For small and mid-size Australian businesses that need to know where they stand on privacy, accessibility and security — and be able to prove it.
No obligation. I’ll look, and tell you what I find.
Australian businesses are facing a run of new digital obligations arriving close together. Privacy law reforms take effect from 10 December 2026, including new transparency requirements for automated decisions and a Children’s Online Privacy Code. Accessibility standards are being enforced more actively around the world. And security expectations are rising through supply chains, government panels and cyber insurance questionnaires.
For most businesses, none of this is visible until it costs something — a tender that doesn’t progress, a letter from a regulator, a complaint, or an insurance claim that gets questioned. The gap was usually there for months before anyone noticed.
The fix is usually straightforward once someone actually looks. The first step is simply finding out where you stand.
Each one is assessed against a published standard, so you know exactly what “done” looks like.
Get ready for the privacy reforms taking effect from 10 December 2026.
From 10 December 2026, Australian businesses face new disclosure requirements around automated decision-making and a new Children’s Online Privacy Code. I audit what you collect, how you use it, and where your privacy policy falls short — then close the gaps with a fixed-price sprint.
Assessed against: Privacy Act 1988 (Cth) and the Australian Privacy Principles
Ask about this →New obligations if under-18s could use your service — even if they’re not your audience.
If your service could reasonably be accessed by under-18s — even if it’s not aimed at them — new obligations may apply. I assess exposure and build the specific safeguards required.
Assessed against: the Children’s Online Privacy Code (OAIC)
Ask about this →Show insurers, panels and clients real evidence of your cyber security maturity.
Insurers, government panels and larger clients increasingly ask small businesses to demonstrate cyber security maturity. I help you document what you actually have in place against the ASD’s Essential Eight framework — real evidence, not certification theatre.
Assessed against: ASD Essential Eight Maturity Model
Ask about this →A manual WCAG 2.2 audit of your website, with a clear list of fixes.
Most business websites fail basic accessibility standards, and legal exposure is rising globally. I run a manual audit against WCAG 2.2 — the fixes are usually simpler than expected, and they open your site to more customers, not fewer.
Assessed against: WCAG 2.2, Level AA
Ask about this →A security check for apps and tools built with AI coding platforms.
If your business built an app or internal tool using AI coding platforms (Lovable, Bolt, Replit, or similar), there’s a good chance it has real security gaps nobody’s checked. I review AI-built applications against known vulnerability patterns and hand back a plain-English fix list.
Assessed against: OWASP Top 10 and common AI-generated code weaknesses
Ask about this →A practical process for spotting fake and AI-generated job candidates.
Fake and AI-generated job candidates are a fast-growing problem in remote hiring. I help businesses build a practical verification protocol for screening and interviews — not expensive enterprise software, just a process that works.
Ask about this →I run a short external diagnostic on your website or policy and send you what I find. No obligation.
If there’s a gap worth closing, I quote a fixed price upfront and deliver the fix — updated policy, documentation, or evidence pack — usually within a week.
You walk away with something concrete: a policy, a report, a checklist — proof you can show a regulator, an insurer, or a client who asks.
A Canberra health practice had a genuinely well-written Charter of Patient Rights — better than most in the sector — but it predated several 2026 requirements. The gaps: no privacy notice on the online contact form, no stated data retention period, no disclosure covering the third-party booking platform in use. None of it required starting over. All of it was fixable within a week.
Every report starts by naming what’s already working — most businesses have more right than wrong.
My background is in IT operations and security compliance — running service management under ITIL, working in ServiceNow, and network security. That work comes down to one thing: knowing exactly what’s in place, what isn’t, and being able to prove it. I now do the same for small and mid-size businesses facing those questions from regulators, insurers and clients.
I’m based in Canberra and work directly with every client — the person you speak to is the person doing the work, and nothing is outsourced.
I identify gaps against published standards and provide documentation to support compliance. This isn’t legal advice, and I partner with a qualified lawyer for anything that needs it.
A short summary of what’s changing, which businesses it applies to, and how to check where you stand.
Coming soonTell me a little about your business and I’ll run a short external check on your website or privacy policy, then send you what I find. No obligation.