Train one person or your whole team

Module 2 is $149 per person. For complete coverage, take both modules for $249 per person, or $699 for a team of up to 10. All prices include GST. Need more than 10 places, or part of a larger practice, group or association? Contact us about tailored licensing.

Enrol here to start

About Module 2

Module 2: On the file is the second of two one-hour modules in Where Privacy Law Meets AML: Essentials for Property Practices. Module 1 explains why both regimes now apply to your practice. Module 2 shows what they mean when a real matter is in front of you.

This is where the two regimes stop agreeing. A client asks for a copy of their file while a suspicious matter report is on foot. Record-keeping rules say keep it; APP 11.2 says destroy what you no longer need. A staff member realises on Monday morning that Thursday’s email went to the wrong address. Module 2 works through each of these, and finishes with the privacy documents the OAIC expects a reporting entity to hold.

Module 2 opens with a short recap of the key terms, so it works on its own. You will get more from it if you complete Module 1 first.

Module length: about one hour across five chapters, including the short quizzes.

Access period: 28 days from enrolment for the module.

Certificate: issued when you pass the short quizzes.

For group enrolments beyond 10 staff, multi-practice or association licensing, contact us to discuss your needs.

Earn one CPD unit

This module covers content relevant to the Practice Management and Business Skills, and Ethics and Professional Responsibility competency areas. Legal practitioners may be able to claim 1 CPD unit, allocated according to the content and the CPD rules in their jurisdiction. Practitioners are responsible for confirming whether this activity meets their requirements. Not available for CPD in Western Australia. Conveyancers and other professionals should check with their regulator or professional body.

Click here for mandatory CPD requirements for lawyers in your jurisdiction (Australia)

Knowing the rule is the easy part

Your team can understand both regimes and still come unstuck. The pressure points are specific, they arrive without warning, and they turn up on ordinary files.

  • A client asks for their file while a suspicious matter report is on foot. Handling the request the usual way risks tipping off; refusing it the usual way risks a privacy complaint

  • AML/CTF record-keeping tells you to keep it. APP 11.2 tells you to destroy or de-identify what you no longer need. Both apply to the same file, on different clocks

  • Payment redirection fraud targets property settlements, and the money usually moves well before anyone notices

  • Sending personal information to the wrong recipient is consistently one of the leading causes of human error breaches reported to the OAIC. It takes a moment of distraction, not a hacker.

  • The OAIC’s August 2026 privacy guidance for AML/CTF reporting entities comes with a checklist, and most items on it are answered by a written document your practice either holds or does not

What you will learn in Module 2

This module works through the decisions staff actually have to make, using a case study that runs through both modules: a staff member at a four-person conveyancing practice, and a settlement that goes wrong.

  • Where AML and privacy obligations pull against each other on a live matter, including access requests and tipping off

  • Suspicious matter reports and the secrecy rules, and what they mean for a client’s privacy rights over their own file

  • Record-keeping under two clocks: what the law requires you to keep, and what you should be destroying

  • How to recognise a data breach, who to notify and how quickly

  • Payment redirection fraud in property settlements, and what to do in the first hour

  • For solicitors: a short update on the 2026 changes to the solicitors’ conduct rules (Rules 8, 12 and 13), and where they meet AML/CTF and privacy.

  • The privacy documents the OAIC expects you to hold, where each one lives, and who is responsible for it

Module 2 at a glance

  • Five concise chapters you can work through at your own pace

  • Approximately one hour of video content and short quizzes

  • Chapter 1: On the file. Chapter 2: SMRs and record-keeping. Chapter 3: Managing a data breach. Chapter 4: The privacy documents your practice needs. Chapter 5: Summary and additional resources

  • Suitable for all staff. Opens with a recap of the key terms, so it works on its own

  • Pass the short quizzes to receive your Module 2 certificate

New to this? Start with Module 1

Module 2 assumes you know what a designated service is, why the Privacy Act now reaches your practice, and what counts as personal information. Module 1: Legal Foundations covers all three in an hour, and suits new starters and support staff. Take both modules for $249 per person, or $699 for a team of up to 10.

See Module 1

Staff training is no longer optional.

Under the Privacy Act, “reasonable steps” to protect personal information now extend to organisational measures, including training your people. Under the AML/CTF regime, your practice must also have an employee due diligence and training program in place. This module helps your practice to meet both obligations through accessible, practical training.

Complete your compliance: pair Module 2 with the Toolkit

Chapter 4 tells you which documents you need. The Toolkit gives you them.

Module 2, Chapter 4 sets out the privacy documents the OAIC expects a reporting entity to hold, and where each one lives. The AML Privacy Toolkit for Property Practices gives you the documents themselves: ten templates and guides, including privacy policies, procedures, a data breach response plan and registers, ready to adapt to your practice. They are drafted by a specialist cyber and privacy lawyer for property practices. The course trains your people ($149 per module, $249 for both). The Toolkit gives you the paperwork ($350 incl. GST for a single-practice licence). Together, they cover the two things regulators look for first: documented procedures and trained staff.
Explore the AML Privacy Toolkit

What practices say about training with Law & Cyber

  • “It's great that CPD is not just about the law anymore but more about how current events affect practice.” (Cyber Risk for Law Firms participants)

  • “…all lawyers [should] have to do this as part of renewing practising certificate.” (Cyber Risk for Law Firms participants)

  • “As a member of support staff, it was an excellent course and should be mandatory for all law firm employees.” (Cyber Risk for Law Firms participants)

"As lawyers we need to understand the risks and impacts involved in cyberattacks both for our own cyber security and that of our clients. This course has provided us with practical, relatable and valuable information to enhance the knowledge of both our professional and support teams. We required every member of our teams nationwide complete this excellent course."

Geoffrey Connellan – National Managing Partner, Moray & Agnew Lawyers (Testimonial for our course Cyber Risk for Law Firms)

Your Instructor

Simone Herbert-Lowe, Founder and Principal, Law & Cyber

Simone is the founder and principal of Law & Cyber, a legal consultancy specialising in cyber risk, data privacy, AML/CTF compliance and technology law. She has more than 30 years of legal experience, including 20 years in professional responsibility at a leading professional indemnity insurer for law firms, where she handled more than 2,000 professional indemnity notifications. She is a former partner in Clyde & Co’s Cyber, Media and Technology practice. Simone writes for the Law Society of NSW Journal and is a peer-reviewed IEEE author. She won Innovator of the Year at the 2022 Lawyers Weekly Women in Law Awards. She knows from experience where property practices get caught out, and this course is built around those risks.

Course curriculum

  • 1

    Chapter 01: On the file

    • Learning Outcome Chapter 01

    • On the file
  • 2

    Chapter 02: SMRs and record-keeping

    • Learning Outcome Chapter 02

    • SMRs and record-keeping

    • Knowledge check
  • 3

    Chapter 03: Managing a data breach

    • Learning Outcome Chapter 03

    • Managing a data breach

    • Knowledge check
  • 4

    Chapter 04: The privacy documents your practice needs

    • Learning Outcome Chapter 04
  • 5

    Chapter 05: Summary and additional resources

    • Learning Outcome Chapter 05

    • Course summary

    • Two minute survey: help us provide the education that property practices need

    • Helpful Resources from the Australian Cyber Security Centre
  • 6

    About Law & Cyber

    • Author and Presenter

    • Our Education Portfolio

    • Stay in the loop