Privacy compliance kits: what they do, what they miss and when software is the better buy
Compliance kits and template packs give you documents as at the day you buy them. The ADM obligation is standing. Here is how to decide between a kit and a living register.
What do privacy compliance kits do, and when is software the better buy?
A privacy compliance kit gives you professionally drafted templates: a privacy policy, a self-assessment questionnaire, checklists and registers you fill in yourself. For a lean organisation that just needs somewhere to start, that is genuinely useful, and it is why kits and template packs are a well-established corner of the Australian privacy market. But a kit has one structural property no amount of drafting quality fixes: it describes your organisation as at the day you completed it. The privacy obligations arriving on 10 December 2026 are not as-at obligations. They are standing ones.
This guide explains what a kit covers well, where it goes stale and how to decide whether a kit or a living register is the right spend for your organisation.
Why this decision is in front of you now
From 10 December 2026, Australian Privacy Principles 1.7 to 1.9 require your privacy policy to disclose the kinds of decisions made by automated systems that significantly affect people, and the kinds of personal information used in them. Meeting that requirement takes two things: knowing which of your systems actually make those decisions, and keeping the answer current as systems change. The first is a project. The second is the part that never finishes, and it is the part a kit cannot do.
What a kit gives you
A good kit gets you moving. Template policies mean you are not drafting from a blank page. A self-assessment walks you through questions you might not have thought to ask. A register template gives you the columns worth filling in. If your organisation has never done structured privacy work, completing a kit will teach you a great deal about your own operations, and the discipline of working through one is real work with real value.
Kits in this market commonly sell for around two to three thousand dollars, and at that price the drafting quality from the established providers is usually high. The problem is not the quality. It is the tense.
Where a kit goes stale, and how fast
Everything a kit produces is true on the day you finish it. Then your organisation keeps moving. You adopt a new tool with scoring built in. A vendor adds AI features to software you already run. A team starts using an eligibility check, a triage model, a hiring screen. None of those events updates your completed questionnaire, your filled-in register or your published policy. Each one quietly pulls the documents out of true.
The December obligation makes this a compliance problem rather than a housekeeping one, because the disclosure duty attaches to what your systems do now, not what they did when you bought the kit. An organisation that completed a kit in March and adopted two new decisioning tools by September has a privacy policy that no longer describes its automated decision-making, and nothing in the kit will tell them so.
What a living register does differently
The alternative is to hold the same information as a system rather than a document. Aicura is your AI Register, so the systems in use live in it as the record, each entry versions as things change, and owners get prompted when something needs attention. It scans your privacy policy against the ADM rules, surfaces which registered automated-decision systems are not yet disclosed and drafts the fixes for your review, so the policy and the register stay reconciled as your organisation changes. The documents a kit asks you to write by hand are generated from the register, which means they change when it changes.
Put plainly, a kit gives you the artefacts and a register gives you the artefacts plus the mechanism that keeps them true. Aicura is guidance and tooling, not certification, an audit or legal advice, and the decisions stay yours, which is the same footing a kit puts you on, with the maintenance carried for you.
When a kit is genuinely enough
If your organisation runs no automated decision-making, adopts new systems rarely and mostly needs baseline privacy documents once, a kit may be all you need, and the cheaper the better. The kit-versus-register question only has teeth where systems change: if you expect to add, upgrade or retire tools with any regularity, or you are not confident you even know where automation already sits in your operations, the as-at problem will find you.
The cost comparison, plainly
A template pack is a one-off spend of roughly two to three thousand dollars, plus your team’s hours to complete it, plus the same hours again each time it needs redoing. Aicura is a subscription, billed monthly or yearly, that generates the register, the scan findings and the drafted policy fixes, and does not go stale between efforts. Current rates are on the pricing page. If the obligation were one-and-done, the kit would often win on price. Because the obligation is standing, the comparison is really between paying once for a snapshot and paying for the thing staying true.
Where to go next
If you want to see what the register-first approach looks like before deciding anything, the guided tour shows the register, the policy scan and an example finding in three screens, with no signup. If you are starting from zero either way, the guide to building an AI Register walks through the same first project a kit’s questionnaire covers, and costs nothing to read.
Related guides
Related frameworks
A register does not go stale between efforts
Aicura holds the same information a kit asks you to write down, as a system rather than a document. It scans your privacy policy against the ADM rules, surfaces which registered systems are not yet disclosed and drafts the fixes for your review. Rates are on the pricing page, and the Register tier starts free.