Privacy Policy

This Privacy Policy explains how Blackwell Short (“we”, “us” or “the firm”) collect, hold, use and disclose personal information, including through our website at blackwellshort.com.au. 

​

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). From 1 July 2026, as a legal practice providing certain “designated services”, we are also a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act), and this Policy reflects the additional collection, verification, reporting and record-keeping obligations that follow from that status.
 

What personal information we collect

The personal information we collect depends on the nature of our relationship with you. It may include:

• Identity and contact details – name, date of birth, address, phone number and email address.

• Engagement information – details relevant to the matter you have instructed us on, including financial, property, corporate or family information.

• Website usage data – browser type and version, operating system, pages viewed, access times and referring website address, collected automatically when you visit our site.

• Account credentials – a username and password if you register for client portal or support features, and information you provide to recover a lost password.
   

Where we provide a designated service under the AML/CTF Act (for example, assisting with the sale or purchase of a business, managing client funds, or acting in company or trust formation), we are required to conduct Customer Due Diligence (CDD). This means we must additionally collect and verify:

• Government-issued identification (such as a driver licence or passport) and, where relevant, proof of address.

• Information about beneficial ownership and control of any corporate, trust or partnership client.

• Information to determine whether you, or an associate, are a politically exposed person (PEP), and to screen against applicable sanctions lists.

• The source of funds or source of wealth involved in a transaction, where our risk assessment requires this.

We collect only what is reasonably necessary for the purpose of the engagement, our professional obligations, and our AML/CTF obligations.
 

How we collect personal information

We collect personal information directly from you – in person, by phone, email or through our website – and, where necessary for identity verification or CDD, from independent sources such as electronic verification providers, government databases, publicly available registers (including ASIC and land title records) and, where relevant, other professional advisers acting for you. We will generally tell you, or it will be apparent from the circumstances, when we collect information from a third-party source.

Why we collect, hold, use and disclose your information

We use personal information to:

• Provide legal services and manage your matter, including billing and file administration.

• Verify your identity and, where applicable, the identity of beneficial owners, before providing a designated service, and to conduct ongoing monitoring of the business relationship.

• Assess and mitigate money laundering, terrorism financing and proliferation financing risk, and meet our AML/CTF program obligations.

• Comply with reporting obligations to AUSTRAC, including threshold transaction reports and, where our professional judgment requires it, suspicious matter reports.

• Comply with other legal and regulatory obligations, including those under the Legal Profession Uniform Law and orders of a court or tribunal.

• Understand website usage, improve our site, and communicate with you about our services.
   

Important note on suspicious matter reporting: section 123 of the AML/CTF Act makes it a criminal offence (the “tipping-off” offence) for us to disclose to you, or to any other person, that a suspicious matter report has been made or is proposed to be made, or other information from which this could reasonably be inferred. This Policy, and our engagement with you generally, is subject to that legal restriction, and it may limit what we are able to tell you in response to an access request under the heading below.
 

From time to time we may use information for a new purpose not previously disclosed here. If our practices change, we will update this Policy and the change will apply to information collected from that point (or earlier, if we are required by law to apply it retrospectively).
 

Disclosure of your information

We may disclose personal information to:

• AUSTRAC, law enforcement and other regulators, where required or authorised by law, including under the AML/CTF Act.

• Independent identity verification and screening providers engaged to conduct CDD, PEP and sanctions checks on our behalf.

• Barristers, expert witnesses, other law practices, financial institutions and other parties reasonably necessary to progress your matter.

• Service providers who support our practice (such as IT, document management and payment processing providers), bound by confidentiality obligations.

• Professional indemnity insurers, costs consultants or our regulator, where necessary.
   

We take reasonable steps to ensure any organisation we disclose information to is bound by confidentiality and privacy obligations equivalent to this Policy. We do not disclose personal information overseas other than where a service provider's infrastructure requires it, and in that case we take reasonable steps to ensure the overseas recipient does not breach the APPs.

Data quality and security

We take reasonable steps to ensure personal information we hold is accurate, complete and up to date, and to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. This includes physical, electronic and procedural safeguards, and restricting access to personal information to personnel who need it to perform their role.

 

Record retention

Where information is collected in connection with a designated service, the AML/CTF Act requires us to retain CDD records, transaction records and related documents for at least seven years after the relevant transaction or the end of the business relationship (whichever is later). Other client file information is retained in accordance with our standard file retention practices and any applicable professional conduct rules.
 

Accessing and correcting your information

You may request access to, or correction of, the personal information we hold about you, subject to exceptions permitted by law (for example, where access would reveal that a suspicious matter report has been made, or would prejudice an investigation). Requests should be made in writing to the contact details below. We may need to verify your identity before actioning a request, and we may charge a reasonable fee for giving access, but not for making the request itself.
 

Changes to this Policy

We may amend this Privacy Policy from time to time, including to reflect changes in the law or our AML/CTF obligations. The current version will always be available on our website and will show the date it was last updated.
 

Contacting us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us during business hours, Monday to Friday.