June 2025 Family Law Changes: A CLC Data-Handling Playbook

New family law settings taking effect from June 2025 raise the bar on how community legal centres (CLCs) collect, store and disclose client information. Here’s a practical playbook to protect clients, comply with the Privacy Act and the Family Law Act, and keep small teams running smoothly.

1) The situation: New compliance obligations plus data privacy and operational risk

This is both a new compliance obligation and a cyber/data privacy and operational risk scenario. Stronger court powers will restrict access to sensitive material, information-sharing frameworks with police and child protection are clearer, and scrutiny of inadvertent disclosure will increase. While the changes focus on financial and property aspects of relationship breakdown, they also affect other areas of the Family Law Act. For CLCs, this intersects with the Privacy Act 1988 (Cth) and APP 6, Family Law Act 1975 s 121 (publication restrictions), subpoena practice, triage, and safety planning.

2) The subpoena moment: where good intent meets high risk

Scenario: your duty lawyer receives a subpoena for case notes while the client has an active safety plan. Under the new settings, releasing unredacted addresses, school details, or third‑party identifiers could:

Breach court or non-publication orders (s 121 implications).
Elevate safety risks for the client and children.
Trigger privacy complaints and regulatory action.
Create reputational damage and operational burden for a small team already juggling conflict checks, duty lists, and limited secure storage.

From 10 June 2025, you can ask the Court to make an order to protect sensitive information from being used in family law proceedings—so the safest default is “minimum necessary” disclosure with strong redaction and clear authority checks.

3) Know the anchors: what changes and what already applies

Privacy Act 1988 (Cth) & APP 6: disclose only when permitted, and only what’s necessary for the purpose.
Family Law Act 1975 s 121: strict publication restrictions; inadvertent disclosures can amount to publication.
New court powers (June 2025): orders to protect sensitive information from being accessed or used in proceedings.
Information-sharing frameworks: clearer pathways with child protection and police—still require scope checks and proportionality.
Record-keeping and secure storage: audit trails, access control, and defensible decision-making are now business-critical.

4) Build your subpoena and disclosure triage checklist this week

Verify legal authority and scope: is the subpoena valid, current, correctly addressed, and specific?
Check for orders: review non-publication, protection orders, or court directions limiting disclosure.
Apply minimum-necessary disclosure: redact addresses, school details, identifiers, and third-party information not strictly required.
Document consent (where appropriate): confirm the client’s understanding; record decisions and rationale.
Assess safety risk: consult the safety plan; consider delays to seek protective orders if needed.
Senior approval: require sign-off from a principal or practice manager before release.
Create a defensible log: keep a checklist, redaction notes, and an audit record of what was shared, with whom, and why.

5) Document your business or get out: create a single source of truth

In small teams, consistency beats heroics. Turn tacit knowledge into repeatable systems so remote workers can follow instructions exactly.

One policy library: a single source of truth for privacy, subpoenas, redaction, information-sharing, and s 121 guidance.
Role-based playbooks: duty lawyer briefing, triage steps, safety-plan check, and subpoena response SOP.
Templates: redaction checklist, scope confirmation email to the issuer, client consent forms, and release cover letters.
Storage map: where records live, who can access them, retention timelines, and metadata hygiene.
Training cadence: onboarding plus quarterly drills so remote and onsite staff execute the same process.

6) APP 6 in practice: access controls, tech hygiene, and safe communications

Least-privilege access: restrict sensitive files to the smallest group necessary; use MFA and role-based permissions.
Encryption and secure sharing: encrypt at rest and in transit; avoid email attachments for highly sensitive material—use secure portals.
Metadata and redaction: use proper redaction tools (not black boxes); scrub document metadata before release.
Audit and alerts: enable logging for file views/exports; review unusual access quickly.
Remote work controls: device hardening, VPN, screen privacy, clear-desk policies, and session timeouts.

7) Strategy: turn compliance into capacity, trust, and funding readiness

The new laws seek a system that is more equitable, accountable, and responsive to children, families, and communities. Strong compliance can become a strategic advantage: better client safety, fewer complaints, smoother audits, and stronger funder confidence.

Significant policy and law reform is needed to make our communities fairer, safer, more inclusive, and more secure… We call on the Commonwealth to support this vision by increasing funding to community legal centres to work in partnership with legal aid commissions.

CLCs like PCLC serve the most disadvantaged. Demonstrating rigorous information governance and data minimisation helps justify diversified funding and resource requests, and keeps service delivery resilient.

8) What to do next: a 14-day action plan

Days 1–3: approve a subpoena/disclosure checklist; publish it to your policy library; brief all staff.
Days 4–7: implement redaction tooling, review access permissions, and identify files needing extra restriction.
Days 8–10: run a mock subpoena drill; validate decision logs; patch gaps in safety-plan steps.
Days 11–14: finalise training for duty lists and remote staff; set quarterly audits; confirm escalation to principals.

Done right, these changes harden client safety, reduce risk, and free your team to focus on outcomes—not firefighting.

June 2025 Family Law Changes: A CLC Data-Handling Playbook