---
title: "Security and destruction of personal information under APP 11"
url: "https://ailawframework.com/precedents/privacy-data-protection-and-cyber/app-11-security-steps"
type: "precedent"
site: "AI Law Framework"
id: "a25-app-11-security-steps"
area_id: "A25"
kind: "checklist"
ai_level: "yellow"
version: 1
task_ids: ["A25-T1-R5", "A25-B8-1"]
law_stated_as_at: "2026-10-22"
---

# Security and destruction of personal information under APP 11

> Checklist of APP 11.1 and APP 11.2 from the OAIC chapter updated on 3 October 2025, including the matters the chapter says bear on reasonable steps.

Canonical page: https://ailawframework.com/precedents/privacy-data-protection-and-cyber/app-11-security-steps  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Privacy, Data Protection & Cyber](https://ailawframework.com/precedents/privacy-data-protection-and-cyber.md)
- Jurisdictions: Australia, Commonwealth
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the authority it cites, for Australia and Commonwealth.

## When to use it

Use when reviewing how an APP entity protects personal information it holds, or when personal information may no longer be needed for a permitted purpose.

## Used for these tasks

- [Build a vendor AI and subprocessors risk questionnaire](https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-vendor-ai-and-subprocessors-risk-questionnaire.md)
- [Assess privacy compliance of a commercially available AI product](https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-privacy-compliance-of-a-commercially-available-ai-product.md)

## How AI may be used

AI may list the systems, suppliers and retention notes already on the file against the chapter's headings, and the lawyer decides whether the steps are reasonable and whether information is still needed.

**AI may:**

- List the systems and third parties named in the file that hold the personal information
- Record any stated retention period and any law the file says requires retention
- Note whether the entity is described as an agency holding a Commonwealth record

**AI must not:**

- Must not decide that the steps taken are reasonable
- Must not decide that information is no longer needed
- Must not treat putting electronic information beyond use as available unless the lawyer finds the limited case in the chapter

**The lawyer checks:**

- The entity holds the information, in the sense of possession or control of a record
- The steps cover the kinds of misuse, interference, loss and unauthorised access, modification or disclosure that the holdings present
- Destruction or de-identification is considered once the information is no longer needed, subject to APP 11.2's exceptions
- APP 11.3, which the footnote says applies to personal information held from 11 December 2024, is taken into account

## Authorities

- [OAIC, APP Guidelines, Chapter 11: APP 11 Security of personal information, updated 3 October 2025](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/privacy-data-protection-and-cyber/app-11-security-steps and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*