The starting point is the service your customers actually buy. Explain the sales and delivery process before deciding which templates, schedules or privacy documents are needed.
Describe the actual service
Explain what the product does, who uses it, how it is sold and whether you provide implementation, support or managed services. Include enterprise requirements that differ from standard subscriptions.
Map the relationships
Identify customers, end users, suppliers, integrators and other platform participants. Collect existing terms, service commitments and vendor arrangements.
Explain data and IP flows
Describe the information handled, relevant service providers, ownership of software and content, and third-party dependencies. The factual picture helps identify what requires further review.
Connect the documents
Consider the relationship between customer terms, the MSA, statements of work, service schedules, privacy documentation and internal processes. The aim is a coherent framework matched to delivery.
Separate legal and technical work
Identify technical security, testing, incident response, foreign-law and sector-specific questions early. These require separate expertise or express scope; a terms-and-privacy project should not imply that those tasks are included.
A useful starting brief
- A short explanation of the product, customers and markets.
- The sign-up or contracting process and current customer terms.
- An outline of service delivery, data flows and key providers.
- Known enterprise requirements and technical commitments.
Connect privacy wording with actual handling
For businesses that are APP entities under the Privacy Act 1988 (Cth), APP 5 addresses notification when personal information is collected, while APP 11 addresses its security and retention. The OAIC’s guidance provides useful context. The practical starting point is a factual map of collection, providers, access, storage and deletion, so the documents can be considered against actual operations. Whether the Act applies needs its own assessment.
Sources checked 6 October 2026. Regulator and government guidance provides context; it is not advice on your matter.
This guide is a practical preparation aid. The applicable law, documents and facts need to be assessed for your circumstances. It does not determine the scope of an engagement.