GDPR in Australia: Duties for Legal Practices

When GDPR Reaches an Australian Legal Practice

Assess GDPR against the practice’s establishment and the particular processing activity before treating an EU connection as sufficient. The European Data Protection Board’s territorial-scope guidance distinguishes two main routes.

An EU establishment brings processing within scope when it occurs in the context of that establishment’s activities. The processing itself can occur outside the EU. For a practice without an EU establishment, examine whether its processing concerns offering services to people in the EU or monitoring behaviour there.

Deliberate targeting is relevant to the services test. A website accessible from Europe, a foreign client address or an EU-related record alone does not establish that test. Nationality is not the deciding factor.

Consider this hypothetical intake. An Australian practice receives French bank statements in an Australian property dispute. Those documents alone do not establish GDPR applicability. If the practice deliberately markets legal services to people in France, its related processing requires a different assessment.

Record the actual activities and the person’s location at the relevant trigger. Obtain specialist EU privacy advice where targeting or an establishment is uncertain, or where monitoring requires closer analysis. Size alone does not exempt a small Australian practice from GDPR.

Determine the Practice’s Data Role

Determine the practice’s role by who decides why and how each processing activity occurs. A controller determines purposes and means. A processor handles data on a controller’s behalf under its instructions. The EDPB’s controller and processor guidance applies these roles to the actual work.

An instructing organisation can control its own employee records while the practice separately controls the use of those records for independent legal advice. Paying the practice does not automatically make it a processor. An external specialist acting only on documented analysis instructions can be a processor for that task.

Map those relationships per activity. A specialist choosing its own purposes for reusing records requires a fresh role assessment. Where a processor relationship applies, use the required written processing terms and define permitted instructions, security and assistance with rights requests.

A GDPR certification claim in Australia also needs a defined scope. Check the approved scheme and the certifying body’s accreditation, then match the certificate to the processing being purchased. The EDPB’s certification register identifies approved mechanisms and accreditation requirements.

The Irish Data Protection Commission’s certification guidance explains that certification concerns specified processing operations. It is voluntary. A training certificate or broad compliance badge does not establish recognised certification of the practice’s matter handling.

Client, Opponent and Third-Party Records

Identify personal data throughout the bundle, including people who never instructed the practice. Statements can identify account holders and payment recipients. Correspondence can identify witnesses, opponents and family members. Copying that material into a ledger is also processing.

For GDPR-covered processing, record the applicable lawful basis for each purpose. The EDPB’s lawful-processing guidance explains the available bases and their conditions. A retainer with the client does not automatically supply the contract basis for an opponent’s data. A client’s authority to instruct the practice also does not amount to everyone’s consent.

Statement descriptions can reveal health information or religious beliefs. These can require a special-category condition in addition to the ordinary lawful basis. The European Commission identifies legal claims as one possible condition for sensitive-data processing. Its necessity must fit the work being performed.

Keep access limited to the people who need the material for the matter. Check confidentiality restrictions and the terms on which evidence was obtained before sharing it. A necessary analysis task does not authorise unrestricted reuse for training, marketing or another matter. Assess any new purpose separately.

Transferring a Statement Bundle to a Specialist

Before sending a bundle, record the purpose and actual recipients, including where people can access it. The EDPB’s international-transfer guidance applies Chapter V where a GDPR-covered exporter makes data available to another organisation outside the European Economic Area (EEA).

That assessment can matter even when the exporter is already in Australia. Establish which processing is covered and whether the proposed disclosure meets the transfer criteria. A supplier’s Australian address does not establish where its staff or subcontractors access records.

Make the proposed handoff specific before authorising it.

1. Identify the statement files and people whose data the task needs. Remove unrelated material where the matter permits.
2. Record the specialist’s role, permitted use and authorised staff access. Identify hosting, support access and onward recipients.
3. Determine whether Chapter V applies and the available transfer mechanism. Assess any required safeguards and destination-country risks.
4. Agree return or deletion arrangements and assistance with incidents and rights requests. Retain the assessment with the engagement terms.

Encryption and confidentiality promises address safeguards. They do not, by themselves, provide a permitted transfer mechanism. Standard contractual clauses require the correct arrangement and assessment for the actual transfer. An Article 49 exception needs its own conditions assessed before use.

Rights Requests, Retention and Incidents

Assign rights requests to a named responsible person who can locate records and obtain legal advice before disclosure or destruction. Confirm the requester’s identity and the capacity in which the practice holds the data. A processor routes the request to its controller and provides the required assistance.

The EDPB’s rights guidance sets out the general one-month response period and conditions for an extension. An access request requires assessment of the person’s data and applicable restrictions. It does not justify automatically forwarding the whole litigation file.

Check the law governing any claimed privilege restriction. For example, Ireland’s supervisory authority explains Irish statutory exceptions to access. An Australian practice must establish the rule applicable to its processing before relying on that exception.

For erasure, identify what remains necessary for legal claims and any retention obligation. Document the applicable exception or other reason for retaining data, then respond within the governing procedure. An Australian retention rule must be assessed alongside GDPR, including whether a GDPR exception supports continued retention.

For an incident, contain the exposure and preserve the facts. Escalate immediately to the practice’s privacy lead and responsible principal. Identify any controller that must be told and assess applicable notification duties.

Under the Irish regulator’s GDPR breach guidance, a risk-bearing breach requires notification to the relevant supervisory authority within 72 hours of awareness. High-risk breaches also require notifying affected people without undue delay. Record awareness and the risk assessment promptly, including reasons for any notification decision.

Record the Applicability Decision

Keep a short decision record that explains the practice’s GDPR reach and the controls required for this matter. GDPR compliance in Australia follows the relevant processing and duties. A generic compliance statement cannot replace that assessment.

Australian obligations remain separate. Use the OAIC’s small-business coverage guidance to assess Privacy Act coverage, including exceptions to the small-business exemption. Check whether the practice’s activities bring it within an exception, such as reporting-entity status.

Professional duties also require a jurisdiction check. In Queensland, the solicitors’ conduct rules on client relations address confidentiality in rule 9 and client documents in rule 14. Rule 14 permits destruction after seven years from completion or termination, subject to contrary instructions or legal obligations. It is not a universal direction to delete every Australian matter file then.

Use this checklist in the practice file.

• Record the territorial trigger, relevant people and processing activities, including the reason for any out-of-scope conclusion.
• Map the practice, instructing organisation and specialist to their actual roles.
• Identify each purpose, lawful basis and any additional condition for sensitive data.
• Keep the transfer assessment, recipient locations and applicable mechanism with the engagement terms.
• Identify access controls, retention decisions and the person responsible for requests or incidents.
• For a certificate relied upon, record the scheme, competent authority, accredited issuer and exact processing scope.
• Set a review trigger, such as a new EU service, changed supplier access or proposed reuse of records.

A certificate can help demonstrate specified safeguards. It does not decide territorial scope or establish that every service the practice uses complies with GDPR. Before a new recipient receives the bundle, resolve any open scope or transfer decision. Where the change creates high-risk processing, use a privacy impact assessment to examine that change in more detail.