Check reasonable steps to protect personal information that is held
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- From the holding arrangements the lawyer supplies, apply Australian Privacy Principle 11 as the guideline states it. The principle applies to personal information the entity holds, which section 6(1) defines as possession or control of a record containing it. Holding includes a right or power to deal with information stored by a third party, including a right to access and amend it. The entity must take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. Misuse is use for a purpose the Privacy Act does not permit. Interference is an attack that interferes with the information but does not necessarily modify it, including an attack that exposes it. Loss is accidental or inadvertent loss, including physically losing documents, equipment or portable storage, or electronically losing it by failing to keep adequate backups, and it can include theft or a natural disaster. It does not include intentional destruction or de-identification done in accordance with the principles. Unauthorised access is access by an employee, contractor or outsider who is not permitted, including copying. Unauthorised modification is alteration by someone not permitted, or in a way the Act does not permit. Unauthorised disclosure is making the information accessible or visible outside the entity and releasing it from effective control in a way the Act does not permit. What is reasonable depends on the entity's size, resources, complexity and business model; the amount and sensitivity; the adverse consequences of a breach; the time and cost, which do not excuse a step unless the burden is excessive; and whether the measure is itself privacy invasive. In all cases the page says reasonable steps should include governance, culture and training; internal policies, procedures and systems; ICT security; access security; third party providers including cloud computing; data breaches; physical security; destruction and de-identification; and standards. Technical and organisational measures are required. Examples of technical measures are securing access to premises, encrypting data, anti-virus software and strong passwords. Examples of organisational measures are staff training and standard operating procedures and policies. Once the information is no longer needed for any purpose for which it may be used or disclosed under the principles, reasonable steps must be taken to destroy it or ensure it is de-identified, unless it is in a Commonwealth record or an Australian law or a court or tribunal order requires it to be retained. Principle 11.3, that reasonable steps include technical and organisational measures, applies to personal information held from 11 December 2024 regardless of when it was acquired. Destruction means it can no longer be retrieved. Putting hard-copy information in garbage or recycling is not ordinarily reasonable unless it has already been pulped, burned, pulverised, disintegrated or shredded. Electronic information is sanitised or irretrievably destroyed. Where irretrievable destruction is not possible, which the page expects only in very limited circumstances, reasonable steps include putting it beyond use: the organisation is not able and will not attempt to use or disclose it, cannot give any other entity access, surrounds it with appropriate technical, physical and organisational security including access controls, logs and audit trails, and commits to take reasonable steps to irretrievably destroy it if, or when, that becomes possible. Where a third party holds it, reasonable steps include verifying that destruction or de-identification occurred. De-identified, in section 6(1), means the information is no longer about an identifiable individual or an individual who is reasonably identifiable. The tool does not decide whether a dataset is de-identified for a release. The Guide to Securing Personal Information was not opened.
- What the lawyer must review
- The lawyer decides whether the steps are reasonable, whether the information is still needed, and whether destruction or de-identification has been achieved.
- Written for / version
- US
Open a jurisdiction version of this task to see which instruments apply: US
Who does what
| Role | What they do |
|---|---|
| Assistance | From the holding arrangements the lawyer supplies, apply Australian Privacy Principle 11 as the guideline states it. The principle applies to personal information the entity holds, which section 6(1) defines as possession or control of a record containing it. Holding includes a right or power to deal with information stored by a third party, including a right to access and amend it. The entity must take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. Misuse is use for a purpose the Privacy Act does not permit. Interference is an attack that interferes with the information but does not necessarily modify it, including an attack that exposes it. Loss is accidental or inadvertent loss, including physically losing documents, equipment or portable storage, or electronically losing it by failing to keep adequate backups, and it can include theft or a natural disaster. It does not include intentional destruction or de-identification done in accordance with the principles. Unauthorised access is access by an employee, contractor or outsider who is not permitted, including copying. Unauthorised modification is alteration by someone not permitted, or in a way the Act does not permit. Unauthorised disclosure is making the information accessible or visible outside the entity and releasing it from effective control in a way the Act does not permit. What is reasonable depends on the entity's size, resources, complexity and business model; the amount and sensitivity; the adverse consequences of a breach; the time and cost, which do not excuse a step unless the burden is excessive; and whether the measure is itself privacy invasive. In all cases the page says reasonable steps should include governance, culture and training; internal policies, procedures and systems; ICT security; access security; third party providers including cloud computing; data breaches; physical security; destruction and de-identification; and standards. Technical and organisational measures are required. Examples of technical measures are securing access to premises, encrypting data, anti-virus software and strong passwords. Examples of organisational measures are staff training and standard operating procedures and policies. Once the information is no longer needed for any purpose for which it may be used or disclosed under the principles, reasonable steps must be taken to destroy it or ensure it is de-identified, unless it is in a Commonwealth record or an Australian law or a court or tribunal order requires it to be retained. Principle 11.3, that reasonable steps include technical and organisational measures, applies to personal information held from 11 December 2024 regardless of when it was acquired. Destruction means it can no longer be retrieved. Putting hard-copy information in garbage or recycling is not ordinarily reasonable unless it has already been pulped, burned, pulverised, disintegrated or shredded. Electronic information is sanitised or irretrievably destroyed. Where irretrievable destruction is not possible, which the page expects only in very limited circumstances, reasonable steps include putting it beyond use: the organisation is not able and will not attempt to use or disclose it, cannot give any other entity access, surrounds it with appropriate technical, physical and organisational security including access controls, logs and audit trails, and commits to destroy it when that becomes possible. Where a third party holds it, reasonable steps include verifying that destruction or de-identification occurred. De-identified, in section 6(1), means the information is no longer about an identifiable individual or an individual who is reasonably identifiable. The tool does not decide whether a dataset is de-identified for a release. The Guide to Securing Personal Information was not opened. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Treat information a contractor stores as held if the entity can still deal with it.
- Match the controls to misuse, interference, loss, unauthorised access, unauthorised modification and unauthorised disclosure, using both technical and organisational measures.
- If it is no longer needed, record the duty to destroy or de-identify unless it is a Commonwealth record or the law or an order requires retention. Do not decide that a dataset is de-identified.
Sources
- OAIC: Chapter 11, Australian Privacy Principle 11 · 2026-10-22
These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.