Also see Privacy collection notice
Privacy Policy for AML/CTF obligations
Kang Law Pty Ltd ACN 682 852 302 T/A Kang Law Practice ABN 58 682 852 302
Our commitment
We are committed to protecting your privacy. We collect, use, share, process, and manage Personal Information only as reasonably necessary for carrying out our functions and activities.
If we prepare to provide, provide you with, or reasonably anticipate that we may provide you with, any Designated Services, we will handle your Personal Information provided in relation to those services in an open and transparent way, subject to our legal obligations, in accordance with this Privacy Policy.
What does this Privacy Policy cover?
Meaning of words used in this Privacy Policy
In this Privacy Policy the terms listed have the following meanings:
|
AML/CTF Act |
Anti‑Money Laundering and Counter‑Terrorism Financing Act 2006 (Cth). |
|
AML/CTF Framework |
AML/CTF Act, AML/CTF Rules and AUSTRAC-issued guidance. |
|
AML/CTF Rules |
Anti-Money Laundering and Terrorism Financing Rules 2025 (Cth) made under the AML/CTF Act. |
|
APP/s |
The Australian Privacy Principles in Schedule 1 of the Privacy Act. |
|
AUSTRAC |
Australian Transaction Reports and Analysis Centre. |
|
Designated Services |
All the services described as Professional Services in Table 6 of section 6 of the AML/CTF Act and its relevant subsections, including:
|
|
We, us, our |
Kang Law Pty Ltd ACN 682 852 302 T/A Kang Law Practice ABN 58 682 852 302 |
|
KYC Information |
Information collected or verified to fulfil our initial and ongoing customer due diligence obligations under the AML/CTF Act and AML/CTF Rules, including:
|
|
OAIC |
Office of the Australian Information Commissioner. |
|
Personal Information |
Information or an opinion about an identified individual, or an individual who is reasonably identifiable: whether the information or opinion is true or not; and whether the information or opinion is recorded in a material form or not, collected, held, used or disclosed by us for the purposes of, or in connection with, activities relating to the AML/CTF Act or regulations or AML/CTF Rules. |
|
Privacy Act |
Privacy Act 1988 (Cth). |
|
Sensitive Information |
|
What privacy law applies to our relationship
We are a “small business operator” under s 6D of the Privacy Act and become subject to the Privacy Act, for the first time, only in relation to AML/CTF-related activities by operation of s 6E(1A) of that Act.
Accordingly, the Privacy Act, including the APPs, applies only to our collection, use, sharing, processing, and management of Personal Information handled for the purposes of, or in connection with, our AML/CTF-related activities.
How do we collect Personal Information?
We collect Personal Information only by lawful and fair means.
We collect Personal Information directly from the individual concerned unless it is unreasonable or impracticable to do so, or another applicable legal provision permits collection from another source.
We may collect Personal Information when you, your organisation, or those acting on your or your organisation’s behalf:
- visit us or meet with our representatives;
- communicate with us, including by physical post, email, social media, telephone or text message;
- register to attend, present at or otherwise participate in a meeting, conference or event hosted or presented by us;
- complete an online questionnaire, upload documents or use an electronic verification or signing service in connection with our AML/CTF-related activities; and/or
- engage us to provide services including when you supply KYC Information in response to our direct request.
If we use a credit reporting body for electronic identity verification, we will seek your express consent prior to doing so and offer an alternative means of verification (for example, certified copies of identification documents), as legally required.
We will take reasonable steps either to notify the individual of the matters required by applicable privacy law or to ensure the individual is aware of those matters.
What Personal Information do we collect?
We are required by law under the AML/CTF Act to collect and verify certain Personal Information and may be prohibited from providing services if we cannot do so.
In particular, we collect KYC Information as required by the AML/CTF Act which may include names, addresses, location, contact details, job titles, services and transactions obtained, offered and supplied including usage history, including information about the time, place, and circumstances of our interactions with you.
We may infer information about you from your engagement with us and your activities. We may also collect Sensitive Information where required for compliance with the AML/CTF Framework or where otherwise permitted by law.
We may conduct ongoing monitoring of transactions and client information to comply with our AML/CTF obligations.
What happens if you don’t provide us with requested Personal Information?
If you do not provide requested Personal Information, we may be unable to provide Designated Services and/or comply with our legal obligations.
Purposes of collection of Personal Information
We collect and use Personal Information to carry out our activities and functions including providing you with Designated Services, complying with our regulatory obligations in relation to the delivery of those services, including adherence to the Legal Profession Uniform Law and its related rules and legislation, the Legal Profession Uniform Law Australian Solicitors’ Conduct Rules 2015 (NSW) and the Legal Profession Uniform General Rules 2015 (NSW). Other relevant legislation which may require us to collect and use your Personal Information includes the Duties Act 1997 (NSW) and the Australian Registrars National Electronic Conveyancing Council’s Model Participation Rules. We also use your Personal Information to complete the transaction as part of our legal service.
