Train one person or your whole team

Module 1 is $149 per person. For complete coverage, take both modules for $249 per person, or $699 for a team of up to 10. All prices include GST. Need more than 10 places, or part of a larger practice, group or association? Contact us about tailored licensing.

Enrol here to start

About Module 1

Module 1: Legal Foundations is the first of two one-hour modules in Where Privacy Law Meets AML: Essentials for Property Practices. It is built for every person who touches a property transaction, not just specialists. If your practice does any conveyancing or property work, these obligations apply to you, and this module explains them in clear, accessible language with no assumed knowledge of privacy law or AML/CTF.

Module 1 answers the question every property practice is asking: why does the Privacy Act now apply to us, and what does it cover? It traces the chain from the AML/CTF reforms through to the Privacy Act, identifies the personal and sensitive information your practice already holds, and works through the Australian Privacy Principles that matter most day to day. The AML/CTF material is there to explain the trigger and give you the vocabulary, not to train you as an AML officer.

Built for property lawyers, licensed conveyancers, general practices that handle property matters, and all administrative and support staff. Module 1 also works as a standalone introduction for new starters and support staff.

Module length: about one hour across five chapters, including short quizzes.

Access period: 28 days from enrolment for the module.

Certificate: issued when you pass the short quizzes.

What comes next: Module 2 (On the file) shows how these rules play out on a live client file. You can take one module or both. We recommend both.

For group enrolments beyond 10 staff, multi-practice or association licensing, contact us to discuss your needs.

Earn one CPD unit

This module covers content relevant to the Substantive Law, Practice Management and Business Skills, and Ethics and Professional Responsibility competency areas. Legal practitioners may be able to claim 1 CPD unit, allocated according to the content and the CPD rules in their jurisdiction. Practitioners are responsible for confirming whether this activity meets their requirements. Not available for CPD in Western Australia. Conveyancers and other professionals should check with their regulator or professional body.

Click here for mandatory CPD requirements for lawyers in your jurisdiction (Australia)

The deadline has passed. These obligations are live.

The Tranche 2 AML/CTF reforms commenced on 1 July 2026, one of the most significant changes to compliance obligations for Australian property practices in decades. If your practice handles property transactions, you are already subject to these rules. Module 1 explains what they are and why they reach your practice.

  • The small business exemption in the Privacy Act does not cover your AML/CTF activities. Your practice must comply for that information, regardless of turnover

  • In 2025, the Federal Court ordered the first civil penalty under the Privacy Act: $5.8 million, for failing to take reasonable steps to protect personal information and failing to properly assess and notify a data breach.

  • The Privacy Act now states that reasonable security steps include organisational measures as well as technical ones, and staff training is the obvious place to start

  • The new statutory tort for serious invasions of privacy applies to all organisations, regardless of size or revenue

  • AUSTRAC and the OAIC are both active regulators looking at the same client files, and a weakness under one regime can quickly become a problem under the other

What you will learn in Module 1

Module 1 explains why the Privacy Act reached your practice on 1 July 2026, what it protects, and what it asks of the people handling client files. The AML/CTF material is there to explain the trigger and give you the vocabulary. The teaching runs through a case study: a four-person conveyancing practice, and a settlement file that goes wrong in Module 2.

  • The chain that brought your practice inside the Privacy Act: providing a designated service makes you a reporting entity, and section 6E(1A) then applies the Act whatever your turnover

  • Enough AML/CTF vocabulary to follow the privacy analysis: designated services, reporting entities, customer due diligence, and how verification of identity differs from CDD

  • The five Australian Privacy Principles that matter most to a property practice: your privacy policy, your collection notice, use and disclosure, overseas storage, and security

  • What counts as personal and sensitive information, why identity documents sit at the higher-risk end, and why almost everything on a conveyancing file is now covered

  • What is now at stake: two regulators, a tiered penalty framework, the statutory tort for serious invasions of privacy, and the Notifiable Data Breaches scheme

  • For solicitors: a short update on the 2026 changes to the solicitors’ conduct rules (Rules 8, 12 and 13), and where they meet AML/CTF and privacy

Module 1 at a glance

  • Five concise chapters you can work through at your own pace

  • Approximately one hour of video content and short quizzes

  • Chapter 1: Course welcome. Chapter 2: AML/CTF key concepts. Chapter 3: Why privacy law now applies to your practice. Chapter 4: What “personal information” means. Chapter 5: What your practice collects and why

  • Suitable for all staff, with no assumed knowledge of privacy law or AML/CTF

  • Pass the short quizzes to receive your Module 1 certificate

Then take Module 2: On the file

Module 1 gives your team the rules. Module 2 shows what happens when those rules collide on a live matter: an access request while a suspicious matter report is on foot, a settlement pack emailed to the wrong person, and the privacy documents the OAIC expects your practice to hold. Take both modules for $249 per person, or $699 for a team of up to 10.

See Module 2

Staff training is no longer optional.

Under the Privacy Act, “reasonable steps” to protect personal information now extend to organisational measures, including training your people. Under the AML/CTF regime, your practice must also have an employee due diligence and training program in place. This module helps your practice to meet both obligations through accessible, practical training.

What practices say about training with Law & Cyber

  • “It's great that CPD is not just about the law anymore but more about how current events affect practice.”

  • “…all lawyers [should] have to do this as part of renewing practising certificate.”

  • “As a member of support staff, it was an excellent course and should be mandatory for all law firm employees.”

"As lawyers we need to understand the risks and impacts involved in cyberattacks both for our own cyber security and that of our clients. This course has provided us with practical, relatable and valuable information to enhance the knowledge of both our professional and support teams. We required every member of our teams nationwide complete this excellent course."

Geoffrey Connellan – National Managing Partner, Moray & Agnew Lawyers (Testimonial for our course Cyber Risk for Law Firms)

Your Instructor

Simone Herbert-Lowe, Founder and Principal, Law & Cyber

Simone is the founder and principal of Law & Cyber, a legal consultancy specialising in cyber risk, data privacy, AML/CTF compliance and technology law. She has more than 30 years of legal experience, including 20 years in professional responsibility at a leading professional indemnity insurer for law firms, where she handled more than 2,000 professional indemnity notifications. She is a former partner in Clyde & Co’s Cyber, Media and Technology practice. Simone writes for the Law Society of NSW Journal and is a peer-reviewed IEEE author. She won Innovator of the Year at the 2022 Lawyers Weekly Women in Law Awards. She knows from experience where property practices get caught out, and this course is built around those risks.

Course curriculum

  • 1

    Chapter 01: Course welcome

    • Learning Outcome Chapter 01

    • Using the course player

    • Legal Foundations
  • 2

    Chapter 02: AML/CTF key concepts

    • Learning Outcome Chapter 02

    • AML/CTF key concepts

    • For solicitors: the 2026 conduct rule changes

    • Knowledge check

    • Glossary
  • 3

    Chapter 03: Why privacy law now applies to your practice

    • Learning Outcome Chapter 03

    • Why privacy law now applies to your practice

    • A note on scope: what the law covers, and what your practice may choose
  • 4

    Chapter 04: What "personal information" means

    • Learning Outcome Chapter 04

    • What "personal information" means
  • 5

    Chapter 05: What your practice collects and why

    • Learning Outcome Chapter 05

    • What your practice collects and why

    • Knowledge check

Complete your compliance: pair the course with the Toolkit

The course trains your people. The Toolkit gives you the documents.

The AML Privacy Toolkit for Property Practices gives you ten templates and guides for the core privacy documents a reporting entity needs: privacy policies, procedures, a data breach response plan and registers, ready to adapt to your practice. They are drafted by a specialist cyber and privacy lawyer for property practices. The Toolkit is $350 (incl. GST) for a single-practice licence. Together, the course and the Toolkit cover the two things regulators look for first: documented procedures and trained staff.
Explore the AML Privacy Toolkit