---
title: "Check the steps taken to protect personal information the client holds"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/check-the-steps-taken-to-protect-personal-information-the-client-holds"
type: "task"
site: "AI Law Framework"
id: "A24-SF20261022-20"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Check the steps taken to protect personal information the client holds

> From the client's security description, mark each of the nine areas named in the chapter as described, partly described, or not mentioned. Leave blank whether the steps are reasonable.…

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/check-the-steps-taken-to-protect-personal-information-the-client-holds  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the client's security description, mark each of the nine areas named in the chapter as described, partly described, or not mentioned. Leave blank whether the steps are reasonable. The tool does not design the controls. |
| What the lawyer must review | OAIC Chapter 11 says an APP entity that holds personal information must take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. Reasonable steps include technical and organisational measures. What is reasonable depends on the entity's size, resources and complexity, the amount and sensitivity of the information, the harm a breach could cause, and the time and cost of a measure. Inconvenience, time or some cost alone does not excuse a step. The burden must be excessive. A security measure should not itself collect more identity information than is needed. In all cases the chapter says reasonable steps should include strategies for governance, culture and training, internal policies and systems, ICT security, access security, third party providers including cloud computing, data breaches, physical security, destruction and de-identification, and standards. The OAIC Guide to securing personal information was cited and not opened, so no control from that guide is added. This is not a review of a contract clause, and it is not a decision that a breach is notifiable. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Source-by-source verification**

Trace relied-on content to independent sources and check for relevant material the output has missed.

- What the AI does: From the client's security description, mark each of the nine areas named in the chapter as described, partly described, or not mentioned. Leave blank whether the steps are reasonable. The tool does not design the controls.
- What the lawyer does: OAIC Chapter 11 says an APP entity that holds personal information must take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. Reasonable steps include technical and organisational measures. What is reasonable depends on the entity's size, resources and complexity, the amount and sensitivity of the information, the harm a breach could cause, and the time and cost of a measure. Inconvenience, time or some cost alone does not excuse a step. The burden must be excessive. A security measure should not itself collect more identity information than is needed. In all cases the chapter says reasonable steps should include strategies for governance, culture and training, internal policies and systems, ICT security, access security, third party providers including cloud computing, data breaches, physical security, destruction and de-identification, and standards. The OAIC Guide to securing personal information was cited and not opened, so no control from that guide is added. This is not a review of a contract clause, and it is not a decision that a breach is notifiable.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Mark the nine areas from the chapter. Do not add controls from the securing guide, which was not opened.
2. Sensitive information and a larger holding call for more steps. The definition of sensitive information was not opened.
3. A cloud provider does not remove the obligation where the client still holds the information.
4. Do not turn this note into incident-notification clauses or a breach assessment.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC: Chapter 11, APP 11 Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) (checked 2026-10-22)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/check-the-steps-taken-to-protect-personal-information-the-client-holds/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*