By Talk to a Lawyer · Published 19 September 2026 · 4 minute read
Technology and privacy enquiries often combine a commercial system with questions about information: what is collected, who can access it, where it goes and what happens when the service ends. Describe the actual workflow rather than asking only for a generic privacy policy. Advice is more useful when the lawyer can see the product, suppliers, users and decisions the organisation needs to make.
Read. Prepare. Find an office.
Use this guide to organise your questions, then confirm the provider’s experience, availability and first-stage fee.
Find technology & privacy providers →Map information and contractual relationships
List the kinds of information involved, the people it relates to and the systems or service providers handling it. Identify hosting, support, analytics, integrations and overseas access where known. Mark uncertainties for investigation. A policy drafted without understanding these flows may not match the service. Ask what factual input the legal review needs from technical and operational staff.
Separate routine compliance from an incident
Explain whether you are launching a product, negotiating a technology contract, handling a privacy complaint or responding to a suspected data incident. If something has happened, preserve the chronology and involve the appropriate technical team promptly. Ask who will assess legal obligations and communications; this guide cannot determine whether notification or another response is required in your circumstances.
Review the whole service lifecycle
For a software or outsourcing agreement, ask about access, service levels, subcontractors, security responsibilities, data return, deletion and exit assistance. Clarify ownership and licences for custom work. A privacy question may coexist with intellectual-property, consumer or employment issues. Define whether the engagement covers the contract, policy, complaint response or a coordinated review of several workstreams.
Describe the data flow and technology dependency
For a privacy or technology review, show where information comes from, who can access it, where it goes and which supplier operates each stage. Include the real service workflow, not only the privacy policy. A contract may promise security or deletion without explaining how the product supports it. Ask the adviser to identify the legal questions and work with the appropriate technical team on implementation. If an incident has occurred, record confirmed facts separately from assumptions and ask about immediate obligations before publishing a speculative account.
Compare the scope and cost of advice
Compare advisers against the commercial decision you need to make. Give each office the same transaction stage, documents and objective, then ask for a first-stage deliverable. A review, a negotiation and ongoing business advice are different services. Record which financial assumptions need your accountant's input and who will coordinate any specialist work before a commitment is made.
- Review and advice
- Ask for the issues identified, their practical effect and the decisions you must make. Confirm whether written advice or a marked-up document is included.
- Drafting and negotiation
- Ask who communicates with the other party, how revisions are priced and what happens if the deal changes materially during the work.
- Completion or implementation
- Confirm responsibility for approvals, signing, records and follow-up tasks. Ask which registrations, searches or external professional costs sit outside the legal fee.
Read the guide to consultation fees and written quotes, or use the provider comparison worksheet.
Illustrative situation · not a client result
What a focused enquiry looks like
A business adds an overseas support provider to its booking system. It asks the lawyer to review the supplier contract and information flows together, including access and exit arrangements, rather than changing only its website notice.
Your preparation checklist
Gather what you already have. Mark missing records and uncertain dates rather than guessing; ask the office what it needs before sending sensitive documents.
0 of 4 gathered · ticks reset when you leave this page.
A preparation aid, not confirmation that a legal requirement is complete.
A first enquiry you can adapt
We use [service or system] to handle [type of information]. We need [contract advice, privacy review or incident-response advice] before [date]. I can provide the data flow and supplier documents. Can you identify the legal scope and any technical input required?
Replace the bracketed details with accurate information. Keep the first message brief and confirm a secure channel for the full records.
Common questions about technology & privacy
Is a copied privacy policy sufficient?
Ask whether it reflects the organisation's actual practices and applicable obligations. A document cannot substitute for understanding how information is handled.
Where can an individual start with a privacy complaint?
The OAIC publishes complaint guidance. Check the relevant process and ask an adviser about the organisation, issue and any other complaint avenues.
Further reading and scope
OAIC: lodging a privacy complaint
Australia; complaints within the OAIC's jurisdiction.
This is general preparation information, not an assessment of your legal position. Requirements, dates and available remedies depend on the facts and jurisdiction. The linked resource has the scope described above; it does not verify an individual provider or this guide.