Can you handle Privacy Act + APPs + Notifiable Data Breaches + ACSC Essential Eight?

Yes, this is the standard Sydney B2B-portal scope. The Australian regulatory stack is: Privacy Act 1988 (the parent law, OAIC as regulator), 13 Australian Privacy Principles (APPs) (the operational rules, collection, use, disclosure, access, correction), Notifiable Data Breaches (NDB) scheme (mandatory breach reporting since Feb 2018), Spam Act 2003 (opt-in for electronic marketing), Australian Consumer Law (ACL) (warranty + refund rules). For B2B portals selling into banking, government, energy, water, or critical-infrastructure clients, we additionally ship ACSC Essential Eight hardening, the Australian Cyber Security Centre's eight-control framework: application control, patch applications, configure MS Office macros, user application hardening, restrict admin privileges, patch OS, MFA, daily backups. We aim for E8 Maturity Level 2 as a baseline for Magento (Adobe Commerce Cloud Sydney already covers ~5 controls; the other 3 are application-layer). DSAR automation within 30 days, OAIC-aligned consent flows, NDB-ready incident response runbook all included.