# Australia Privacy Act Compliance Workflow Reference

## Workflow 1: APP Compliance Assessment

### Step 1 — Determine Applicability
1. Does the organisation have an annual turnover exceeding AUD 3 million? If yes → fully subject.
2. Is the organisation a health service provider, credit reporting body, or trading in personal information? If yes → fully subject regardless of turnover.
3. Is the organisation a federal government agency? If yes → subject to APPs.

### Step 2 — Map Collection and Use
1. Identify all personal information collected.
2. Map each collection to a permitted purpose (APP 3: reasonably necessary for functions/activities).
3. Identify sensitive information requiring explicit consent.
4. Document use and disclosure purposes per APP 6.
5. Identify cross-border disclosures requiring APP 8 compliance.

## Workflow 2: Automated Decision-Making Compliance (2024)

### Step 1 — Identify Automated Decisions
1. Inventory all systems using personal information for substantially automated decisions.
2. Assess whether each decision significantly affects individual rights or interests.
3. If yes: classify as subject to automated decision-making transparency obligations.

### Step 2 — Impact Assessment
1. Assess the privacy impact of each automated system before deployment.
2. Document: data inputs, logic/algorithms, potential impact on individuals, bias assessment.
3. Implement safeguards: human review mechanism, transparency notices, error correction.

### Step 3 — Transparency and Rights
1. Inform individuals when automated decisions are made about them.
2. Provide meaningful information about the decision process.
3. Enable human review upon request.
4. Maintain records of systems, logic, and decisions for OAIC inspection.

## Workflow 3: Notifiable Data Breach Response

### Day 0 — Awareness/Suspicion
1. Reasonable grounds to suspect an eligible data breach has occurred.
2. 30-day assessment clock starts.

### Days 1-30 — Assessment
1. Determine: what information was involved, how many individuals, likelihood of serious harm.
2. If remedial action taken to prevent serious harm → may not be notifiable.
3. If eligible: prepare notification statement.

### Notification (As soon as practicable after assessment)
1. **OAIC notification**: Submit via the NDB form on the OAIC website.
2. **Individual notification**: Direct notification to affected individuals.
3. **Content**: Description, information involved, recommended steps.
4. If direct notification impracticable: publish on website and take reasonable steps.

## Workflow 4: Data Subject Rights Response

### Access Request (APP 12)
1. Receive request in writing.
2. Verify identity.
3. Provide access within 30 days.
4. May charge a reasonable access charge (not for making the request).
5. If refused: provide written notice with reasons and complaint mechanisms.

### Correction Request (APP 13)
1. Receive correction request.
2. Assess accuracy, completeness, and relevance.
3. If warranted: correct and notify all previous recipients.
4. If refused: provide reasons and attach a statement to the record.

### Erasure Request (2024 Amendment)
1. Receive erasure request.
2. Assess: is the information no longer necessary? Was consent withdrawn? Was it unlawfully collected?
3. If yes: delete or de-identify within a reasonable timeframe.
4. If deletion impracticable: de-identify as an alternative.
5. If refused: provide written reasons.

## Workflow 5: Cross-Border Disclosure (APP 8)

### Step 1 — Assessment
1. Identify the overseas recipient and destination country.
2. Assess whether the recipient is in a prescribed country with substantially similar protections (when prescribed list is published).
3. If not prescribed: take reasonable steps to ensure the recipient will handle information consistently with the APPs.

### Step 2 — Implement Safeguards
1. Execute a contractual arrangement imposing APP-equivalent obligations.
2. Include: purpose limitation, security, breach notification, access/correction facilitation.
3. Conduct periodic review of the recipient's compliance.

### Step 3 — Record and Monitor
1. Maintain records of overseas disclosures per 2024 requirements.
2. Monitor the recipient's compliance.
3. If the recipient breaches the APPs, the disclosing organisation remains liable.