Check the safeguards for client personal information the practice holds
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Against the practice's security note, list which of the guideline's categories are already recorded: governance, culture and training; internal policies, procedures and systems; ICT security; access security; third party providers, including cloud; data breaches; physical security; destruction and de-identification; and standards. Note any technical measure the note already names, such as securing premises, encrypting data, anti-virus software or strong passwords, and any organisational measure such as staff training or a written procedure. Do not decide that the steps are reasonable. Do not add a control the practice has not described.
- What the lawyer must review
- Decide whether the steps are reasonable in the circumstances for APP 11.1. An APP entity that holds personal information must take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. The guidelines say those steps depend on the entity's size, resources, complexity and business model, the amount and sensitivity of the information, the possible adverse consequences, the practical burden, and whether a measure is itself privacy-invasive. Inconvenience, time or some cost does not of itself excuse a step. Reasonable steps include technical and organisational measures, used in layers so that there is not a single point of failure. First confirm that the Privacy Act applies to the practice.
- Written for / version
- US
Open a jurisdiction version of this task to see which instruments apply: US
Who does what
| Role | What they do |
|---|---|
| Assistance | Against the practice's security note, list which of the guideline's categories are already recorded: governance, culture and training; internal policies, procedures and systems; ICT security; access security; third party providers, including cloud; data breaches; physical security; destruction and de-identification; and standards. Note any technical measure the note already names, such as securing premises, encrypting data, anti-virus software or strong passwords, and any organisational measure such as staff training or a written procedure. Do not decide that the steps are reasonable. Do not add a control the practice has not described. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Map only measures the practice's own note records. Do not invent a control.
- Include third parties who hold the information, including a cloud provider, as the guidelines flag that case.
- Keep this check separate from a suspected eligible data breach, which is its own assessment.
- The lawyer decides whether the steps are reasonable, after confirming the Act applies.
Sources
These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.