Know where the sensitive data is, who can reach it, and what left

The assessment establishes which obligations genuinely apply to you, what you actually hold, and the gap between the two. It is deliberately done with your privacy officer rather than presented to them.

• Obligations scoped honestly. Which of the Privacy Act, sector regulation, contractual client requirements and internal policy genuinely bind you, since most organisations are told they need more than they do.
• Discovery across the real estate. Cloud stores, analytics platforms and the forgotten file shares, with anything that cannot be scanned listed rather than quietly excluded from the report.
• Effective access mapped. Who can currently reach each sensitive dataset including inherited and standing access, which is usually broader than anyone expects.
• Breach reconstruction tested. Whether existing audit retention would let you determine who accessed which records, checked against a real scenario rather than assumed.
• Residency verified, not assumed. Where data, metadata and logs physically sit, because metadata and log layers are the ones that quietly leave the country.
• Licence position costed first. What your existing entitlements already cover, since a technically correct design can be commercially unacceptable once the licences are priced.

Discovery first, because classification drives everything downstream. Policy comes after the taxonomy is agreed with the business, and enforcement comes after a period in audit mode.

• Classification before control. Scanning and classification established first, because a policy written before you know what you hold protects the wrong things.
• A small taxonomy the business agreed. Few enough labels that people apply them correctly, worded the way the business already describes its own information.
• Audit mode before enforcement. Policies run in report-only first so the noise is visible and tuned before anyone is blocked and starts requesting overrides.
• Access bound to one identity plane. Data permissions resolved against the workforce directory rather than local accounts, so a leaver loses access everywhere at once.
• Ownership recorded per data product. A named business owner and definition attached to each published asset, since a catalogue without owners is documentation rather than governance.
• Audit retention set by scenario. Log retention chosen against the breach assessment and dispute windows you actually face, not left on a platform default.

This domain is where data governance and identity meet. The recurring failure is a control that exists in configuration but has quietly lapsed in effect, so verification matters more than deployment.

• Least privilege proven by test. Access verified by querying as accounts at several permission levels, including one that should see nothing, rather than by reading a policy.
• Standing access removed. Privileged data and compliance roles moved to approved, time-bound elevation so permanent access to sensitive data is the exception.
• Access reviews on a cycle that runs. Recurring reviews with a named reviewer and an escalation path, because a review nobody completes is worse than none at all.
• Encryption keys with a documented owner. Customer-managed keys for governed stores and evidence repositories, with key access separated from the teams being audited.
• AI access governed explicitly. What assistants and agents may read treated as a data governance decision, since an assistant surfaces oversharing faster than any audit.
• Residency pinned deliberately. Data, metadata and log locations constrained on purpose, because aggregation and scanning layers can move content outside Australian regions by default.

Governance fails on adoption more than on technology. A label nobody applies and a review nobody completes both produce a record of control that is not real, which is more dangerous than an acknowledged gap.

• Taxonomy designed with the business. Workshops with the people who create the documents, because a taxonomy written by IT alone produces labels that go unused.
• Data owners actually appointed. Named individuals accepting ownership of specific data products, with the time commitment made explicit rather than assumed.
• Reviewers trained on the decision. Access reviewers shown how to judge whether access is still needed, so a review is a decision rather than a bulk approval.
• Policy tips explained before enforcement. Staff told what will be flagged and why ahead of enforcement, which reduces the override requests that hollow out a policy.
• Privacy officer inside the process. Involved from assessment rather than consulted at the end, since they own the obligation the technology is supposed to support.
• Evidence pack rehearsed. The audit or breach evidence process walked through once before it is needed for real, which is when the gaps become obvious.

Classification drifts as new repositories appear, access accumulates as people move, and platform naming in this area changes often enough to matter. Governance that is not maintained becomes governance on paper.

• Discovery re-run on a cycle. New repositories and stores found and classified as they appear, since the estate grows faster than any one-off project's scope.
• Access review completion tracked. Not just whether reviews ran, but whether reviewers made real decisions, with bulk approvals treated as a signal to investigate.
• Policy override rates watched. Frequent overrides mean the policy is mistuned rather than that staff are careless, and a hollowed-out policy is a false control.
• Residency re-verified after change. Checked again whenever a service, region or aggregation setting changes, because this is where drift is least visible.
• Platform naming and status tracked. Product renames, converged features and retirements assessed before they affect a documented control or a client-facing statement.
• Evidence pack kept current. Regenerated periodically so the assembly process is known to still work, rather than discovered to be broken during an audit.