This guide is intended for use by entities1 covered by the Privacy Act, including organisations, agencies, credit reporting bodies (CRBs), credit providers and tax file number recipients.2 However, this guide may also be relevant to organisations not subject to the Privacy Act as a model for better personal information security practice.
This guide is not legally binding. However, the Office of the Australian Information Commissioner (OAIC) will refer to this guide when undertaking its Privacy Act functions, including when investigating whether an entity has complied with its personal information security obligations (s 40) or when undertaking an assessment (s 33C). Information on when and how we might exercise our regulatory powers is available in the OAIC’s Privacy regulatory action policy.
If you can spare a few dollars for the creators of this website to continue their research to bring you more great content, any amount, no matter how great or small, would be greatly appreciated.