---
title: "Check reasonable steps to protect personal information that is held"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/check-reasonable-steps-to-protect-personal-information-that-is-held"
type: "task"
site: "AI Law Framework"
id: "A25-QU20261022-14"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Check reasonable steps to protect personal information that is held

> From the holding arrangements the lawyer supplies, apply Australian Privacy Principle 11 as the guideline states it.…

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/check-reasonable-steps-to-protect-personal-information-that-is-held  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the holding arrangements the lawyer supplies, apply Australian Privacy Principle 11 as the guideline states it. The principle applies to personal information the entity holds, which section 6(1) defines as possession or control of a record containing it. Holding includes a right or power to deal with information stored by a third party, including a right to access and amend it. The entity must take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. Misuse is use for a purpose the Privacy Act does not permit. Interference is an attack that interferes with the information but does not necessarily modify it, including an attack that exposes it. Loss is accidental or inadvertent loss, including physically losing documents, equipment or portable storage, or electronically losing it by failing to keep adequate backups, and it can include theft or a natural disaster. It does not include intentional destruction or de-identification done in accordance with the principles. Unauthorised access is access by an employee, contractor or outsider who is not permitted, including copying. Unauthorised modification is alteration by someone not permitted, or in a way the Act does not permit. Unauthorised disclosure is making the information accessible or visible outside the entity and releasing it from effective control in a way the Act does not permit. What is reasonable depends on the entity's size, resources, complexity and business model; the amount and sensitivity; the adverse consequences of a breach; the time and cost, which do not excuse a step unless the burden is excessive; and whether the measure is itself privacy invasive. In all cases the page says reasonable steps should include governance, culture and training; internal policies, procedures and systems; ICT security; access security; third party providers including cloud computing; data breaches; physical security; destruction and de-identification; and standards. Technical and organisational measures are required. Examples of technical measures are securing access to premises, encrypting data, anti-virus software and strong passwords. Examples of organisational measures are staff training and standard operating procedures and policies. Once the information is no longer needed for any purpose for which it may be used or disclosed under the principles, reasonable steps must be taken to destroy it or ensure it is de-identified, unless it is in a Commonwealth record or an Australian law or a court or tribunal order requires it to be retained. Principle 11.3, that reasonable steps include technical and organisational measures, applies to personal information held from 11 December 2024 regardless of when it was acquired. Destruction means it can no longer be retrieved. Putting hard-copy information in garbage or recycling is not ordinarily reasonable unless it has already been pulped, burned, pulverised, disintegrated or shredded. Electronic information is sanitised or irretrievably destroyed. Where irretrievable destruction is not possible, which the page expects only in very limited circumstances, reasonable steps include putting it beyond use: the organisation is not able and will not attempt to use or disclose it, cannot give any other entity access, surrounds it with appropriate technical, physical and organisational security including access controls, logs and audit trails, and commits to take reasonable steps to irretrievably destroy it if, or when, that becomes possible. Where a third party holds it, reasonable steps include verifying that destruction or de-identification occurred. De-identified, in section 6(1), means the information is no longer about an identifiable individual or an individual who is reasonably identifiable. The tool does not decide whether a dataset is de-identified for a release. The Guide to Securing Personal Information was not opened. |
| What the lawyer must review | The lawyer decides whether the steps are reasonable, whether the information is still needed, and whether destruction or de-identification has been achieved. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Source-by-source verification**

Trace relied-on content to independent sources and check for relevant material the output has missed.

- What the AI does: From the holding arrangements the lawyer supplies, apply Australian Privacy Principle 11 as the guideline states it. The principle applies to personal information the entity holds, which section 6(1) defines as possession or control of a record containing it. Holding includes a right or power to deal with information stored by a third party, including a right to access and amend it. The entity must take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. Misuse is use for a purpose the Privacy Act does not permit. Interference is an attack that interferes with the information but does not necessarily modify it, including an attack that exposes it. Loss is accidental or inadvertent loss, including physically losing documents, equipment or portable storage, or electronically losing it by failing to keep adequate backups, and it can include theft or a natural disaster. It does not include intentional destruction or de-identification done in accordance with the principles. Unauthorised access is access by an employee, contractor or outsider who is not permitted, including copying. Unauthorised modification is alteration by someone not permitted, or in a way the Act does not permit. Unauthorised disclosure is making the information accessible or visible outside the entity and releasing it from effective control in a way the Act does not permit. What is reasonable depends on the entity's size, resources, complexity and business model; the amount and sensitivity; the adverse consequences of a breach; the time and cost, which do not excuse a step unless the burden is excessive; and whether the measure is itself privacy invasive. In all cases the page says reasonable steps should include governance, culture and training; internal policies, procedures and systems; ICT security; access security; third party providers including cloud computing; data breaches; physical security; destruction and de-identification; and standards. Technical and organisational measures are required. Examples of technical measures are securing access to premises, encrypting data, anti-virus software and strong passwords. Examples of organisational measures are staff training and standard operating procedures and policies. Once the information is no longer needed for any purpose for which it may be used or disclosed under the principles, reasonable steps must be taken to destroy it or ensure it is de-identified, unless it is in a Commonwealth record or an Australian law or a court or tribunal order requires it to be retained. Principle 11.3, that reasonable steps include technical and organisational measures, applies to personal information held from 11 December 2024 regardless of when it was acquired. Destruction means it can no longer be retrieved. Putting hard-copy information in garbage or recycling is not ordinarily reasonable unless it has already been pulped, burned, pulverised, disintegrated or shredded. Electronic information is sanitised or irretrievably destroyed. Where irretrievable destruction is not possible, which the page expects only in very limited circumstances, reasonable steps include putting it beyond use: the organisation is not able and will not attempt to use or disclose it, cannot give any other entity access, surrounds it with appropriate technical, physical and organisational security including access controls, logs and audit trails, and commits to destroy it when that becomes possible. Where a third party holds it, reasonable steps include verifying that destruction or de-identification occurred. De-identified, in section 6(1), means the information is no longer about an identifiable individual or an individual who is reasonably identifiable. The tool does not decide whether a dataset is de-identified for a release. The Guide to Securing Personal Information was not opened.
- What the lawyer does: The lawyer decides whether the steps are reasonable, whether the information is still needed, and whether destruction or de-identification has been achieved.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Treat information a contractor stores as held if the entity can still deal with it.
2. Match the controls to misuse, interference, loss, unauthorised access, unauthorised modification and unauthorised disclosure, using both technical and organisational measures.
3. If it is no longer needed, record the duty to destroy or de-identify unless it is a Commonwealth record or the law or an order requires retention. Do not decide that a dataset is de-identified.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC: Chapter 11, Australian Privacy Principle 11](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) (checked 2026-10-22)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/privacy-data-protection-and-cyber/check-reasonable-steps-to-protect-personal-information-that-is-held/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*