RemoteSMB1001 for law firms
Your clients trust you with their files. Now they want proof.
Since 1 July 2026, firms doing conveyancing, trust or company work are AML/CTF reporting entities, and small firms now carry Privacy Act obligations for that work. Clients, panels and insurers are asking how you protect what you hold. SMB1001 certification gives you one answer they can check online.
- Tranche 2 started
- 1 Jul 2026
- DSI matrix tier for client personal information
- Gold
What changed
AML/CTF brought the Privacy Act with it.
The small business exemption from the Privacy Act does not cover AML/CTF reporting entities for their AML/CTF work. For a lot of small firms, that was the first time Australian Privacy Principle 11 applied: take reasonable steps to protect the personal information you hold.
General information, not legal advice.
- 1 Jul 2026Tranche 2 startsLawyers and conveyancers providing designated services, such as property transactions, managing client money, or setting up companies and trusts, became AML/CTF reporting entities.
- 1 Jul 2026The Privacy Act followsSmall firms under the $3 million turnover threshold must now comply with the Privacy Act for anything they do in connection with their AML/CTF obligations.
- 29 Jul 2026AUSTRAC enrolment deadlineFirms providing designated services had to enrol with AUSTRAC by this date.
- NowShow your reasonable stepsClients, panels, insurers and regulators can all ask how you protect the identity records and client files you hold.
Reasonable steps
The OAIC's own examples, mapped to SMB1001.
The OAIC lists the kinds of steps it expects, scaled to the size of the business. Taking no steps is not reasonable. Most of them are SMB1001 controls already.
| OAIC example of a reasonable step | Where SMB1001 covers it | Control |
|---|---|---|
| Multi-factor authentication | MFA on email (Silver), then on every business app and social account (Gold) | From Silver 2.5.0.0 / 2.6.0.0 |
| Timely software updates | Automatic patching on every device (Bronze), servers patched (Silver) | From Bronze 1.4.0.0 / 1.6.0.1 |
| A data breach response plan | An incident response plan, and from 2027 a yearly practice run | From Gold 4.5.0.0 / 5.2.0.1 |
| Privacy terms with service providers | Confidentiality agreements (Silver), a supplier trust program (Diamond) | From Silver 4.1.0.1 / 4.9.0.1 |
| Destroy information you no longer need | Secure destruction of paper records and secure disposal of devices | From Gold 4.6.0.0 / 4.7.0.0 |
| Audit logs | Not a named SMB1001 control. We switch logging on and keep it, because you will need it after an incident. | Not in SMB1001 |
The OAIC also notes the AML/CTF Act no longer requires keeping full copies of identity documents for new clients. Destroy or de-identify them once you no longer need them. We can help you find where they live.
Which tier
For most firms, the answer is Gold.
DSI's Supplier Categorization Matrix puts any business holding personal or confidential information covered by privacy rules at Gold. Identity records, settlement details and client files all qualify. If a client, panel or insurer names a tier, that one wins.
The Gold control firms most often miss is multi-factor sign-in on every business app. That includes the practice management system, the trust account banking portal, PEXA and the firm's social media pages.
How we do it
Five steps, planned around your practice.
- Step 1We check how client files are protected today
Email, the document management system, trust account access, laptops and remote access. You see plainly what is covered and what is open.
- Step 2You get a priced plan for the right tier
We confirm the tier your clients, panels and insurer actually need, list each fix with its cost, and start nothing until you approve it.
- Step 3We lock down where attackers aim
Multi-factor sign-in on every account, endpoint protection on every computer, email that cannot be faked in your name, and backups you have seen restored.
- Step 4We write the policies with you
Access rules, an invoice and trust payment verification procedure, and a breach response plan that fits the Notifiable Data Breaches scheme. Written around how your firm works.
- Step 5Your principal signs, CyberCert certifies
Your principal attests through CyberCert. We keep the controls running and check everything again before you renew each year.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What firms ask us.
Do law firms have to get SMB1001?
No regulator requires SMB1001 by name. But the Privacy Act requires reasonable steps to protect personal information, and since 1 July 2026 that reaches small firms that are AML/CTF reporting entities. SMB1001 gives you a recognised, checkable way to show the steps you have taken.
What changed on 1 July 2026?
Lawyers and conveyancers who provide designated services, such as property transactions, managing client money, or setting up companies and trusts, became AUSTRAC reporting entities. They had to enrol with AUSTRAC by 29 July 2026, and small firms now have Privacy Act obligations for anything connected to their AML/CTF work.
Does the Privacy Act now cover everything a small firm holds?
Not automatically. For a small firm it covers handling connected to its AML/CTF obligations, such as customer due diligence and the records kept for it. Where the same information is also used for other work, the Act applies to that information too. In practice it is hard to separate, so most firms protect all client information to the same standard.
Which tier should our firm aim for?
By DSI's Supplier Categorization Matrix, a business holding personal or confidential information covered by privacy rules sits at Gold. If a client, panel or insurer names a tier, that one wins. Gold has 27 controls in SMB1001:2026 and 28 in SMB1001:2027.
Will this disrupt fee earners?
We plan changes around your practice, roll them out in stages and test with a small group first. The most visible change for staff is usually the extra sign-in step, which we set up with each person.
Are you certified yourselves?
Yes. Real Bytes holds SMB1001 Gold through CyberCert, so we have been through the same process we take your firm through.
Is this legal advice?
No. This page is general information about technology controls. Talk to your own legal or compliance adviser about your AML/CTF and privacy obligations.
Next step
Find out what your firm needs to fix.
Run the free Gold gap check, then talk to an engineer about what it found. Want the day to day IT side as well? See IT support for law firms.
Keep reading
- SMB1001 certification All five tiers, the tier finder, and how certification works.
- SMB1001 Gold certification What Gold adds, a readiness check and what changes in 2027.
- Every SMB1001 requirement All 39 controls for 2026 and 44 for 2027, searchable.
- Free SMB1001 gap check Pick your tier and score yourself on CyberCert's platform.
- SMB1001 in Brisbane Local certification support from engineers you can meet.
- IT support for law firms Day to day IT for Australian legal practices.
Checked 30 October 2026. General information, not legal advice. Sources: OAIC: privacy guidance for AML/CTF reporting entities, Legl: law firms and the 29 July AUSTRAC enrolment deadline, DSI: Supplier Categorization Matrix.