Data and privacy
Privacy law is moving fast
Australia’s privacy regime has changed more in the past two years than in the decade before. The Privacy Act 1988 now carries higher penalties and new OAIC enforcement powers, individuals can sue for serious invasions of privacy, and from 10 December 2026 privacy policies must explain how automated decisions use personal information. Customers and regulators expect more, and data breaches are front-page news.
We help businesses build privacy frameworks that work in practice: clear disclosures, sensible handling processes and a breach response plan you can actually follow. Our advice draws on our partners’ experience inside major banks, where privacy, credit reporting and AML/CTF obligations all meet.
Who we act for
Advice for businesses that hold personal information
Lenders and credit providers
Privacy and credit reporting obligations under Part IIIA of the Privacy Act and the Credit Reporting Code.
Fintechs and platforms
Privacy by design for new products, apps and data-sharing arrangements, including the consumer data right.
Consumer brands and member organisations
Marketing, loyalty and member platforms that collect and use customer data.
Boards and leadership teams
Governance, data breach readiness and what the reforms mean for your organisation.
How we help
Our data and privacy services
- Privacy policies, collection notices, consents and credit reporting policies
- Privacy impact assessments for new products, systems and data projects
- Data breach response plans, and support when you’re dealing with an eligible data breach
- Marketing advice under the Privacy Act, the Spam Act 2003 and the Do Not Call Register regime
- Credit reporting compliance under Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code
- Automated decision-making disclosures ahead of 10 December 2026
- Privacy complaints and internal complaint handling procedures
- Privacy audits, compliance programs and staff training
- Document retention schedules and record-keeping processes
- Sensitive information, workplace surveillance and the consumer data right
Selected work
Recent privacy matters
Macquarie Bank
During his time at Macquarie Bank, AJ Sridaran was one of the lead senior lawyers advising the bank on privacy.
Member platform
Provided extensive data and privacy advice to a National Rugby League club on its member platform.
Policy reviews
Review lender policy documentation for compliance with privacy, AML/CTF, data, National Credit Code and Corporations Act requirements.
Trade promotions
Advised a large retailer on the terms and conditions for a game-of-chance promotion, and managed the legal process from start to finish.
Why Hindsight
Why clients choose us
We’ve sat on the bank’s side
We’ve worked inside major banks, so we know how compliance actually works in a large organisation.
Practical, not theoretical
Advice you can implement, sized to your business and the data you actually hold.
Partner-supervised, every matter
Every matter is supervised by one of our Founding Partners.
Clear scope and fees
We agree the scope and fees with you upfront, and charge fixed fees wherever we can.
Our partners
The team behind your privacy program
Our privacy work is led by our Founding Partners. During his time at Macquarie Bank, AJ Sridaran was one of the lead senior lawyers advising the bank on privacy, so we know how privacy obligations play out inside a large financial institution.
Michael Lazar
Founding Partner
Formerly NAB and Dentons. Advises banks, credit providers and SMSF lenders on regulation and structuring.
AJ Sridaran
Founding Partner
Formerly Macquarie Bank and Dentons. Legal 500 ‘lawyer to note’ in fintech and financial services regulation.
Recognised by the Legal 500 and Lawyers Weekly
Meet our partners →FAQs
Frequently asked questions
Does the Privacy Act apply to my business?
It applies to most organisations with annual turnover of more than $3 million, and to some smaller businesses regardless of turnover, such as health service providers and businesses that trade in personal information. Credit reporting rules can also apply to smaller credit providers. We can confirm where you stand.
What do we need to do about automated decisions?
From 10 December 2026, if you use computer programs to make or substantially assist decisions that significantly affect individuals, your privacy policy must say so. Our article on automated decisions and the Privacy Act explains what lenders need to do.
What should we do if we have a data breach?
Act quickly to contain it, then assess whether it’s likely to cause serious harm. If it is, you must notify affected individuals and the OAIC. A response plan prepared in advance makes this far easier. See our article on the OAIC’s latest data breach statistics.
Can customers sue us for a privacy breach?
Since June 2025, individuals can sue for serious invasions of privacy under a new statutory tort, separate from the OAIC complaints process. Good privacy practices reduce that risk.
Can you review our privacy policy?
Yes. We review privacy policies, collection notices and credit reporting policies against current law and update them so they’re clear and compliant.
Talk to us
Need help with your privacy obligations?
Whether it’s a policy update, a new product or a breach, book a call and we’ll tell you what you need to do and what it will cost.