Information governance
Make sensitive information easier to find, share and protect.
The IT Privacy People
Privacy, engineered.
When personal information is scattered across applications, backups and file shares, ownership, access and retention can be unclear. Kritical maps the systems, builds the controls your organisation has approved and verifies the technical result. We are computer engineers, not lawyers: the service produces technical work and evidence; it does not provide legal advice or certify compliance.
On this page
Choose where to start.
Jump to the part that matches the problem or decision in front of you.
Use the arrows or scroll to see every card.
We're not lawyers. Here's the practical IT-delivered side of privacy.
Your lawyer or privacy adviser decides what the law requires of you. We deliver the technical side. We find where personal information sits across your systems, backups and file shares, and who owns each one. We set sign-in, access, sharing and encryption so only the right people can reach it. We match retention and backups to the rules your adviser sets. And we make sure you have the logs, incident route and evidence trail to investigate if you suspect a data breach.
Know what personal information your systems hold.
Start with a bounded map of repositories, applications, integrations, backups, owners and access paths across platforms such as Microsoft 365, Business Central, Shopify, file shares and backup systems. The result distinguishes what was observed from what has not yet been established, so the next decision is based on evidence rather than a spreadsheet of assumptions.
Turn approved privacy requirements into working controls.
Kritical scopes and implements agreed identity, access, encryption, classification, sharing and data-loss controls. The work starts with the organisation's approved requirements and the systems actually in scope. Platform licences, exceptions, business owners and recovery arrangements are identified before changes are made.
- Identity and least privilege Review who can reach the information, how administrators authenticate, and where access is broader than the job requires.
- Information protection Map approved handling rules to available labelling, encryption, sharing and data-loss controls without claiming that configuration alone proves compliance.
- Retention and defensible disposal Implement decisions made by the organisation's records and legal owners, including the effect of archives and backups. Kritical does not decide the lawful retention period.
Be ready to investigate a suspected data breach.
A technical response needs usable logs, an incident route, named decision owners and a way to preserve evidence. We help establish those foundations so your organisation and its advisers can assess what happened, which information and people may be affected, and what further action is required.
Prove the technical work without inventing a badge.
The engagement can leave a system and data-flow map, control-and-evidence matrix, prioritised findings, change record, verification results, exception register and handover instructions. The exact deliverables are named in the proposal. Kritical does not issue legal opinions, privacy certifications or a blanket statement that an organisation is compliant.
First call
Confirm the business decision, systems, information and accountable owners in scope.
Read-only assessment
Collect agreed configuration and evidence without making changes, then separate verified controls, gaps and areas not yet established.
Scoped remediation
Quote approved technical changes separately, with testing, rollback and handover defined before implementation.
Use the current Australian privacy guidance as the legal reference point.
The Office of the Australian Information Commissioner publishes the current Australian Privacy Principle guidance and data-breach preparation material. Your lawyer or privacy adviser determines how the law applies to your organisation; Kritical uses the approved outcome to scope the systems work.
Use the current Australian privacy guidance as the legal reference point.
- OAIC: APP 11 — Security of personal informationRead the current guidance on reasonable technical and organisational steps, security, and destruction or de-identification when information is no longer needed. (opens in a new tab)
- OAIC: Data breach preparation and responseUse the current OAIC material when establishing the organisation's breach-response and assessment process. (opens in a new tab)
Separate privacy-control responsibility from system behaviour.
Privacy engineering turns approved requirements into technical controls, but the systems carrying those controls still need evidence. Keep ownership explicit and choose the specialist path that matches the observed problem.
Separate privacy-control responsibility from system behaviour.
- Clarify technical and legal responsibilityRead the boundary between technical implementation, business approval and legal advice before the control work begins.
- Follow slow data paths into performanceWhen access, retention or classification work exposes a constrained application or repository, investigate its performance path.
Questions before you enquire
Is Kritical a law firm or privacy adviser?
No. Kritical provides computer engineering. A qualified legal or privacy adviser determines how the law applies and approves the requirements; Kritical maps those requirements to systems, controls and evidence.
Can you start with Microsoft 365?
Yes. A bounded read-only assessment can review the agreed identity, sharing, information-protection, retention, audit and incident-evidence surfaces available in your tenant and licences.
Does the assessment certify compliance?
No. It records the technical scope, observations, evidence, gaps and recommended work. Compliance and legal conclusions remain with the organisation and any appropriately qualified adviser or assessor.
What should we send through the website form?
Describe the decision, systems and timeframe. Do not send passwords, access tokens, payment-card details, breach evidence or confidential records through the public form.
Related services
Identity & access
When access is inconsistent, over-permissioned or difficult to recover, Kritical improves identity across Active Directory, Microsoft Entra ID and connected applications, so people and services get the access they need and nothing more than that.
Cybersecurity
Kritical assesses configuration, prioritises remediation and implements agreed security improvements across identity, endpoints, networks and infrastructure.
Security readiness
Frameworks are useful when they help you decide what to protect, which gaps matter and what evidence should exist.
Microsoft 365
When licences, accounts, email, shared files and devices are difficult to administer together, Kritical brings them into one coherent environment — configured and checked against agreed requirements, with ongoing administration scoped separately as your business changes.
Let’s define the next step.
Tell us what you want to achieve, what you have today and when it matters.