Privacy and regulatory evidence readiness
New systems, AI tools and vendors all touch personal information. Boards, auditors, funders and regulators increasingly expect you to show how it is handled, not just say so. Here are the Australian Privacy Principles in plain English, and where to start.
Australian Government agencies, and private organisations with annual turnover over $3 million (plus some smaller ones, below), come under the federal Privacy Act 1988 and its thirteen Australian Privacy Principles. State, territory and local government bodies generally come under their own state or territory’s rules instead. South Australia has no privacy Act (see below).
Commonwealth departments and agencies.
With annual turnover over $3 million.
Regardless of turnover: for example private health service providers, businesses that buy or sell personal information, and contractors to the Australian Government.
Each state and territory has its own rules for its government bodies. Your lawyer confirms which apply to you and how.
Health information has its own law in New South Wales (Health Records and Information Privacy Act 2002), Victoria (Health Records Act 2001) and the ACT (Health Records (Privacy and Access) Act 1997). These apply to government bodies, including councils. They can also apply to private organisations that hold health information, such as private health services and aged care providers, alongside the federal Privacy Act.
The OAIC lists each state and territory’s privacy law and regulator.
A clear, current privacy policy, and notice when you collect personal information.
And use or disclose it only for the purpose you collected it, with limited exceptions.
Reasonable steps to protect it, and to destroy or de-identify it when it is no longer needed.
Access and correction on request.
Including to cloud and software vendors outside Australia.
Under the Notifiable Data Breaches scheme, a breach likely to result in serious harm must be reported to the Office of the Australian Information Commissioner and to the people affected, as soon as practicable. A suspected breach must be assessed within 30 days, so the time to decide who does what is before it happens.
A privacy impact assessment maps how a project handles personal information and what could go wrong, before it goes live. Australian Government agencies must do one for high privacy risk projects; for everyone else it is the clearest way to show the risk was thought through.
Is a small business covered? Check the OAIC’s guide.
Where to begin, in order.
Step 1
List the personal information you collect, where it lives, and which vendors and systems touch it.
Step 2
Does it describe what you really do, including any automated decisions that affect people?
Step 3
A privacy impact assessment before new systems, AI tools or data sharing that handle personal information.
Step 4
Decide who assesses a suspected breach, who notifies, and test it once.
Step 5
An evidence register: what's needed, what you hold, and what's missing, so you can show the work.
Each engagement is a defined result at one fixed price, with legal questions flagged for your own counsel.
General information only, not legal advice. Your own lawyer confirms how privacy law applies to your organisation. Details as published by the Office of the Australian Information Commissioner.