30 Days to Compliance: The June 2025 Family Law Privacy Playbook

New Family Law changes from June 2025 tighten controls on accessing and sharing protected information in parenting and family violence matters. Here’s how a small community legal centre (and the lessons any small business handling sensitive client data can use) moved from risk to readiness in 30 days—avoiding court sanctions, strengthening trust, and building a culture of least‑privilege and accountability.

1) The Wake‑Up Call: June 2025 Raises the Stakes

“Unauthorised disclosure can attract court sanctions and regulatory action.” That line jolted our team into action. The reforms emphasise protecting sensitive material in family law proceedings, including how Courts will make parenting orders in the best interests of the child. The intent is clear: make systems more equitable, accountable and responsive for children, families and communities. For a resource‑stretched centre with remote staff and volunteers, we needed a plan that worked fast, worked anywhere, and worked every time.

Director: “If we share the wrong page, we risk a child’s safety—and our organisation.”

The message for small organisations: compliance is now an operational discipline, not an annual policy refresh.

2) The Audit: Finding Risk in Plain Sight

Day 0–1 revealed the hidden risks:

Email trails carrying unredacted reports to multiple recipients.
Practice management system (PMS) users with default full‑file access—no least‑privilege.
Ad‑hoc subpoena responses with inconsistent redaction and no chain of custody.
Remote workers improvising steps because SOPs lived in inboxes, not a shared knowledge base.

In short, there was no single source of truth. A mentor’s blunt advice rang true: “Document your business or get out.” We committed to documenting, standardising and enforcing the way sensitive information moves—end to end.

3) Rapid Privacy Impact Assessment (Days 1–5)

Scope, Map, Reduce Risk—Fast

Define scope: Parenting, family violence, child protection and safety‑related documents, recordings and notes.
Map data flows: Intake → PMS → evidence folder → counsel → court bundle; include email, messaging, and cloud storage.
Assess risks: Likelihood × impact (safety, legal, reputational, regulatory).
Select controls: Least‑privilege, role‑based access, need‑to‑know redaction, encryption, DLP, logging.
Record decisions & owners: Create an audit‑ready register with due dates and accountabilities.

This was guided by existing privacy principles and aligned with strengthened privacy expectations (including the intent behind reforms like the Privacy and Personal Information Protection Amendment Bill 2021 in NSW). We also reviewed government fact sheets on protecting sensitive information in family law proceedings to validate our control set.

4) Document or Bust: SOPs Remote Teams Can Follow (Days 6–12)

The Single Source of Truth

We built a living SOP hub with version control and read receipts. Each procedure was a one‑page, remote‑friendly checklist with screenshots and example scripts.

Information‑sharing protocol: Who can share, what can be shared, how to verify authority, and when to redline or withhold.
Subpoena triage: Verify scope and legitimacy; legal review before release; redaction standard; authorised approver sign‑off.
Redaction guide: Mask addresses, school names, contact details, safety‑critical notes and third‑party identifiers unless expressly required.
Incident response: Contain, escalate, notify, document—all time‑stamped.
Data minimisation: Collect only what’s necessary for the matter and retain only as long as required.

Ops Lead: “If a volunteer can’t follow it on their phone, it’s not an SOP—it’s a wish.”

Result: Remote workers followed instructions uniformly, reducing variance and mistakes.

5) Least‑Privilege in Practice Management Systems (Days 10–18)

Turn Controls Into Guardrails

Role‑based access: Default to least‑privilege; sensitive matters tagged with restricted groups; “break‑glass” emergency access with auto‑alerts.
Field‑level masking: Hide high‑risk fields by default; reveal only on approved roles.
MFA + device posture: Enforce multi‑factor authentication and deny access from unmanaged devices.
Immutable audit logs: Monitor open/export/print; weekly review of anomalies.
DLP & email rules: Auto‑flag attachments with sensitive terms; external send warnings; forced encryption.

Quick Wins

Disable bulk export for non‑admin roles.
Require supervisor sign‑off to share any document labelled “Protected”.
Create a secure “court bundle” workspace with templated redaction presets.

These changes made the compliant path the easy path.

6) Subpoena Response, Rebuilt (Days 12–20)

Defensible, Documented, Repeatable

Triage form: Log scope, due date, court/jurisdiction, and the requesting party.
Scope check: Confirm legal basis and narrow where appropriate.
Double authorisation: Legal + senior approver must sign off.
Standard redaction: Apply safety‑first rules; retain an unredacted master secured in restricted storage.
Chain of custody: Time‑stamp who packaged, who checked, and how it was delivered.
Template coversheet: Cite what’s included/excluded and why.

Paralegal: “Wait—do I send the whole file?” Supervisor: “No. Send only within scope, redacted to protect safety, and log each step.”

By codifying the process, we reduced disclosure risk while staying responsive to the court’s needs.

7) Training, Habits and the Win (Days 15–28)

Microlearning that Sticks

Four 30‑minute modules: information‑sharing rules, safe redaction, PMS permissions, subpoena workflow.
Scenario drills: “Forward or withhold?”, “What if a caller claims to be the other parent?”, “How to package a court bundle”.
Attestations: Staff e‑sign they understand; quiz scores tracked; re‑training auto‑scheduled on low scores.
Mantra: If it’s not documented, it didn’t happen.

Outcome by Day 28: 100% staff refreshed, permissions right‑sized, zero unapproved exports, and a clean audit trail. The main challenge—controlling access and sharing—was effectively resolved, with court‑ready processes and clear accountability.

8) The 30‑Day Checklist and Call to Action

Your Small‑Org Playbook

Run a rapid PIA: Map data, rate risks, choose controls, assign owners.
Install least‑privilege: Role‑based permissions, masking, MFA, logging.
Publish one‑page SOPs: Single source of truth that remote teams can follow.
Rebuild subpoena workflow: Scope, review, redaction, sign‑off, custody log.
Train and attest: 30‑minute modules, scenarios, and mandatory sign‑off.
Measure weekly: Access anomalies, export events, training completion, incident count.

The broader policy shift also touches financial/property aspects and other areas of the Family Law Act, but for small providers the immediate risk is mishandling protected information. Government fact sheets outline how to safeguard sensitive materials; sector bodies continue to push for more funding so services can implement these controls at scale. As the SPLA and ALRC reports note, chronic under‑funding is real—so advocate for investment while you harden your systems. Start today; 30 days is enough to change your risk profile—and your culture.

30 Days to Compliance: The June 2025 Family Law Privacy Playbook