flowchart LR A[Legal obligations<br/>bind you already] --> B[Security engineering<br/>do it because it is right] B --> C[Evidence and documentation<br/>a by-product of B] C --> D[Certification<br/>when a deal requires it] D --> E[Deal unblocked] A -. skipping here is not an option .-> A
Compliance Is a Sales Function, Not a Security Function
Certifications do not make you secure. They prove to a buyer’s procurement team that controls exist, are documented, and were checked by someone else. Confusing the two is expensive.
The clearest way I can put it: the security work is worth doing regardless; the certificate is what unblocks the deal. Those are two different projects with two different success criteria, and treating them as one is how a company spends $60k on SOC 2 and still ships a tenant-isolation bug.
Neither half is optional. But if you cannot say which one you are currently doing, you will do both badly.
What a certificate actually asserts
| Framework | What it is | When you need it |
|---|---|---|
| SOC 2 Type II | An AICPA attestation. An auditor’s opinion on your controls over an observation window. Not a certification | US buyers, mid-market and up. The default ask in North America |
| ISO/IEC 27001:2022 | A certifiable ISMS standard. An accredited body issues a three-year certificate with annual surveillance | Australian, European and enterprise buyers |
Read the definitions closely and the framing follows. SOC 2 is an opinion about whether the controls you described were operating over a window. It is not a statement that your software is free of vulnerabilities, and it was never designed to be.
That is not a criticism of the frameworks. It is what they are for. The mistake is on the buyer’s side and the seller’s side equally: treating an attestation about process as evidence about product.
The order of operations that actually works
The failure mode is starting at D. A compliance programme run as a sales project produces a binder that describes controls somebody intends to implement, and an audit window spent hurriedly making the binder true.
Run in the right order, the certificate is mostly a packaging exercise over work you already did.
The part that binds you whether or not you certify
For anything handling health data in Australia, the legal baseline is stricter than most founders assume, and it applies from day one.
- Health information is sensitive information under the Privacy Act’s APP 3. Collection requires consent and a direct connection to your functions, and the bar for use, disclosure and cross-border transfer is materially higher than for ordinary personal information.
- The small business exemption does not save you. The under-$3M-turnover exemption is voided if you provide a health service or hold health records. A pre-revenue startup holding patient-reported outcomes is a full APP entity immediately. This is the single most commonly missed obligation in Australian health tech.
- There is no controller/processor split. Unlike GDPR, if you hold the information you are an APP entity in your own right. You cannot contract your way into being a mere processor, and both you and the clinic have independent obligations over the same record.
- Notifiable Data Breaches: assess a suspected eligible breach within 30 days, and if serious harm is likely and you cannot remediate, notify the OAIC and the affected individuals. Health data almost always clears the serious-harm threshold. Thirty days sounds generous until you are mid-incident, so write the runbook first.
- APP 8 makes you accountable for your offshore recipients’ acts as if they were your own. In practice: host in an Australian region and document every subprocessor’s residency. “Our vendor is US-based but SOC 2 certified” is not an answer under APP 8, which is the cleanest illustration of the whole thesis.
That last point is worth sitting with. A buyer’s procurement team may accept a certificate. The statute does not.
The reform state, because it is moving
Tranche 1 of the Privacy Act reform passed in late 2024. The piece with the sharpest commercial edge is the statutory tort for serious invasion of privacy, which commenced 10 June 2025: individuals can sue directly, independent of any regulator action, with no turnover threshold. Automated decision-making transparency requirements follow in December 2026.
Tranche 2 remains a Government commitment rather than enacted law, with no bill passed and no timetable. Expected scope includes a “fair and reasonable” test independent of consent, GDPR-style rights including erasure, a broader definition of personal information, and removal of the employee and small-business exemptions.
The engineering implication is simple enough to act on now: design the data model assuming erasure and export will become mandatory. Retrofitting deletion into a schema that assumed permanence is one of the more painful migrations available.
One thing to check rather than assume
If your product does anything more than deliver questionnaires and report outcomes, check whether it is Software as a Medical Device under the TGA. Pure administrative and record-keeping software normally falls inside the exclusions. The moment you add scoring that flags a clinical action, risk stratification, or anything recommending treatment, you may be in the SaMD regime.
That is a regulatory conversation rather than an engineering one, and it changes your entire quality-management burden. Get a written opinion early, when it is a question, rather than late, when it is a finding.
Takeaway
Three sentences:
- Legal obligations bind you today, certificate or not, and for health data in Australia they are stricter than the startup folklore suggests.
- Security engineering is worth doing on its own merits, and it produces the evidence a certification needs as a by-product.
- The certificate is a sales artefact. Buy it when a deal requires it, and be honest that this is why.
The trouble starts when the third sentence is mistaken for the second. Full notes, including the framework comparison and the Australian legal detail, are in Web Development.
Note
Engineering notes, not legal advice. Privacy law is being actively reformed; check the current state before relying on any of it.