---
title: "Check the safeguards for client personal information the practice holds"
url: "https://ailawframework.com/obligations/confidentiality-and-client-information/check-the-safeguards-for-client-personal-information-the-practice-holds"
type: "task"
site: "AI Law Framework"
id: "A51-MA20261022-11"
practice_area: "Confidentiality & client information"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Check the safeguards for client personal information the practice holds

> Against the practice's security note, list which of the guideline's categories are already recorded: governance, culture and training; internal policies, procedures and systems; ICT security; access security;…

Canonical page: https://ailawframework.com/obligations/confidentiality-and-client-information/check-the-safeguards-for-client-personal-information-the-practice-holds  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Confidentiality & client information](https://ailawframework.com/obligations/confidentiality-and-client-information.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Against the practice's security note, list which of the guideline's categories are already recorded: governance, culture and training; internal policies, procedures and systems; ICT security; access security; third party providers, including cloud; data breaches; physical security; destruction and de-identification; and standards. Note any technical measure the note already names, such as securing premises, encrypting data, anti-virus software or strong passwords, and any organisational measure such as staff training or a written procedure. Do not decide that the steps are reasonable. Do not add a control the practice has not described. |
| What the lawyer must review | Decide whether the steps are reasonable in the circumstances for APP 11.1. An APP entity that holds personal information must take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. The guidelines say those steps depend on the entity's size, resources, complexity and business model, the amount and sensitivity of the information, the possible adverse consequences, the practical burden, and whether a measure is itself privacy-invasive. Inconvenience, time or some cost does not of itself excuse a step. Reasonable steps include technical and organisational measures, used in layers so that there is not a single point of failure. First confirm that the Privacy Act applies to the practice. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Source-by-source verification**

Trace relied-on content to independent sources and check for relevant material the output has missed.

- What the AI does: Against the practice's security note, list which of the guideline's categories are already recorded: governance, culture and training; internal policies, procedures and systems; ICT security; access security; third party providers, including cloud; data breaches; physical security; destruction and de-identification; and standards. Note any technical measure the note already names, such as securing premises, encrypting data, anti-virus software or strong passwords, and any organisational measure such as staff training or a written procedure. Do not decide that the steps are reasonable. Do not add a control the practice has not described.
- What the lawyer does: Decide whether the steps are reasonable in the circumstances for APP 11.1. An APP entity that holds personal information must take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. The guidelines say those steps depend on the entity's size, resources, complexity and business model, the amount and sensitivity of the information, the possible adverse consequences, the practical burden, and whether a measure is itself privacy-invasive. Inconvenience, time or some cost does not of itself excuse a step. Reasonable steps include technical and organisational measures, used in layers so that there is not a single point of failure. First confirm that the Privacy Act applies to the practice.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Map only measures the practice's own note records. Do not invent a control.
2. Include third parties who hold the information, including a cloud provider, as the guidelines flag that case.
3. Keep this check separate from a suspected eligible data breach, which is its own assessment.
4. The lawyer decides whether the steps are reasonable, after confirming the Act applies.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC APP guidelines, chapter 11: security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) (checked 2026-10-22)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/obligations/confidentiality-and-client-information/check-the-safeguards-for-client-personal-information-the-practice-holds/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*