How to Build a Successful Data Protection Strategy

The firm’s defence attorneys bring forth their expertise to assist individuals in investigations spanning numerous jurisdictions and involving various agencies. Although headquartered in Sydney, Australia, the firm leverages robust international capabilities and partnerships to address transnational matters that possess ties to Australia. In the area of transnational and international criminal law, Nyman Gibson Miralis transcends geographical limitations. The firm’s international law practice focuses on white-collar and corporate crime, international sanctions, transnational financial crime, international money laundering, bribery and corruption, international asset freezing and forfeiture, extradition, cybercrime and mutual assistance law. Nyman Gibson Miralis further assists individuals who have been arrested and held in police stations across the ACT and NSW. Nyman Gibson Miralis further appears at the Police Integrity Commission, NSW State Parole Authority hearings, Royal Commissions, NSW Crime Commission, Coronial Inquests, Australian Crime Commission, Coronial inquiries and the Independent Commission Against Corruption.

Particular focus will be given to refusal rates, adherence to statutory timeframes, disclosure log practices, and compliance with the Information Publication Scheme, with a view to enhancing transparency and accountability across government. It will progress complaint investigations and undertake monitoring activities, using data-driven insights to identify systemic underperformance across agencies. In relation to rights preservation in new and emerging technologies, the OAIC will actively protect privacy and information access rights in high-impact technological contexts. The OAIC will also scrutinise advertising technology, such as pixel tracking, and practices involving the excessive collection and retention of personal information. This will include regulatory attention on the rental and property sector, credit reporting, and data brokerage practices.

This restructuring is intended to bolster the OAIC’s capacity to address the increasing complexity and volume of privacy and information access matters. The OAIC’s Corporate Plan for 2025–26 outlines the agency’s strategic priorities and key activities aimed at promoting and upholding privacy and information access rights in Australia.117 The sweep was designed to encourage entities to reflect on the robustness of their privacy practices and ensure they are meeting their statutory obligations.115 The sweep, announced on 9 December 2025, marked a significant step in the OAIC’s proactive enforcement strategy, aiming to ensure that entities meet the requirements of the Privacy Act and provide clear, transparent privacy policies https://cognifyo.com/articles/understanding-pcr-mouth-swab-testing/ to individuals. The OAIC also contributed to the development of the Australian Government’s AI Ethics Principles, released in 2019 by the Department of Industry, Science and Resources. In collaboration with the Australian Cyber Security Centre, the OAIC also released a joint statement on responsible AI use (2023), which reinforces the importance of robust security and de-identification practices when using personal data in AI training and inference processes.

Your weekly news podcast for cybersecurity pros

So, GDPR compliance impacts organizations around the world, not just those based in the EU. Nyman Gibson Miralis has earned a range of awards and accolades, reflecting https://mamemame.info/practical-and-helpful-tips-14/ its status as a leading criminal defence law firm. Its presence in litigation involves the initiation of cases of public significance that scrutinise the impact of crime commission powers on foundational tenets of criminal law, such as the right to a fair trial and protection against self-incrimination. In crime commissions and other coercive tribunals, Nyman Gibson Miralis participates in key Australian cases exploring the powers of crime commissions in relation to asset forfeiture and proceeds of crime. In general and serious crime, Nyman Gibson Miralis has navigated some of Australia’s most intricate defence cases.

In collaboration with its international partners, the firm has advised on investigations involving the US, Canada, the UK, the EU, China, Hong Kong, Singapore, Taiwan, Macao, Vietnam, Cambodia, Russia, Mexico, South Korea, the British Virgin Islands, New Zealand and South Africa. Nyman Gibson Miralis is an international criminal defence law firm based in Sydney, Australia. Phillip has completed a Bachelor of Laws degree at the University of Technology Sydney and has previously worked in the area of general crime. Domestically, Jack has advised on a range of criminal issues and investigations, including white-collar crime, fraud, sanctions, INTERPOL, extraditions and national security. Dennis specialises in international criminal law, with a focus on complex multi-jurisdictional investigations and criminal prosecutions. Dennis Miralis is a leading Australian defence lawyer and partner at Nyman Gibson Miralis.

While the Act does not specifically regulate automated decision-making, several provisions – particularly within the APPs – are relevant to the use of personal data in such systems. It is generally expected that an APP entity will enter into an enforceable contractual arrangement with an overseas recipient that will enforce and require the recipient to govern the personal information in accordance with the APPs.104 The OAIC has stated that the ‘requirement in APP 8.1 to ensure that an overseas recipient does not breach the APPs is qualified by a reasonable steps test’. On disclosure of personal data to foreign law enforcement and governmental bodies, the OAIC has broadly issued guidance to APP entities on the reasonable steps to ensure an overseas recipient does not breach any APPs.103

This principle ensures that any use of personal data for automated decision-making must align with the original purpose of collection or fall within a permitted exception. It limits organisations to using or disclosing personal information only for the primary purpose for which it was collected, unless an exception applies. It requires entities to inform individuals at or before the time of collection (or as soon as practicable thereafter) about the purpose for which their information is being collected, including if it will be used in automated decision-making processes.

• These solutions automate the detection of sensitive or personal data, often using pattern recognition and machine learning to classify information at scale.
• IAM systems manage processes for user authentication, authorization, and role-based access, ensuring that employees, contractors, and partners only access data necessary for their roles.
• Adoption of strong encryption mitigates the impact of breaches, limits the liability of lost data, and demonstrates due diligence to auditors.
• Modern solutions offer continuous or scheduled backups with features for deduplication, encryption, and quick restores at scale.
• Identity and Access Management (IAM) solutions control who can access information and resources within an organization’s systems.
• Data discovery platforms integrate with databases, file shares, and SaaS applications, providing dashboards to monitor data flows and assess exposure.

Data Protection Strategy

• CCPA applies to for-profit organizations that do business in California and meet certain revenue or data volume thresholds.
• The standard mandates technical controls like encryption, network segmentation, and regular vulnerability assessments.
• Maintaining compliance requires continuous employee training, risk assessment, and updating of security controls as healthcare threats and technologies evolve.
• CCPA enforces transparency, requiring businesses to update privacy notices and provide clear channels for consumer requests.
• While every organization’s approach will have unique features, the considerations above can help you create, review and maintain a data protection program that supports security and benefits your business operations.

In Australia, while there is no AI-specific legislation, the OAIC has provided important guidance on the use of AI, particularly in relation to the handling of personal information under the Privacy Act and the APPs.106 19.2 What guidance (if any) has/have the data protection authority(ies) issued in relation to the processing of personal data in connection with artificial intelligence? As a result, entities deploying AI systems that process personal data must ensure compliance with the APPs to mitigate legal and regulatory risk.