Checklist · Privacy, Data Protection & Cyber
De-identification assessment record before a dataset is shared or released (Privacy Act s 6 definitions)
Record for deciding whether a dataset is de-identified (no longer about an identified or reasonably identifiable individual) before it is shared, sold, published or used to train a model: the data, the release environment, re-identification risks, controls and the decision.
- Kind
- Checklist. Steps or checks to work through and tick off.
- Where it applies
- Australia
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 18 October 2026
- Status
- Maintained. Checked on 18 October 2026 against the 2 authorities it cites, for Australia.
- Version
- 1
- Source
- Written for this library
When to use it
Use before an organisation or agency shares a dataset with a partner, researcher or vendor, publishes open data, or uses data for analytics or AI training on the basis that it is not personal information. If the data is still personal information, the APPs apply to the use or disclosure.
Used for these tasks
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
AI may profile the dataset (fields, rarity of combinations, free text) and list re-identification risk indicators; the privacy officer and the lawyer decide whether individuals are reasonably identifiable in the intended release environment.
AI may
- List fields and classify them as direct identifiers, quasi-identifiers, sensitive attributes or free text
- Count small cells and unique combinations of quasi-identifiers and flag them
- Draft the description of the release environment and controls from the data sharing agreement for checking
AI must not
- Must not decide that the data is de-identified
- Must not attempt to re-identify individuals or link the dataset with outside data except in a controlled test the privacy officer has approved
- Must not be given the identified source data outside an approved environment
The lawyer checks
- Direct identifiers are removed and quasi-identifiers, small cells and free text have been treated
- The assessment considers who will receive the data, what other information they hold or can access, and the controls on them
- The decision and its reasons are recorded, with a review date and a trigger for reassessment if the release environment changes
- If individuals remain reasonably identifiable, the APPs (including APP 6 and, for overseas recipients, APP 8) have been applied to the disclosure
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Response to a request for access to personal information (APP 12), with refusal notice and correction options (APP 13)
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Response to a direct marketing opt-out or source request (APP 7.6 and 7.7)
- Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option
- Notifiable data breach statement to the OAIC: completion guide for the online form
- Does the Privacy Act apply? Small business exemption assessment checklist and advice note (Privacy Act ss 6C to 6EA)
- Employee records exemption: assessment checklist for a planned use of staff information (Privacy Act s 7B(3))
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Letter of demand for a serious invasion of privacy (statutory tort, Privacy Act Sch 2): take-down, undertakings and remedies
- Collection notice (APP 5) for forms, websites, apps and call scripts
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area