Privacy Act Compliance Checklist for Australian Businesses
Law firms, medical practices, accountants and financial services providers hold some of the most private personal information in the country. This includes client names, addresses, clinical notes, tax file numbers, bank details and file notes about family disputes. The Privacy Act 1988 covers all of it. All of it must be handled, stored and eventually shredded and destroyed.
Privacy law in Australia changed during 2024 and 2025. The rules are broader, the penalties are higher, and people affected by data breaches now have new rights. Most practices do not need a big overhaul. They need simple habits, done every time, and written down so they can show they did them. This checklist covers those habits. It also covers the step practices most often skip: what happens to paper records once no one needs them anymore.
Who the Privacy Act covers
The Privacy Act 1988 contains 13 Australian Privacy Principles, usually called the APPs, which apply to private sector organisations and most government agencies. The Act also includes exemptions, notably for some small businesses, for employee records, and for registered political parties and political acts.
Two things are worth keeping front of mind. First, the small business exemption is narrower than plenty of owners assume, and it does not cover every situation a practice might fall into. Second, the reforms flagged across 2024 and 2025 have been widening obligations and lifting penalties. If you are unsure whether you are covered, treat yourself as covered and verify the position with the OAIC or your legal adviser rather than assuming the exemption applies.
Your Privacy Act compliance checklist
Work through the items below in order. The early steps make the later ones much easier, particularly when you get to destruction and retention.
1. Confirm whether the Act applies to you
Before anything else, determine the applicability of the Privacy Act to your specific business, including any turnover threshold questions and whether any of the exemptions genuinely apply. Write the answer down with the date and the reasoning. If your circumstances change, such as taking on a new type of client or handling health information, revisit that note.
2. Conduct a data mapping exercise
You cannot protect what you cannot find. Map where personal information lives across the practice: client files, appointment systems, cloud storage, email archives, physical filing rooms, archive boxes in storage, reception sign-in sheets and staff mobiles. For each location, note what is held, who can access it, how long it stays there and how it will eventually be disposed of.
3. Review your collection notices and privacy policy
Your privacy policy should reflect what you actually do, not what you did five years ago. Check that your collection notices explain what you collect, why, who you share it with and how someone can access or correct it. If you have started using a new practice management system or a new shredding provider, the policy probably needs a small update.
4. Lock down storage and access
Paper is often the weakest link, because a filing cabinet does not send an alert when a drawer is left open. Limit who has keys to storage rooms, keep archive boxes labelled and tracked, position locked consoles where documents can be dropped without sitting on desks overnight, and make sure cleaners and tradespeople cannot wander through record areas unescorted.
5. Destroy what you no longer need
Retention without destruction is just hoarding with extra risk. Once the retention period for a file has passed, dispose of it through a method that cannot be reconstructed. That means cross-cut shredding or a certified destruction service, not a recycling bin and not a cheap home shredder that produces strips. Record what was destroyed, when, and by whom.
6. Know your breach response
If personal information is lost, accessed or disclosed in a way that creates serious harm, you need to know who decides what happens next before the phone starts ringing. Nominate a contact, keep an incident log, and write a short response plan covering containment, assessment, notification and the role of the OAIC. Test the plan once a year with a simple tabletop exercise.
7. Train your team and review annually
Most privacy incidents are small human moments: a file emailed to the wrong client, a laptop left in a car, a box of superseded records put out with the recycling. Fifteen minutes at a team meeting on secure handling and destruction, repeated each year, does more than a policy sitting unread in a shared drive. Diarise a review of the whole checklist yearly, or whenever the Act changes.
Record retention: when to keep and when to shred
Retention periods vary by profession, engagement type and the purpose the record was created for. The table below gives the general trigger points most practices work from. Confirm the specific periods that apply to your industry with your professional body, your insurer and the relevant regulator before destroying anything.
Record type | Keep while | Destroy when |
|---|---|---|
Legal client matter files | The matter is active and your professional body’s retention standard is running | The standard has been met and no dispute or appeal is on foot |
Medical and clinical records | The patient is under your care, per your college’s standard | The retention standard for that record type is reached |
Accounting and tax working papers | The engagement is open and record-keeping obligations are satisfied | Obligations are met and the client relationship has ended |
Financial services and lending files | The client relationship is active and licensee policy is met | Policy period has ended and no complaint is open |
Duplicate copies, superseded drafts, faxes and printouts | Never | As soon as the final version is saved |
That last row is where most practices claw back the most risk and the most space. You do not need three copies of a settlement statement, and you certainly do not need last year’s superseded appointment lists sitting in a reception drawer.
Why a Certificate of Destruction matters
Compliance is not just about doing the right thing, it is about being able to show you did it. If a client later asks what happened to their file, or an insurer asks how records were disposed of, a certificate confirming the date and method of destruction closes that conversation in seconds. It is also a tidy way to demonstrate accountability under the APPs without asking anyone to take your word for it.
How Proshred fits into a compliance routine
We provide secure document shredding and destruction for businesses and residents across Sydney, Penrith, the Blue Mountains and Western Sydney. That includes scheduled and one-off shredding, archive box collections, and locked console or bin placement so staff have somewhere secure to drop sensitive paper every day rather than letting it stack up.
Our process is built for practices that need to prove what happened to their records. Staff are police-checked, vehicles are GPS-tracked, and sites are covered by video surveillance. Every job finishes with a Certificate of Destruction, and the shredded material is recycled.
For a practice managing the checklist above, a regular collection is usually the simplest option: bins on site for day-to-day paper, a scheduled purge for closed files, and paperwork on file that satisfies both your insurer and your privacy obligations.
Frequently Asked Questions
Does the Privacy Act apply to small businesses?
The Act contains exemptions for some small businesses, along with separate exemptions for employee records and for registered political parties and political acts. The exemptions are narrower than many owners expect, and the requirements have been expanding through recent reforms. Check your position with the OAIC or a legal adviser rather than assuming you are outside the Act.
How long should we keep client records before shredding them?
There is no single answer, because retention periods depend on your profession, the type of engagement and your insurer’s requirements. Confirm the specific period with your professional body and the relevant regulator, diarise the destruction date when a file closes, and shred as soon as that period ends rather than letting boxes accumulate indefinitely.
Can we just put old files in the recycling bin?
No. Recycling bins are accessible to staff, cleaners and anyone who passes the loading dock, and paper in a bin can be read in full. Secure destruction means the document is destroyed.
What is a Certificate of Destruction?
It is a document issued after your material has been destroyed, confirming when it happened and how. It gives you a written record of the destruction date & time.
