Checklist · Privacy, Data Protection & Cyber
Security and destruction of personal information under APP 11
Checklist of APP 11.1 and APP 11.2 from the OAIC chapter updated on 3 October 2025, including the matters the chapter says bear on reasonable steps.
- Kind
- Checklist. Steps or checks to work through and tick off.
- Where it applies
- Australia, Commonwealth
- AI use
- Yellow You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at
- 22 October 2026
- Status
- Maintained. Checked on 22 October 2026 against the authority it cites, for Australia and Commonwealth.
- Version
- 1
- Source
- Written for this library
When to use it
Use when reviewing how an APP entity protects personal information it holds, or when personal information may no longer be needed for a permitted purpose.
Used for these tasks
- Build a vendor AI and subprocessors risk questionnaire
- Assess privacy compliance of a commercially available AI product
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
AI may list the systems, suppliers and retention notes already on the file against the chapter's headings, and the lawyer decides whether the steps are reasonable and whether information is still needed.
AI may
- List the systems and third parties named in the file that hold the personal information
- Record any stated retention period and any law the file says requires retention
- Note whether the entity is described as an agency holding a Commonwealth record
AI must not
- Must not decide that the steps taken are reasonable
- Must not decide that information is no longer needed
- Must not treat putting electronic information beyond use as available unless the lawyer finds the limited case in the chapter
The lawyer checks
- The entity holds the information, in the sense of possession or control of a record
- The steps cover the kinds of misuse, interference, loss and unauthorised access, modification or disclosure that the holdings present
- Destruction or de-identification is considered once the information is no longer needed, subject to APP 11.2's exceptions
- APP 11.3, which the footnote says applies to personal information held from 11 December 2024, is taken into account
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is available after you log in. It is free. When you log in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Response to a request for access to personal information (APP 12), with refusal notice and correction options (APP 13)
- Cross-border disclosure of personal information under APP 8
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Response to a direct marketing opt-out or source request (APP 7.6 and 7.7)
- OAIC privacy complaint form
- CCPA privacy policy
- Incident response plan outline
- Use or disclosure of personal information under APP 6
- Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option
- OAIC privacy complaint authorised representative form
- Notifiable data breach statement to the OAIC: completion guide for the online form
- Does the Privacy Act apply? Small business exemption assessment checklist and advice note (Privacy Act ss 6C to 6EA)
- Breach notice with a statute checklist
- Notice at collection
- Employee records exemption: assessment checklist for a planned use of staff information (Privacy Act s 7B(3))
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Letter of demand for a serious invasion of privacy (statutory tort, Privacy Act Sch 2): take-down, undertakings and remedies
- Consumer request response
- Service-provider safeguards addendum
- Collection notice (APP 5) for forms, websites, apps and call scripts
- De-identification assessment record before a dataset is shared or released (Privacy Act s 6 definitions)
- Critical infrastructure cyber incident reporting clocks
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- California security breach notice
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area