Checklist · Privacy, Data Protection & Cyber
Employee records exemption: assessment checklist for a planned use of staff information (Privacy Act s 7B(3))
Checklist for advising whether a private sector employer’s planned handling of staff information is exempt under s 7B(3): is it the employer, is the person a current or former employee, is the record an employee record, and is the act directly related to the employment relationship and that record.
- Kind
- Checklist. Steps or checks to work through and tick off.
- Where it applies
- Australia
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 18 October 2026
- Status
- Maintained. Checked on 18 October 2026 against the 2 authorities it cites, for Australia.
- Version
- 1
- Source
- Written for this library
When to use it
Use before an employer relies on the employee records exemption for a new use of staff information, such as analytics, AI tools, monitoring, sharing with a related company or a vendor, or disclosure in a sale of business. Agencies, contractors, job applicants and volunteers fall outside the exemption. Workplace surveillance and state laws are separate.
Used for these tasks
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
AI may map the planned use and the data fields involved against the checklist and list each point that needs a decision; the lawyer decides whether each element of s 7B(3) is met for each data flow.
AI may
- List the data fields, sources, recipients and purposes of the planned use from the project documents
- Mark which individuals are current or former employees and which are contractors, applicants or others
- Match each data field to the examples in the definition of employee record for the lawyer to consider
AI must not
- Must not conclude that the exemption applies to a data flow
- Must not treat disclosure to a related company, vendor or purchaser as an act of the employer without the lawyer’s analysis
- Must not process staff records in a tool outside the employer’s approved environment
The lawyer checks
- The person handling the information is the employer (not a related company, recruiter or vendor acting on its own account)
- Each individual is a current or former employee, and each record is an employee record within the s 6 definition
- Each act is directly related to the employment relationship and to the employee record, and not merely to the employer’s other business purposes
- Other obligations have been checked: workplace surveillance laws, the Fair Work Act, health records laws, tax file number rules and the employment contract
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Response to a request for access to personal information (APP 12), with refusal notice and correction options (APP 13)
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Response to a direct marketing opt-out or source request (APP 7.6 and 7.7)
- Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option
- Notifiable data breach statement to the OAIC: completion guide for the online form
- Does the Privacy Act apply? Small business exemption assessment checklist and advice note (Privacy Act ss 6C to 6EA)
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Letter of demand for a serious invasion of privacy (statutory tort, Privacy Act Sch 2): take-down, undertakings and remedies
- Collection notice (APP 5) for forms, websites, apps and call scripts
- De-identification assessment record before a dataset is shared or released (Privacy Act s 6 definitions)
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area