We use and disclose Personal Information for the primary purpose for which it was collected. We may also use or disclose it for a related secondary purpose that the individual would reasonably expect, or with consent or as otherwise permitted or required by law. For Sensitive Information, a secondary purpose relied on under the reasonable-expectations exception must be directly related to the primary purpose.
Disclosure of Personal Information
Third parties
We may disclose Personal Information for the purposes described in this policy to service providers assisting with identity verification, AML/CTF compliance, information collection, document processing, practice management and data storage. We may also disclose Personal Information to other recipients where authorised by the individual or otherwise permitted or required by law, subject to our professional obligations of confidentiality.
Legal requirements
We may use or disclose your Personal Information in circumstances where required by law and/or expressly permitted by the Privacy Act, including if:
- it is not reasonable or practical to obtain consent and we reasonably believe use or disclosure is necessary to lessen or prevent a serious threat to life, health, or safety of any individual or public health and safety;
- we have reason to suspect that unlawful activity or misconduct of a serious nature that relates to our activities or functions is being or has been engaged in, and we believe the collection, use or disclosure is necessary to take appropriate action in relation to the matter;
- we reasonably believe that the collection, use or disclosure is reasonably necessary to assist with the location of a person reported missing; or
- we are compelled by law including:
- by warrant or subpoena;
- where we are required by request under statute or lawful order of a government agency or authority including law enforcement, courts and tribunals and regulators; and/or
- to AUSTRAC and other government agencies without your knowledge or consent, including where we form a suspicion about a matter or transaction under the AML/CTF Framework.
Nothing in this Privacy Policy limits our obligations of confidentiality or client legal privilege. However, there may be circumstances where we are compelled to disclose confidential information to AUSTRAC under the AML/CTF Framework.
We may be prohibited by law from notifying you of certain disclosures to AUSTRAC or other authorities.
How do we protect your information?
We hold Personal Information in hard copy and electronic formats. We take reasonable steps to prevent unauthorised access, disclosure, alteration, destruction or loss of Personal Information including by using a range of physical, operational and technological security measures to protect this information. These measures include organisational and technical measures such as: staff education and training to ensure our staff are aware of their privacy obligations when handling your Personal Information; administrative and technical controls to restrict access to Personal Information to only those people who need access; technological security measures.
Where a data breach is likely to result in serious harm, we will comply with the Notifiable Data Breaches scheme in the Privacy Act, including notifying the OAIC and affected individuals, as required.
Can your Personal Information be accessed offshore?
Where we disclose Personal Information to an overseas recipient, we take reasonable steps required by applicable privacy law to ensure that the recipient does not breach the Australian Privacy Principles in relation to that information, unless an exception applies.
We utilise third-party cloud infrastructure and enterprise service providers (including Microsoft, Paperform, DocuSign, LEAP, and InfoTrack) to store, process, and manage data. While we prioritise hosting data locally within Australia, these providers operate global networks and may store, route, or process your personal information offshore. Consequently, your personal information may be disclosed to overseas recipients located in: The United States; The United Kingdom; Canada; New Zealand; Countries within the European Union; Singapore; Japan; South Korea.
Due to the dynamic nature of cloud computing and our providers’ infrastructure, data may occasionally be routed through or backed up in other geographic regions utilized by these vendors.
How you can access and correct your Personal Information
You may request access to or correction of Personal Information we hold about you by contacting our Privacy Officer at:
This includes information held on our behalf by service providers where it remains within our possession or control.
We will deal with your request in accordance with the applicable requirements of the Privacy Act, including any grounds for refusing access or correction. We may ask you to verify your identity before acting on your request.
If you believe information we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading, please identify the information and the correction you seek. We will assess your request and take reasonable steps to make any correction required by the Privacy Act, having regard to the purpose for which the information is held.
We will respond to access and correction requests within a reasonable period, usually within 30 days. We do not charge for making a request or for correcting information. We may charge a reasonable, non-excessive fee for providing access and will advise you of any proposed fee beforehand.
If we refuse access or correction, we will provide written notice explaining our reasons, except to the extent it would be unreasonable to do so, and how you may complain.
How you can complain about our information handling practices
To complain about our handling of your Personal Information or compliance with the Australian Privacy Principles, please contact our Privacy Officer using the contact details in this policy and provide details of your complaint. We will assess your complaint, make inquiries as appropriate and respond within a reasonable period.
If you are dissatisfied with our response or have not received a response within 30 days, you may complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.
