APP 1 – Open and transparent management
Have a clear, up-to-date privacy policy.
Australia · Office of the Australian Information Commissioner (OAIC) · Privacy Act / APPs
Privacy Act & Australian Privacy Principles
The 13 Australian Privacy Principles (APPs) govern how APP entities handle personal information under the Privacy Act.
What it is
The Privacy Act 1988 sets out how APP entities handle personal information. This covers most Commonwealth agencies and private sector organisations with turnover above $3M, plus some smaller entities. The 13 APPs cover collection, use and disclosure, data quality, security, access and correction, and cross-border transfers. APP 11 matters most for cybersecurity: entities must take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.
Who it applies to
Most Australian Government and Norfolk Island government agencies. Private-sector and not-for-profit organisations with a yearly turnover above $3 million. All private health service providers, whatever their size. Some small businesses too, including credit reporters, residential tenancy databases and businesses that trade in personal information.
What a Vectra privacy audit reviews.
The OAIC expects APP entities to take reasonable steps to comply. The APPs are principles, so each business has some freedom in how it meets them, but a data breach can still lead to regulatory action. Our audits test your policies and procedures on each point below. Where we find weak spots, we set out a plan to fix them.
-
How you manage personal information openly (APP 1).
-
How people can choose not to identify themselves (APP 2).
-
How you collect personal and sensitive information (APP 3).
-
When you must tell a person about certain matters (APP 5).
-
When you may use or disclose the personal information you hold (APP 6).
-
When you may use or disclose it for direct marketing (APP 7).
-
What you check before personal information goes overseas (APP 8).
-
How you handle a person's request to access their information (APP 12).
-
How you correct personal information (APP 13).
Requirements
APP 3 – Collection of personal information
Collect only personal information reasonably necessary for functions or activities.
APP 6 – Use or disclosure
Use personal information only for its primary purpose, or a related secondary purpose the individual would reasonably expect.
APP 8 – Cross-border disclosure
Take reasonable steps to ensure overseas recipients meet APP standards.
APP 11 – Security of personal information
Reasonable steps to protect personal information and to destroy or de-identify it when no longer needed.
Start with a conversation.
Speak to us about your cyber governance and compliance requirements.
Message sent
Thanks. We have your message.
A member of our team will be in touch soon at . You can also reach us during business hours on 1800 816 044.
- Topic
- Company
Need us sooner? Call +61 8 8208 0800, or the 24/7 incident line on 1800 816 044 if something is happening now.