WHAT WE DO

Privacy & Data Governance | Privacy Advisory | Cyber Security Incident Response | Cyber Claims Management | Commercial Legal Support | Governance & AI Governance

Privacy & Data Governance

Supporting organisations to manage privacy, data and trust.

Privacy is core to governance, customer trust and organisational risk. Not just a legal obligation. As regulation evolves and businesses collect, use and share more information, organisations need advice that supports both compliance and commercial outcomes.

We advise businesses across Australia, New Zealand and the UK on privacy compliance, data governance, cross-border data transfers, and the privacy implications of emerging technologies, including AI.

We combine legal expertise with commercial insight to help organisations build privacy frameworks that are practical, proportionate, and aligned to the way they actually operate.

Privacy Advisory

Protect your business with commercial advice on evolving privacy obligations, so you can operate with confidence and trust. Services include:

  • General privacy advice

  • Reviewing and drafting privacy policies

  • Data transfer advice and implementation

  • SOCI advice and compliance

  • Privacy and data protection frameworks (APPs, IPPs, GDPR, and equivalent regimes)

  • Guidance on privacy access requests and complaints

Cybersecurity Incident Response

Cyber incidents move fast, and the legal and regulatory clock starts the moment you become aware of one. We advise organisations through the full lifecycle of a cybersecurity incident, from initial triage through to regulatory notification and remediation, with the commercial judgement to know what actually matters in the first 48 hours.

Our advice covers:

  • Initial incident triage and legal risk assessment

  • Coordinating with forensic and technical response teams

  • Assessing mandatory data breach notification obligations (including under the Privacy Act 1988 (Cth) Notifiable Data Breaches scheme, and equivalent regimes in New Zealand and the UK)

  • Advising on regulator and affected-individual notification strategy and timing

  • Reviewing incident communications for legal exposure

  • Post-incident remediation, including uplift to privacy and security frameworks to reduce recurrence

We work directly with organisations across Australia, New Zealand and the UK, drawing on hands-on experience managing live incidents, including unauthorised access matters and their associated notification obligations, in addition to advisory and governance work in privacy and data protection.

Clear, direct advice from someone who has actually run these matters, not a hand-off to a call centre, a junior team or an inexperienced lawyer. 

Cyber Claims Management

We also support insurers with cyber claims management and incident and breach response. In incident and breach response matters, Johnny Chal.Legal can:

  • Provide specialist legal oversight on breach matters

  • Establish and maintain legal professional privilege

  • Manage legal assessment of privacy, regulatory, contractual, and liability exposures

  • Advise on mandatory notification obligations (OAIC, and equivalent international regimes)

  • Draft regulatory notifications and sensitive communications

  • Oversee legal aspects of forensic, ransomware, and negotiation pathways

  • Support insurers with coverage, defensibility, and settlement strategy

Commercial
LEGAL Support 

Whether you're an in-house legal team looking for additional capacity or specialist expertise, or a business leader navigating commercial challenges, we provide practical legal support that adapts to the way you work.

From day-to-day commercial matters to strategic projects and embedded legal support, our flexible, fixed-fee model gives you access to experienced commercial legal expertise, without the overhead of a traditional firm.

 We advise across commercial contracting, technology and AI, privacy and data, governance, and regulatory compliance and risk, combining legal expertise with commercial thinking to help you make confident decisions, manage risk, and achieve better business outcomes.

GOVERNANCE

Helping organisations make better decisions with clearer accountability.

Governance is no longer just about meeting regulatory obligations. Organisations today are navigating emerging technologies, tighter regulation, and sharper stakeholder scrutiny.

When governance fundamentals aren't managed well, the impact is immediate: decision-making slows, actions fall through the cracks, and risk increases. With legal expertise and commercial judgement, we help organisations strengthen governance, support effective decision-making, and confidently meet their regulatory obligations.

We work with boards, executives, company secretaries, and in-house legal teams across corporate governance, regulatory compliance, reporting, AI, and board education.

AI GOVERNANCE

Working with boards, risk and compliance, and legal teams, we help embed practical AI governance guardrails for responsible AI adoption and defensible decision-making. Services include review and/or development of:

  • AI governance frameworks, policy and process maps

  • AI Impact Assessment reports and risk registers

  • Governance implementation plans and action logs