Check the steps taken to protect personal information the client holds
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- From the client's security description, mark each of the nine areas named in the chapter as described, partly described, or not mentioned. Leave blank whether the steps are reasonable. The tool does not design the controls.
- What the lawyer must review
- OAIC Chapter 11 says an APP entity that holds personal information must take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. Reasonable steps include technical and organisational measures. What is reasonable depends on the entity's size, resources and complexity, the amount and sensitivity of the information, the harm a breach could cause, and the time and cost of a measure. Inconvenience, time or some cost alone does not excuse a step. The burden must be excessive. A security measure should not itself collect more identity information than is needed. In all cases the chapter says reasonable steps should include strategies for governance, culture and training, internal policies and systems, ICT security, access security, third party providers including cloud computing, data breaches, physical security, destruction and de-identification, and standards. The OAIC Guide to securing personal information was cited and not opened, so no control from that guide is added. This is not a review of a contract clause, and it is not a decision that a breach is notifiable.
- Written for / version
- US
Open a jurisdiction version of this task to see which instruments apply: US
Who does what
| Role | What they do |
|---|---|
| Assistance | Do not begin AI assistance until the responsible lawyer has defined and confirmed its permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Mark the nine areas from the chapter. Do not add controls from the securing guide, which was not opened.
- Sensitive information and a larger holding call for more steps. The definition of sensitive information was not opened.
- A cloud provider does not remove the obligation where the client still holds the information.
- Do not turn this note into incident-notification clauses or a breach assessment.
Sources
These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.