Data privacy

Why it matters

Privacy failures are expensive in three ways. There is the direct cost of a breach: investigating, notifying, and losing customers who no longer trust you. There is the regulatory risk, with the OAIC able to seek significant penalties for serious interferences with privacy (check the current figures). And there is the commercial cost: larger customers, government buyers and platform partners now ask privacy questions in due diligence, and a business that cannot answer them loses the deal. Good privacy practice is also good data practice; it makes your systems cleaner and your marketing more effective.

What counts as personal and sensitive information

Personal information is any information or opinion about an identified individual, or one who is reasonably identifiable. It does not need to be secret. A work email address, a phone number, a customer’s purchase history and an IP address linked to a person can all qualify. The question is whether someone could be identified, alone or by combining what you hold with other information.

A subset called sensitive information carries stronger protections: health, racial or ethnic origin, religious beliefs, sexual orientation, criminal record, biometric data and a few other categories. You generally need consent to collect it and must handle it more carefully. An allied health clinic, a gym with injury notes or a recruiter holding police checks is dealing with sensitive information whether it thinks of itself as a data business or not.

What the Australian Privacy Principles ask of you

The thirteen APPs are easier to remember as a handful of themes. Be open: have a current privacy policy that says what you collect, why, how you store it and how people can access or correct it. Collect only what you reasonably need for a function of your business, and tell people at the point of collection what you are collecting and why. Use and disclose information for that purpose, or a related one people would reasonably expect, unless they consent to more.

Keep it accurate and secure: take reasonable steps to protect information against misuse, interference, loss and unauthorised access, which in practice means the cyber baseline plus access controls inside your own team. Give people access to their information and correct it when asked. Destroy or de-identify information you no longer need. And if you send information overseas, including to a cloud provider or an offshore support team, take reasonable steps to ensure the recipient handles it to the same standard.

• A privacy policy that reflects what you actually do, reviewed yearly.
• A collection notice wherever you gather information: forms, sign-ups, phone scripts.
• A data inventory: what personal information you hold, where, who can see it, and why.
• Contracts with suppliers who process your data, covering security, breach notification and offshore handling.
• Retention rules: how long each type of data is kept and how it is destroyed.

Direct marketing, consent and the practical overlaps

Privacy law overlaps with the Spam Act and the Do Not Call Register when you market to people. The short version: you need consent or an existing relationship to send commercial electronic messages, every message must identify you and offer a working unsubscribe, and you must honour opt-outs promptly. Buying lists is high risk because you usually cannot show how consent was obtained.

Consent is also the heart of newer questions about AI and analytics. Using customer data to train a model, sharing it with an AI tool, or profiling people for pricing all need to pass the test of whether the person would reasonably expect it. If you are unsure, be transparent and offer a choice. SMBH Consulting’s AI governance service helps businesses map these data flows before they become a problem.

When a breach happens

A data breach is any unauthorised access, disclosure or loss of personal information: a hacked mailbox, a lost laptop, an email sent to the wrong customer, a misconfigured shared folder. Under the Notifiable Data Breaches scheme, an organisation covered by the Privacy Act must assess a suspected breach quickly and, if it is likely to result in serious harm to any individual that cannot be prevented by remedial action, notify the OAIC and the affected people. The assessment is expected to be completed within a short, fixed period; check the current timeframe with the OAIC.

Prepare for this before it happens. Write a response plan that names the decision maker, lists your IT, legal and insurance contacts, and includes a draft notification. Most of the harm in a breach comes from slow or confused handling, not from the initial incident.

How to get your privacy house in order

1. Confirm whether the Privacy Act covers you Check turnover, industry and activities against the current OAIC guidance. Adopt the APPs regardless.
2. Build a data inventory List every system and file that holds personal information, what it contains, who can access it and why.
3. Cut what you do not need Remove unnecessary form fields and delete or de-identify old records.
4. Write or refresh your privacy policy Plain English, describing what you actually do. Add collection notices at every point of collection.
5. Lock down access Role-based access, MFA, and a review of who can see what each quarter.
6. Review supplier contracts Cloud, marketing, payroll and offshore providers should commit to security and breach notification.
7. Write a breach response plan Who decides, who to call, how to assess, draft notifications.

Real-world example

A Hobart physiotherapy clinic tidies up its data

Derwent Physio has four practitioners and about 3,000 patient records containing health information, which makes it a health service provider covered by the Privacy Act regardless of its size. When a receptionist accidentally emails one patient’s treatment plan to another patient with a similar name, the owner, Lena, realises she has no idea what to do.

She contains the incident by asking the recipient to delete the email, assesses that the information is sensitive but limited to one person, apologises to the affected patient and documents the decision not to notify the OAIC because the harm was contained. Then she fixes the underlying mess: patient files move from a shared drive into the practice management system with per-user logins, the intake form drops three questions nobody used, a retention rule is set in line with health records requirements in her state, and the clinic adopts a new rule that outgoing clinical documents are sent through the patient portal rather than email.

Common mistakes

• Copying a privacy policy from another website A policy that describes things you do not do, or omits things you do, is worse than none. Write it from your data inventory.
• Keeping everything forever Old records are pure liability. Set retention periods and actually delete.
• Letting everyone see everything A shared drive where every staff member can open every customer file is a breach waiting to happen.
• Ignoring suppliers Your cloud provider, marketing agency and offshore bookkeeper handle your data. Your contract with them should say how.
• Waiting to write the breach plan Assessing a breach for the first time under pressure leads to slow, inconsistent decisions and often a worse outcome for the people affected.

KPIs to track

• Systems with personal data mapped Share of systems in your data inventory with owner, contents and access documented. Target: all of them.
• Staff with access to customer records Lower is better. Track it after each quarterly access review.
• Records past retention period Count of records that should have been deleted. Should trend to zero.
• Time to contain an incident Hours from discovery to containment. Faster containment usually means no notifiable breach.
• Access and correction requests handled on time Requests from individuals answered within a reasonable period, typically within 30 days.

Frequently asked questions

Does the Privacy Act apply to my small business?

It depends on your turnover, your industry and what you do with data. Health service providers and businesses that trade in personal information are covered regardless of size, and the small business exemption has been under review. Check the current position on the OAIC website or ask a lawyer.

Do I need a privacy policy on my website?

If the Act applies, yes, and it must be clearly expressed and up to date. Even if it does not, a clear policy builds trust and is often requested by partners and platforms.

Can I store customer data in overseas cloud services?

Generally yes, provided you take reasonable steps to ensure the recipient protects the information to the standards of the APPs, which usually means a reputable provider with strong contractual commitments. Tell people in your privacy policy that data may be held overseas.

What should I do if I think we have had a breach?

Contain it immediately, assess the likelihood of serious harm, consider whether you can remedy it, and if serious harm is still likely and you are covered by the Act, notify the OAIC and affected individuals. Document every decision.

Key takeaways

• Personal information is broader than most owners assume, and sensitive information needs extra care.
• Collect only what you need and delete what you no longer need; that removes most of the risk.
• A privacy policy must describe what you actually do, built from a real data inventory.
• Suppliers handling your data need contracts that say how they protect it.
• Write the breach response plan now and practise the first hour.