With the prevalence of cyber attacks are on the rise, ensuring that your organisation's data and customer information protected has become a critical aspect of standard business operations. This article explores when you need privacy policy and the detail that should be included.

In a rapidly developing digital world where cyberattacks are commonplace, data protection and privacy policies are becoming increasingly important. Many organisations holding highly sensitive information, such as Charities and Not-for-Profits ('NFPs'), must now consider whether they require a privacy policy and, if so, what should be included in such policy.

When do you need a privacy policy?

If your charity or NFP meets the definition of an Australian Privacy Principles ('APP') entity under the Privacy Act 1988 (Cth) ('the Act'), then it requires a privacy policy.

An APP entity is generally either an agency or organisation. This includes:

partnerships
body corporates
individuals
any other unincorporated association, or
a trust.

Agencies and organisations that do not fall under the APP entity classification include:

registered political parties
small business operators (an annual turnover of $3,000,000 or less in the preceding financial year), and
State or Territory authorities, agencies, or a prescribed instrumentality of a State or Territory.

Even if you are not legally obliged to have a privacy policy, it is still beneficial to have one in place. Many people like to know how organisations utilise their personal information, and what steps they have in place to protect such information.

Recent Changes

There have been recent changes surrounding NFPs and Charities, and the use of private information. Amendments to the Act include introducing the Notifiable Data Breach ('NDB') scheme, which commenced on 22 February 2018.

If your organisation is currently required to secure personal information under the Act (as above), then it will need to comply with the NDB scheme. The NDB scheme applies to data breaches of personal information likely to result in serious harm to individuals affected. In short, you should consider the following three questions when assessing a data breach:

Has there been unauthorised access to or unauthorised disclosure of personal information?
Is this likely to result in serious harm to one or more individuals?
Were you unable to prevent the likely risk of serious harm with any remedial action?

If you answered “yes” to all of the above, then a notifiable data breach has occurred.

If a notifiable data breach has occurred, you are required to notify the affected individual(s) and the Office of the Australian Information Commissioner. If you fail to comply with the NDB scheme, then significant legal penalties of up to $1.8 million may apply.

What should be included in a privacy policy?

Your privacy policy should inform people as to how your Charity or NFP protects and safeguards its data. To ensure you comply with the NDB scheme, you should also outline how and when individuals are to be notified in the event of a data breach.

Other information to be addressed in your privacy policy should include:

how you identify possible risks, and
what is done with information that is no longer required.

People should also be informed of:

how they can access their data
who else can access their data, and
how you handle questions/complaints about the handling of personal information.

How can Sharrock Pitman Legal help?

We can assist Charities and NFPs to implement necessary privacy policies such as to mitigate legal and financial risk, ensuring your organisation is protected in a pragmatic and pro-active way. If you have any queries, please contact us on 1300 205 506 or alternatively complete the form below.

‍

The information contained in this article is intended to be of a general nature only and should not be relied upon as legal advice. Any legal matters should be discussed specifically with one of our lawyers.

‍

Liability limited by a scheme approved under Professional Standards Legislation.

Written by a member of our Legal Team

For further information contact

Mitchell Zadow

Mitchell is the Managing Principal of our law practice.

He is an Accredited Specialist in Commercial Law (accredited by the Law Institute of Victoria). He also deals with areas of Employment Law, Wills & Estate Planning and Probate. For further information, contact Mitchell on his direct line (03) 8561 3318.

ACNC Governance Standards for Charities

Leaving a Gift to a Charity

Important changes to Charity Fundraising

With the prevalence of cyber attacks are on the rise, ensuring that your organisation's data and customer information protected has become a critical aspect of standard business operations. This article explores when you need privacy policy and the detail that should be included.

However, in this article we will set out the factors that influence how long it will take to obtain a Grant of Probate and to administer an estate in Victoria.

The basics

First things first: what is a Grant of Probate? A Grant of Probate is effectively a document issued by the Supreme Court of Victoria which formally authorises an executor to manage the estate of a deceased person in accordance with their Will. Without Probate, the asset holders (say a bank or share registry) cannot be satisfied as who has the correct authority to receive the deceased's assets and may refuse to pay out.

Sometimes, for smaller estates or if assets are mostly jointly owned with a surviving spouse, asset holders might agree to release payment without requiring a Grant of Probate. This is usually on the basis that the person who receives payment promises to repay (or Indemnify) the asset holder if it turns out they paid to the wrong person.

If there is no Will, then you cannot obtain a Grant of Probate. Instead you obtain Letters of Administration. This is effectively the same, in terms of authorising someone to administer the estate, and would usually be obtained by the person who is the closest next-of-kin to the deceased.

“A Grant of Probate is effectively a document issued by the Supreme Court of Victoria which formally authorises an executor to manage the estate of a deceased person in accordance with their Will.”

Timeframes for Probate in Victoria

In order to obtain a Grant of Probate, the Supreme Court needs to be given information about the assets and liabilities of the estate, the deceased person, the witnesses to the Will, the executors and the Will itself. An advertisement of your intention to apply for Probate must also be published on the Supreme Court website for at least 14 days prior to any application being lodged.

Often, making enquires to obtain all the necessary information can take a number of weeks. Also, you will need the Death Certificate for the application for Grant of Probate and possibly for making proper enquires regarding the assets and liabilities. Waiting for the Death Certificate to issue can therefore add a few more weeks to the process. Overall, if you have your application for Grant of Probate lodged within 1 to 2 months from the date of death, you are making timely progress.

The Court itself usually does not take long to process the application (maybe another 1 to 2 weeks) and this is completed using the electronic Supreme Court filing system. This means you do not have to go to a Court hearing. The timeframe for processing applications for Letters of Administration is even less, given that there is no Will document for the Court to consider. There is also a general discretion for the Court to raise a 'Requisition' asking for more information before they review the application - this can sometimes delay matters.

“Overall, if you have your application for Grant of Probate lodged within 1 to 2 months from the date of death, you are making timely progress.”

So, here we are a few months after death and you finally have a Grant of Probate or Letters of Administration. It is important to remember that this is the start of the estate administration and not the end. For a very simple estate, you might only need a further month or so to cash the assets and pay them to the correct beneficiaries. However, it can often be more complex than that. Factors that determine the timeframe to administer the estate include:-

Some assets will take time to cash or transfer. For example, if selling a property, final settlement might be 60/90/120 days from the day of sale.
There is a 6 month period for challenges to be brought against the estate and executors must wait until this period expires before distributing the estate, if there is any risk that a disgruntled family member might come forward.
There might need to be final tax returns for the deceased or for the estate. Failing to wait for the ATO to process these could leave the executor personally liable for a tax bill.

You might need to advertise for creditors to come forward and wait for a period of months while this advertising timeframe expires. This protects the executor if they are unsure of all of the deceased's financial dealings and creditors.
It might not always be a good time to immediately cash estate assets. For example, the shares just took a nose-dive, do you still sell regardless of available price?

There is a general rule that executors have an 'executor's year' to complete the estate administration. This means that you should be aiming to have the estate finalised and distributed within 12 months from the date of death.

Liability limited by a scheme approved under Professional Standards Legislation.

Need help with Probate?

Our expert legal team is ready to take your call!

Mitchell is the Managing Principal of Sharrock Pitman Legal. He is an Accredited Specialist in Commercial Law (accredited by the Law Institute of Victoria). He also deals with areas of Employment Law, Wills & Estate Planning and Probate and can answer all your questions related to probate.

For further information, contact Mitchell on his direct line:

DIRECT LINE:

(03) 8561 3318

Free Property Law webinar -

Land Development and Joint Ventures

Why does a not-for-profit or charity need a privacy policy?

With the prevalence of cyber attacks are on the rise, ensuring that your organisation's data and customer information protected has become a critical aspect of standard business operations. This article explores when you need privacy policy and the detail that should be included.

When do you need a privacy policy?

Recent Changes

What should be included in a privacy policy?