Date reviewed: 29/09/2026.
Privacy collection notice for customer due diligence
Kang Law Pty Ltd ACN 682 852 302 T/A Kang Law Practice ABN 58 682 852 302
This notice explains how we collect and handle personal information for the purposes of, or in connection with, our anti-money laundering and counter-terrorism financing (AML/CTF) obligations. It includes information collected for both AML/CTF and related legal-service purposes.
Why we need to collect your information
We collect personal information to comply with the customer due diligence and related requirements of the *Anti-Money Laundering and Counter-Terrorism Financing Act 2006* (Cth) and the *Anti-Money Laundering and Counter-Terrorism Financing Rules 2025* (Cth). This includes to:
– establish and verify the identity of clients, their representatives and relevant beneficial owners, and verify authority to act;
– understand the nature and purpose of a proposed transaction or business relationship, including relevant source-of-funds and source-of-wealth information;
– assess and manage money laundering, terrorism financing and proliferation financing risks, including relevant sanctions and politically exposed person checks;
– conduct ongoing due diligence and transaction monitoring; and
– make reports and keep records as required by law.
Where applicable and permitted by law, we also use information collected for these purposes to provide the related legal services and carry out your transaction.
What personal information we collect
Depending on the client, transaction and checks required, we collect:
– names, dates of birth, residential addresses and contact details;
– identity-document details and, where necessary, copies or images of identification documents, including photographs, passport or driver licence numbers and signatures;
– occupation, business activities, ownership and control details, and information about representatives and their authority;
– financial and transaction information, including relevant bank account details, source of funds and source of wealth; and
– information relevant to sanctions, politically exposed person status and other AML/CTF risk assessments.
Where relevant to the checks performed, information may include sensitive information, such as criminal-record information or political associations. Electronic identity-verification checks may also involve biometric information where facial matching or other biometric verification is used. We collect sensitive information only where permitted or required by applicable law, including obtaining consent where required.
How we collect your information
We generally collect information from you when you engage us, complete questionnaires, provide documents or communicate with us. Collection may occur during onboarding and throughout the matter or business relationship.
We use Outlook for email correspondence and document uploads, Paperform for online questionnaires and document uploads, and InfoTrack for relevant identity-verification and AML/CTF services. These providers may collect information on our behalf. We use LEAP to manage matter information.
Where permitted by law, we may also obtain information from authorised representatives, relevant company or other public registers, land and court records, verification and screening providers, financial institutions and professional advisers involved in the matter.
If we use a credit reporting body to verify your identity under the AML/CTF identity-verification provisions, we will obtain the consent and offer the alternative verification process required by law.
Who we may share your information with
Where permitted or required by law and subject to our professional obligations, we may disclose relevant personal information to:
– providers supporting information collection, identity verification, AML/CTF screening, practice management and storage, including Paperform, InfoTrack and LEAP;
– providers of electronic signing, document processing and AI-assisted document review, research, drafting, summarisation or analysis, where used for the purposes described in this notice;
– parties, representatives, professional advisers, financial institutions and transaction-service providers where necessary for the related legal services and lawfully permitted; and
– AUSTRAC and other authorities where required or authorised by law.
We may be prohibited by law from notifying you of certain disclosures.
Our service providers and their related entities or subcontractors may store or process information outside Australia or allow overseas access. Locations depend on the service and provider arrangements and may change. Further information about overseas handling is set out in our Privacy Policy.
We utilise third-party cloud infrastructure and enterprise service providers (including Microsoft, Paperform, DocuSign, LEAP, and InfoTrack) to store, process, and manage data. While we prioritize hosting data locally within Australia, these providers operate global networks and may store, route, or process your personal information offshore. Consequently, your personal information may be disclosed to overseas recipients located in: The United States; The United Kingdom; Canada; New Zealand; Countries within the European Union; Singapore; Japan; South Korea.
Due to the dynamic nature of cloud computing and our providers’ infrastructure, data may occasionally be routed through or backed up in other geographic regions utilized by these vendors.
What happens if we cannot collect your information
If we cannot obtain information necessary to meet our AML/CTF obligations, we may be unable to verify identity, commence or continue the relevant services, or complete the transaction for you or the person you represent. This does not mean that every item requested is mandatory; the consequences depend on the information and the applicable requirements.
Your privacy rights and our privacy policy
Our Privacy Policy explains how we handle personal information, how you may request access or correction, and how to make a privacy complaint and how we handle it.
You can read it at https://kang.com.au/privacy or request a copy using the contact details below.
How to contact us about your privacy
**Privacy Officer**
Kang Law Pty Ltd trading as Kang Law Practice
Date: 29 September 2026
Kang Law Pty Ltd t/a Kang Law Practice | Privacy Policy