Protect your customers' information

Under the Privacy Act 1988, you may be required to protect your customers’ personal information from:

• theft
• misuse
• interference
• loss
• unauthorised access
• modification
• disclosure.

When you no longer need your customers’ personal information, you must destroy or de-identify it.

If your business has an annual turnover of more than $3 million, you must comply with the Privacy Act.

Some businesses with smaller turnovers still need to comply with the Privacy Act. For example, you must comply with the Act if you’re a:

• private sector health service provider. This includes complementary therapists, gyms, weight loss clinics, childcare centres and private education providers
• business that sells or buys personal information
• contractor providing services under a contract with the Australian Government
• credit provider or credit reporting body
• residential tenancy database operator.

Personal information is any information that could be used to identify a person. It doesn’t matter if the information is true or what form it’s in.

Personal information might include your customers’:

• name
• signature
• address, email or phone number
• date of birth
• medical records
• bank details
• photos and videos
• IP address
• opinions that could be used to identify them.

If the Privacy Act covers your business, you need to comply with the Australian Privacy Principles (APPs). These outline how you must handle, use and manage personal information. You can check the APPs quick reference and APP guidelines to understand your responsibilities.

Even if the Privacy Act doesn’t cover your business, you can follow the APPs to protect your customers’ personal information.

You need to have a clear and up-to-date privacy policy. This outlines:

• the information you collect
• what you use it for
• how you protect it.

You might like to get legal advice when drafting your privacy policy.

It's a good idea to publish your privacy policy on your website.

If your business is covered by the Privacy Act, you need to comply with the Notifiable Data Breaches scheme.

If a data breach involves personal information and is likely to cause serious harm to someone, you need to notify both the:

• person involved
• Office of the Australian Information Commissioner (OAIC).