Privacy Act compliance not built into the data model
Australian SaaS products handling personal data of Australian users without a privacy-by-design approach in the data model are building technical debt that becomes a legal liability. The Australian Privacy Act 1988 and the proposed reforms require consent management, data deletion capability for individuals exercising their right to erasure, data breach notification workflows, and a clear data retention policy enforced at the application layer. These are not policies you document and file — they are features the product must implement. Retrofitting consent management and data deletion into a data model that was not designed for them requires touching every table that holds personal data and every API endpoint that returns it. Building them in from day one is a fraction of the cost.