and settlement records sit, including the ELNO, the practice management system and anything a contractor can reach?
Destroy
Do you know which records the AML retention floor holds, and what happens to the rest once you no longer need it?
A conveyancing file concentrates identity documents, beneficial-ownership and screening results, and evidence of where settlement money came from. That combination is what makes a breach serious rather than embarrassing.
Privacy Act 1988 (Cth), APP 1, APP 5, APP 8, APP 11 and APP 11.2, and Part IIIC (Notifiable Data Breaches); AML/CTF Act 2006 (Cth).
Privacy is part of client trust
87% of Australians are more concerned about their privacy than they were five years ago.
A client hands you their identity documents and the evidence of where their settlement money came from, at the largest transaction of their life. A practical privacy system helps your team handle that with the care clients increasingly expect.
A privacy policy is one document.
You may already have one. It is one of the thirteen.
Privacy policy
Says what you do
A statement for clients and your website.
Practical procedures
Tell your team how
The steps behind privacy in everyday work.
The Conveyancer Kit gives you the policy and the procedures behind it.
Designated services from 31 March 2026
Why this reaches almost every conveyancing practice
The designated service is assisting a client to buy, sell or otherwise transfer real estate, which for most practices is the whole of the work.
Not the trigger
Your turnover · Your firm size · Whether you have enrolled yet
The dates that actually apply
Once you are a reporting entity, Privacy Act s 6E applies the Australian Privacy Principles to the personal information you handle for your AML/CTF activities, even below the A$3 million threshold.
The rest of your practice is not automatically swept in.
Legal detail and sources
The designated service is stated in the Act's own words: "assisting a person in the planning or execution of a transaction, or otherwise acting for or on behalf of a person in a transaction, to sell, buy or otherwise transfer real estate". Conveyancers, and in Western Australia licensed settlement agents, are named reporting entities alongside lawyers, accountants and real estate agents. The privacy obligation attaches from the moment you are providing designated services and are a reporting entity, not from the day you enrol. Confirm your firm's own dates with AUSTRAC.
AML/CTF Act 2006 (Cth) s 6(5B), Table 6 (Professional services), item 1; Privacy Act 1988 (Cth) s 6E.
Put a practical privacy baseline in place
One complete 13-document privacy kit for Australian conveyancers and WA settlement agents. Guided tailoring for your firm, kept current as the privacy rules change.
A$449/year incl GST
General information and document templates you tailor, not legal advice. Written by Privaproof.