If your business is covered by the Privacy Act, the Australian Privacy Principles (APPs) are the rules you are measured against. There are 13 of them. Most business owners have never read them, which is why they are a useful starting point for any compliance review.

The 13 principles at a glance

  • APP 1: Open and transparent management. Have a clear, current privacy policy and sensible internal practices.
  • APP 2: Anonymity and pseudonymity. Where practical, let people deal with you without giving their name.
  • APP 3: Collection of solicited information. Only collect personal information you reasonably need, and collect it fairly.
  • APP 4: Unsolicited information. Decide what to do with personal information you receive but did not ask for.
  • APP 5: Notification. Tell people what you collect and why, at or before the time you collect it.
  • APP 6: Use and disclosure. Use information only for the purpose you collected it, with limited exceptions.
  • APP 7: Direct marketing. Marketing to people has its own conditions, including a way to opt out.
  • APP 8: Cross-border disclosure. Take care when personal information goes to a recipient overseas.
  • APP 9: Government identifiers. Do not use identifiers like a tax file number as your own customer ID.
  • APP 10: Quality. Keep the information you hold accurate, up to date and complete.
  • APP 11: Security. Protect information from misuse and loss, and destroy or de-identify it when you no longer need it.
  • APP 12: Access. Give people access to their information when they ask.
  • APP 13: Correction. Correct information that is wrong.

Where small businesses usually slip

The same few principles come up again and again: a privacy policy that is out of date or copied from somewhere else (APP 1), no notice at the point where a form collects details (APP 5), customer data kept forever (APP 11) and tools that send data overseas without anyone checking (APP 8).

A practical way to use the list

Print the 13 principles and, next to each one, write one sentence on what your business actually does. Where you cannot write that sentence, you have found a gap. That gap list is the start of your compliance plan, and it is a much smaller job than it looks from the outside.

What to do this week

  • Read your privacy policy against APPs 1, 5 and 6
  • List every form or tool that collects personal information
  • Note who can see customer data and where it is stored
  • Pick the three biggest gaps and fix those first

This is general information, not legal advice. If you are unsure how this applies to your business, speak with a qualified privacy lawyer and see the OAIC guidance.