Survey findings on cost, timing and operational change 8 min read
Australia's proposed privacy reforms will require significant, multi-year investment in data, technology, governance and business transformation, at a time when organisations are already managing competing regulatory priorities. To understand the expected impact and how the Government could smooth implementation, we surveyed leading legal, privacy and risk professionals across more than a dozen sectors. Although the reforms have not yet passed, over half of respondents said their organisation has begun preparing.
The takeaways
Privacy uplifts will compete for many of the same budgets, people and systems as other major programs, particularly AI, cyber and data transformations. Organisations that start early and take a cross-functional approach can build privacy requirements into transformations and avoid duplicating investment. Organisations that wait, or treat privacy reform as a standalone compliance effort, may pay more to achieve less.
Respondents emphasised their need for early, detailed regulatory guidance and adequate time for implementation. Without these, organisations cannot invest confidently or design changes that minimise harms effectively. One critical component to the reforms' success will be ensuring that the Office of the Australian Information Commissioner (OAIC) has sufficient resources to issue timely guidance.
About the survey
We wanted to know the likely operational impact of the privacy reforms across industries. We surveyed lawyers, privacy and risk professionals and executives across more than a dozen sectors, with most coming from financial services, retail, energy and technology. These are the decision-makers who will scope, fund and deliver the changes needed.
Who responded?
Implementation challenges
What’s standing in the way?
'Legacy technology and scale of system changes' was among the top barriers to implementation, chosen by 40% of respondents. Among organisations with annual revenue over $1 billion, that percentage rose to over 50%.
How prepared are organisations?
More than half of the respondents said their organisation has started preparing even though legislation has not yet passed. With an additional 10% having progressed beyond a preliminary assessment, performing tasks such as gap assessments.
How long will compliance take?
Overall, 38% of organisations say they would need 12-24 months to implement the changes. While 12% of respondents say they would need two years or more to implement the reforms, this rises to 29% among organisations with revenue above $1 billion. The findings point to a lengthy implementation program, particularly for larger organisations where the scale and complexity of change is greatest.
of all organisations need 12-24 months to implement the reforms
of organisations with under $1 billion in annual revenue need 24 months or more to implement the reforms
of organisations with over $1 billion in annual revenue need 24 months or more to implement the reforms
Where the work and money will go
Which reforms will have the greatest operational impact?
'Expanded definition of personal information' was most often named among the reforms with the biggest operational impact. This reform is also the most closely tied to data management: those who named it most often ranked data discovery, mapping and remediation as their largest cost.
How much will organisations spend?
There was significant variation in estimated costs of privacy reform. Thirty-three percent of larger organisations that were able to estimate the costs, expect implementation costs of $1 million or more with 6% of these larger organisations expecting implementation costs to exceed $2.5 million and some saying over $25 million. More than half of the largest organisations can't yet put a figure on costs. See what organisations your size expect to spend.
Find your headcount below to see what organisations your size expect to spend.
| Headcount | Median cost band* |
|---|---|
| Fewer than 250 | Under $250,000 |
| 250 to 999 | $250,000 to $500,000 |
| 1,000 to 2,499† | $500,000 to $1 million |
| 2,500 to 10,000+† | $1 million to $2.5 million |
* Respondents chose from preset cost bands, and median is based only on respondents who gave an estimate.
† Small groups (nine and 13 respondents); treat as indicative. One respondent who didn't know their headcount is excluded.
What will cost the most?
Respondents most often ranked 'Technology and system changes' as their biggest expense, just ahead of 'Data discovery, mapping and remediation.' Technology and systems also takes the longest time: more than half of those who ranked it first expect to need 18 months or more for compliance.
Below are the top results chosen out of eight categories.
Guidance and implementation support
When asked what would make implementation of privacy reforms easier, respondents' most popular first choice was early, detailed OAIC guidance.
Delivering early guidance may be challenging. The OAIC has far fewer staff than peer regulators and already has a full plate: supporting compliance with automated decision-making disclosure requirements that start 10 December, finalising the Children’s Online Privacy Code for registration by the same date, and helping businesses that became subject to anti-money laundering and counter-terrorism financing laws on 1 July understand their privacy obligations.
Companies may choose to scope their exposure now, work from the draft and adjust when the OAIC publishes.
What would make implementation easier?
| Top-ranked implementation support | Share |
|---|---|
| Detailed early OAIC guidance and practical examples | 42% |
| A longer implementation period | 38% |
| Staged commencement | 20% |
OAIC staffing vs peers
OAIC funding vs peers
Sector impacts
Where industries expect the greatest impact
Respondents differed on what parts of their business would be most affected. For financial services and energy, it was how long they keep data and how they dispose of it. For consumer, retail and media, it was how they collect data and obtain consent. See how your organisation compares to the rest of your sector.
In each sector, the parts of the business that would be most affected, are:
Note: Participants could select up to three reforms, so total does not add up to 100%
Next steps
Methodology
-
Allens conducted an online survey of nearly 100 senior legal, privacy, risk and executive decision-makers between 10 and 21 September 2026.