8 entries
Privacy Act APP 11. Reasonable steps to protect personal information you hold, and to destroy or de-identify it when it is no longer needed. Technical and organisational measures (APP 11.3 from 11 Dec 2024). OAIC Chapter 11 + Guide to securing personal information.
From 10 December 2026, an organisation covered by the Privacy Act that lets software, including AI, make or materially shape decisions that significantly affect people must say so in its APP privacy policy. The three-part test, why human review does not get you out of it, what the policy has to list, and a six-week readiness checklist.
Compute on ciphertext and get an encrypted result. The processor never sees the plaintext. Specialised, not a swap for AES.
Healthcare providers, repository and portal operators and contracted service providers registered with My Health Record have a breach duty that sits beside the Privacy Act's Notifiable Data Breaches scheme. It starts on suspicion rather than a serious-harm assessment, it goes to both the Australian Digital Health Agency and the OAIC as soon as practicable, and only the Agency may tell patients. Here is what counts, who you tell, what to include and how it differs from an ordinary NDB.
The Privacy Act gate for an eligible data breach. Reasonable person, more probable than not, s 26WG factors, then remedial action.
What the Privacy Act requires in an eligible-data-breach statement to the OAIC and to individuals — and how to file it on the OAIC online form.
The OAIC now has three levels of enforcement for Privacy Act failures: court-ordered civil penalties for serious or repeated interferences, on-the-spot infringement notices for specific procedural breaches, and compliance notices that tell you what to fix. What triggers each one, what it can cost, and what to check before the OAIC does.
Since 10 June 2025, individuals in Australia can sue for a serious invasion of privacy under Schedule 2 of the Privacy Act 1988. The five elements, why insider snooping and covert recording are the security cases that matter, the exemptions for reporting to police and ASD, the time limits and damages cap, and what to change in your logging and incident playbooks.
Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary