APP 11 — security of personal information

Australian Privacy Principle 11 sits in Schedule 1 of the Privacy Act 1988. An APP entity that holds personal information must take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure (APP 11.1). Separately, once the information is no longer needed for a purpose permitted under the APPs, the entity must take reasonable steps to destroy it or ensure it is de-identified (APP 11.2), unless an Australian law or a court/tribunal order requires retention.

Holds is broader than a rack you own. Under s 6(1), an entity holds personal information if it has possession or control of a record that contains it. OAIC Chapter 11 is explicit that outsourcing storage does not end APP 11 if you retain the right to deal with the information — including access and amendment. The cloud contract is not a privacy off-switch.

Reasonable steps are contextual: the amount and sensitivity of the information, the harm that could result from compromise, who you are, how hard protection is, and the cost. APP 11.3 says those steps include technical and organisational measures. Per the OAIC Guide to securing personal information, APP 11.3 applies to information held after 11 December 2024, regardless of whether the information was acquired or created before or after that commencement. OAIC examples of technical measures include access control to premises, encryption, anti-virus, and strong authentication; organisational measures include training, standard operating procedures, and policies for securing personal information. Layer them. A single control is a single point of failure.

APP 11.2 is the retention cut. OAIC guidance treats destruction as irretrievable — personal information is destroyed when it can no longer be retrieved. Map systems that hold personal information, set retention that matches a permitted purpose (or a retention law), and destroy or de-identify on exit from that purpose. Backups, ticket attachments, and vendor exports count. A retention schedule without a destroy job is not a reasonable step.

APP 11 is not the Notifiable Data Breaches scheme. NDB is what you do after an eligible breach. APP 11 is the duty to reduce the chance of that breach and to stop keeping data you no longer need. Pair this page with the NDB clock, the serious-harm test, and your data-breach response plan. Primary: OAIC APP Guidelines Chapter 11 (v1.3, updated 3 October 2025) and the OAIC Guide to securing personal information.