11 entries
Privacy Act APP 11. Reasonable steps to protect personal information you hold, and to destroy or de-identify it when it is no longer needed. Technical and organisational measures (APP 11.3 from 11 Dec 2024). OAIC Chapter 11 + Guide to securing personal information.
Before personal information goes to an overseas recipient, APP 8.1 requires reasonable steps, and s 16C can make you answer for the recipient's mistakes. How the OAIC separates disclosure from use and from a breach, when an offshore cloud or support contract is in or out, the exceptions, and what to write into vendor contracts and runbooks.
From 10 December 2026, an organisation covered by the Privacy Act that lets software, including AI, make or materially shape decisions that significantly affect people must say so in its APP privacy policy. The three-part test, why human review does not get you out of it, what the policy has to list, and a six-week readiness checklist.
The OAIC says the Privacy Act applies to every use of AI that involves personal information, covering both what goes into a tool and what comes out. What to check before you buy, when a prompt becomes an APP 6 disclosure, why AI output can be a collection under APP 3, and the security and accuracy steps the OAIC expects.
When staff data is stolen, private-sector employers often ask whether the employee records exemption takes the breach outside the Notifiable Data Breaches scheme. What the exemption covers, where it stops (applicants, contractors, volunteers) and why tax file numbers keep the scheme in play.
Compute on ciphertext and get an encrypted result. The processor never sees the plaintext. Specialised, not a swap for AES.
Healthcare providers, repository and portal operators and contracted service providers registered with My Health Record have a breach duty that sits beside the Privacy Act's Notifiable Data Breaches scheme. It starts on suspicion rather than a serious-harm assessment, it goes to both the Australian Digital Health Agency and the OAIC as soon as practicable, and only the Agency may tell patients. Here is what counts, who you tell, what to include and how it differs from an ordinary NDB.
The Privacy Act gate for an eligible data breach. Reasonable person, more probable than not, s 26WG factors, then remedial action.
What the Privacy Act requires in an eligible-data-breach statement to the OAIC and to individuals — and how to file it on the OAIC online form.
The OAIC now has three levels of enforcement for Privacy Act failures: court-ordered civil penalties for serious or repeated interferences, on-the-spot infringement notices for specific procedural breaches, and compliance notices that tell you what to fix. What triggers each one, what it can cost, and what to check before the OAIC does.
Since 10 June 2025, individuals in Australia can sue for a serious invasion of privacy under Schedule 2 of the Privacy Act 1988. The five elements, why insider snooping and covert recording are the security cases that matter, the exemptions for reporting to police and ASD, the time limits and damages cap, and what to change in your logging and incident playbooks.
Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary