Privacy Impact Assessment
A Privacy Impact Assessment is a process that identifies and reduces privacy risks associated with projects or data handling. It helps Australian businesses comply with the Privacy Act 1988 and the Australian Privacy Principles.
A tool to help businesses identify and reduce privacy risks when handling personal information. It ensures you meet Australian legal standards.
20 free credits on signup — no card needed
About this Document
A Privacy Impact Assessment is a practical tool used by Australian businesses to identify, assess and mitigate privacy risks. It is not just a paperwork exercise. It is a way to look closely at your projects and your daily operations to see how they affect the privacy of personal information. In Australia, privacy is a serious matter. The Privacy Act 1988 sets the rules. This Act includes the Australian Privacy Principles. These principles apply to many private sector businesses, especially those with an annual turnover of more than 3 million dollars. However, even small businesses and sole traders must follow the Act if they trade in personal information or provide a health service. If you run a trade business, a construction company or a consultancy, you likely hold personal details about your clients, your employees and your suppliers. This information might include names, addresses, phone numbers, tax file numbers and bank account details. You might even hold sensitive information like health records or medical history. If you lose this data or if someone steals it, the damage to your reputation can be severe. You might face legal action. You might face financial penalties. This is where a Privacy Impact Assessment helps you. It forces you to stop and think before you start a new project. You use it when you plan to change how you handle data. You use it when you buy new software. You use it when you change your website. The assessment helps you see the risks early. You can then put steps in place to fix the problems before they happen. Completing a Privacy Impact Assessment is about good business practice. It shows your clients that you take their privacy seriously. It builds trust. In the current digital age, trust is a valuable commodity. Clients need to know that their details are safe with you. They need to know you will not share their data without asking them first. They need to know you will keep their data secure from hackers. The Privacy Act 1988 requires you to take reasonable steps to protect the personal information you hold. A Privacy Impact Assessment helps you document those steps. It provides evidence that you have done your homework. If the Office of the Australian Information Commissioner ever investigates your business, this assessment will be your first line of defence. It shows you acted responsibly. You do not need a lawyer to complete a basic Privacy Impact Assessment. You can do it yourself. The process involves a few clear steps. First, you must describe the project. What are you doing? Why are you doing it? Second, you must identify the personal information involved. What data are you collecting? Where does it come from? Third, you must assess the risks. What could go wrong? How could the data be misused? Fourth, you must consider the privacy principles. Does your project comply with the Australian Privacy Principles? Fifth, you must plan your mitigation strategies. How will you reduce or eliminate the risks? Finally, you must sign off on the assessment and review it regularly. Australian tradespeople and small business owners might think this sounds complicated. It is not. Think of it like a safety checklist for a job site. You would not start a demolition job without checking for asbestos or live wires. You should not start a data project without checking for privacy risks. The risks are real. Data breaches can happen to anyone. A lost laptop, a hacked email account or a misplaced file can lead to a breach. Under the Notifiable Data Breaches scheme, you must tell people if their data is lost in a serious breach. This is a legal requirement. If you fail to notify, you can face heavy fines. A Privacy Impact Assessment helps you avoid these situations. It highlights where your security is weak. Maybe you are storing customer files on an unsecured USB drive. Maybe your staff share passwords. Maybe your website does not use encryption. The assessment will catch these issues. You can then fix them. Common mistakes to avoid include rushing the process. Do not just tick boxes to say you did it. You must actually think about the answers. Another mistake is ignoring the context. Think about the people whose data you hold. How would they feel if they knew you were sharing it? Another mistake is failing to consult. Talk to your staff. They know how the data is actually used on the ground. Talk to your IT provider. They know about technical risks. You should also be aware of other laws that interact with privacy. The Fair Work Act 2009 sets out rules about employee records. These records are often exempt from the Privacy Act, but you still need to handle them with care. The Corporations Act 2001 sets out director duties. Directors must act with due care and diligence. Ignoring data privacy could be a breach of that duty. The Privacy Act 1988 requires you to handle personal information openly and transparently. You must have a clear Privacy Policy. Your Privacy Impact Assessment checks whether your actual practices match your policy. For example, your policy might say you only collect data that is necessary. But your new contact form might ask for irrelevant details like date of birth or marital status. This is a problem. The assessment will flag it. You can then remove the unnecessary questions. This reduces your risk. The Australian Privacy Principles also give people the right to access their data. Your project must not make this hard. If you move your data to a new system, you must ensure people can still ask for a copy. The assessment helps you check this. When you write a Privacy Impact Assessment, use plain English. Do not use legal jargon. Write clearly so anyone in your business can understand it. The assessment is a living document. It changes as your project changes. If you find a new risk later on, update the assessment. If you finish the project and start a new one, do a new assessment. Businesses in the building and construction industry deal with many subcontractors. You often share client details with these subcontractors so they can do the job. This creates a privacy risk. You are responsible for the data until it is destroyed. Your assessment must cover how you share data. Do you use a secure portal? Or do you just send a PDF via email? Sending sensitive documents via standard email is risky. The assessment helps you choose a safer method. You should also consider the Spam Act 2003. This law regulates commercial electronic messages. If you use email marketing, you need consent. Your Privacy Impact Assessment can check if you have that consent. It can check if you offer an unsubscribe option. This links privacy with marketing compliance. The Australian Consumer Law also applies. You must not mislead your customers about how you use their data. If you say you will not sell their data and then you do, you are breaking the law. Your assessment helps ensure your marketing claims are true. For small businesses, the cost of a data breach can be crippling. You might have to pay for credit monitoring for affected customers. You might lose contracts. You might lose customers. The time spent dealing with a breach takes you away from your actual work. Doing a Privacy Impact Assessment is a cost effective way to insure against this. It is preventative maintenance. It is like servicing your ute. You do it to keep running smoothly. You do not wait for the engine to seize. The Privacy Act 1988 includes 13 Australian Privacy Principles. Principle 1 is about open and transparent management of personal information. Principle 2 is about anonymity and pseudonymity. Principle 3 is about collection of solicited personal information. Principle 4 is about unsolicited personal information. Principle 5 is about notification of the collection of personal information. Principle 6 is about the use or disclosure of personal information. Principle 7 is about direct marketing. Principle 8 is about cross-border disclosure of personal information. Principle 9 is about data quality. Principle 10 is about data security. Principle 11 is about access to personal information. Principle 12 is about correction of personal information. Your Privacy Impact Assessment should check your project against these principles. You do not need to write a long essay on each one. You just need to show you have considered them. For example, under Principle 6, you need a lawful reason to use or disclose the data. Your assessment should list that reason. Is it for the primary purpose of the service? Is it for a secondary purpose that the person would reasonably expect? If you are not sure, do not do it. Seek consent first. The assessment creates a paper trail. It shows you asked these questions. It shows you made a reasoned decision. This is vital if something goes wrong later. If you are a sole trader, you might feel you have no one to answer to. But you answer to your clients. You answer to the law. A Privacy Impact Assessment protects you and your business. It helps you sleep at night knowing you have done the right thing. It is a sign of professional maturity. It shows you are ready to grow. In summary, a Privacy Impact Assessment is a necessary part of running a modern Australian business. It helps you comply with the Privacy Act 1988. It helps you manage risks. It builds trust. It is not hard to do. It just requires time and attention to detail. Start by looking at the personal information your business holds. Ask yourself how it flows through your business. Ask yourself where the weak points are. Then document your findings. Create a plan to fix the issues. Review the plan regularly. This is the path to good privacy governance.
Key Facts
- A Privacy Impact Assessment helps identify and mitigate risks to personal information.— Office of the Australian Information Commissioner (OAIC)
- The Privacy Act 1988 regulates how private sector organisations handle personal information.— Privacy Act 1988 (Cth)
- Businesses with an annual turnover of more than 3 million dollars must comply with the Privacy Act.— Privacy Act 1988 (Cth)
- The Notifiable Data Breaches scheme requires reporting of eligible data breaches.— Privacy Amendment (Notifiable Data Breaches) Act 2017
- Australian Privacy Principles set out standards for the collection, use and disclosure of personal information.— Privacy Act 1988 (Cth)
- Employee records are generally exempt from the Privacy Act but still require secure handling.— Fair Work Act 2009 (Cth)
- You must take reasonable steps to destroy or de-identify personal information when no longer needed.— Australian Privacy Principle 11
Sources
Required Sections
Project Overview
This section defines the scope of the project. It describes what the business intends to do and why the project is necessary.
To get a clear picture of your privacy obligations, you must first draw a line around your project. This process is called scoping. It stops you from looking at the whole business when you only need to assess one change. You need to be specific about what you are doing and why you are doing it.
Start by listing the project objectives. Write down exactly what the new project, system, or process aims to achieve. Avoid vague goals like "improving efficiency." Instead, be direct. For example, state if you are "implementing a new customer booking app" or "digitising employee job sheets." If your project changes how you handle personal information, you must note it. Under the Privacy Act 1988 (Cth), you must handle personal information correctly. Knowing the "why" helps you justify the data you collect later. If you cannot explain why a specific objective requires certain data, you probably should not collect it.
Next, identify the data involved. You must list the types of personal information your project will use. In Australia, personal information is any information that identifies you. This includes names, phone numbers, email addresses, and photos. You also need to consider sensitive information. This is a special category under the Act that includes health records, medical history, and trade union membership. For tradespeople, this often appears when you take photos of a job site that show people or when you keep records of a client's specific medical conditions for safety reasons.
You should document where the data comes from and where it goes. Do you collect it directly from the client, or do you get it from a third party like a property manager? Will you share it with subcontractors or cloud service providers? If your project involves sending data overseas, the Australian Privacy Principles (APPs) impose strict rules on how you handle that transfer.
Be clear about what you are excluding from the assessment too. If you are updating your invoicing software but leaving your payroll system untouched, state that the payroll system is out of scope. This keeps your assessment focused and manageable. Accurate scoping ensures you comply with the Notifiable Data Breaches (NDB) scheme requirements because you will know exactly what data you hold. If you do not know what data you have, you cannot protect it properly.
Data Flows and Collection
This section maps out how personal information moves through the business. It covers collection, storage, access and disposal.
Start by listing every point where your business collects personal information. You must include this information in your Privacy Policy, as required by the Privacy Act 1988 (Cth). Do not just guess. Walk through a typical day. Write down when you take details over the phone, when clients fill out a quote form on your website, or when you save contact info from a job sheet. If you use apps like ServiceM8 or Xero, check what customer data they pull in. You need to know exactly what you have before you can protect it.
Next, map out where the data goes once you have it. This is the "flow" part of the assessment. If you write down a customer's address in a notebook and then type it into your accounting software, that is a data flow. If you email a client invoice that includes their name and service history to your bookkeeper, that is another flow. For small businesses, data often moves between people, devices, and cloud storage. Sketch a simple diagram if it helps. Show the journey from the initial collection point, through your internal systems like tablets or computers, and out to any third parties such as subcontractors, suppliers, or the Australian Taxation Office.
You must identify all third parties who receive this data. Under the Notifiable Data Breaches scheme, you are responsible for how these third parties handle the information. Check if you share data with payment gateways like Stripe or PayPal. Check if you share client lists with manufacturers for warranty purposes. List every external recipient.
Finally, determine the end of the data lifecycle. Australian Privacy Principle 11 requires you to destroy or de-identify personal information when it is no longer needed. Do not keep old client files forever just in case. Define a retention period. For example, you might keep tax records for seven years as required by law, but delete a quote request from a non-customer after one year. Write down how you delete the data. It is not enough to drag a file to the recycle bin on your computer. You should use secure deletion software or shred physical paperwork. This complete map ensures you handle personal information lawfully from start to finish.
Privacy Issues and Risks
This section identifies specific privacy risks. It looks at what could go wrong and the potential impact on individuals.
Identifying privacy risks involves looking at how personal information flows through your business and finding where things could go wrong. You need to think about the information you collect on job cards, quote forms, and customer relationship management (CRM) software. Under the Privacy Act 1988 (Cth), you must take reasonable steps to protect this data.
Unauthorised Access This happens when someone who should not see the information gets hold of it. Think about who has the keys to your work van, but for your digital files. If you leave a paper client file on the front seat of your ute or share a login to your accounting software with a subcontractor, you are creating a risk. Another common issue is using unsecured Wi-Fi at a cafe to email client quotes. Hackers can intercept that data. You must ask yourself who has access to customer lists and if they actually need it.
Data Loss Data loss occurs when information is accidentally deleted, destroyed, or corrupted. For a tradesperson, this might look like dropping a phone in a bucket of water and losing all your contacts for the week because there was no backup. It could also be a laptop left in a hot car that fails, taking years of invoices and client history with it. Without a secure backup plan on the cloud or a separate hard drive, this risk is high.
Misuse of Information Misuse is using personal information for a purpose other than what it was collected for. If you collect a customer's email address to send a quote but then add them to a marketing newsletter list without their permission, that is misuse. Using customer details to check social media profiles for non-work reasons is another example.
Examples of Risk Levels
-
High Risk You store client credit card details and building plans in a shared Google Drive that is not password protected. Anyone with the link can download, copy, or share sensitive financial data. This could lead to identity theft or financial fraud for your clients. This is a high risk because the impact is severe and the security is non-existent.
-
Low Risk You keep a paper notebook of customer names and phone numbers in a locked drawer in your office van. Only you have the key. While the notebook could be lost or stolen, the limited amount of information and the physical security measure make this a lower risk scenario. However, you should still consider digitising and securing this data eventually.
Compliance and Legislation
This section checks the project against Australian laws. It ensures alignment with the Privacy Act and Australian Privacy Principles.
Check your project against the Australian Privacy Principles
You must check your project against the 13 Australian Privacy Principles (APPs). These rules are in the Privacy Act 1988. If your business has an annual turnover of more than $3 million, or you handle sensitive health data, you must follow this law. Even small businesses handling personal information need to know these rules to stay safe.
APP 1: Open and transparent management You must have a clear privacy policy. Tell your customers what data you collect and why. Put this policy on your website or give it to clients in writing.
APP 2: Anonymity and pseudonymity If possible, let people use your services without giving their full name. If a client asks to remain anonymous, and it is lawful, you must allow it.
APP 3: Collection of solicited personal information Only collect information that is necessary for your job. For a plumber, collect the address and the problem. Do not collect their shopping habits. If you collect data directly from the person, tell them why you need it.
APP 4: Dealing with unsolicited personal information If someone sends you personal information you did not ask for, you must destroy or de-identify it. If you need it for your work, you must treat it as if you collected it under APP 3.
APP 5: Notification of the collection of personal information When you collect data, tell the person who you are and how you will use it. This is often done at the same time as collection.
APP 6: Use or disclosure of personal information Use the information only for the reason you collected it. If you collected a phone number to book a job, do not use it for marketing. Do not sell the data to third parties.
APP 7: Direct marketing You cannot use personal information for direct marketing without consent. There are exceptions, but it is safer to ask first.
APP 8: Cross-border disclosure of personal information If you send data overseas, you must ensure the recipient protects it. This applies if you use cloud servers located outside Australia.
APP 9: Data quality, APP 10: Data security Keep data accurate and up to date. You must protect data from misuse, loss, and unauthorised access. Use strong passwords and secure filing cabinets.
APP 11: Access and correction If a customer asks to see their data, you must give it to them. If the data is wrong, you must correct it.
APP 12: Notification of access You must take reasonable steps to notify a person if you give them access to their information or refuse a request.
APP 13: Handling of complaints Have a simple system to handle privacy complaints. Respond to complaints quickly and investigate the issue. Document your response.
Review against the Privacy Act 1988 Go through each principle and tick it off if your project follows the rule. If you find a gap, change your procedures. The Office of the Australian Information Commissioner (OAIC) can issue fines if you do not comply. Following these standards builds trust and keeps your business legal.
Mitigation Strategies
This section outlines the plan to fix the problems. It lists actions the business will take to reduce the risks.
Create a table to list how you plan to manage each privacy risk you found in your assessment. You must fill out every row for this section to meet the standards set out in the Privacy Act 1988 (Cth). Use three columns for your Risk, Solution, and Person Responsible.
Column 1: The Risk
In the first column, list the specific privacy problem you identified. Be precise. Do not just write "Data breach." Write exactly what could go wrong. For example, write "Customer credit card details stored in a van could be stolen if the vehicle is broken into." Or write "Job site photos containing faces of neighbours are posted on social media without consent." Being specific now helps you fix the problem later.
Column 2: The Solution
In the second column, write the exact steps you will take to stop the risk or reduce the chance of it happening. These steps must show you are taking "reasonable steps" to protect information, as required by Australian Privacy Principle (APP) 11.
If you store paper files, your solution might be to install a lockable cabinet in your secure office. If you use digital tools, the solution might be to enable two-factor authentication and delete customer files from your phone as soon as the job is done. If you collect data on the road, the solution could be using a locked drawer in your utility vehicle. You might also decide not to collect the information at all if it is not essential for the work.
Column 3: Person Responsible
In the third column, name the individual who owns this task. In a small business, this is often the owner or manager. However, if you have office staff or a site supervisor, assign the task to them. You must put a specific name or role here. If you write "anyone", the task will likely get ignored. For example, write "Office Manager" or "Lead Electrician."
Keep this table simple and clear. If the Australian Information Commissioner ever asks to see your records, this table acts as your proof that you understand your obligations under the Notifiable Data Schemes (NDS) and are actively working to protect your clients.
Approval and Sign-off
This section formalises the assessment. It records who approved the plan to go ahead.
Approval and Sign-off
This Privacy Impact Assessment (PIA) is not valid until a senior member of your business signs it off. This final step is essential. It confirms that your business understands the privacy risks involved in your new project and accepts the responsibility for managing them.
For a tradesperson or small business owner, the sign-off usually comes from the Director, Sole Trader, or a designated Business Owner. This person has the legal authority to make decisions about how the business operates and handles customer information. You cannot delegate this legal responsibility to a junior staff member or an external IT provider. The law holds the business accountable, so the ultimate decision-maker must review the findings.
Sign-off proves you have done your due diligence. Under the Privacy Act 1988 (Cth), the Office of the Australian Information Commissioner (OAIC) expects businesses to take reasonable steps to protect personal information. If a data breach occurs, regulators or insurers will ask to see your risk assessments. A signed PIA is concrete evidence that you identified privacy issues and planned to fix them before you started work. Without it, you leave your business open to regulatory fines and potential legal action.
The sign-off also marks the moment the project can proceed. By signing, the business owner agrees that the mitigation strategies listed in this document are sufficient. You are confirming that the remaining risks are acceptable and that you have the budget and resources to implement the security measures. This might mean agreeing to pay for new software, updating customer contracts, or training staff on new data handling rules.
If you work under specific industry regulations, such as the Notifiable Data Breaches (NDB) scheme, a signed record is even more critical. It shows you acted with transparency and accountability.
Keep the signed document with your other important business records. You might need to show it to a client during a tender process, or produce it during an audit. Treat the sign-off as a formal commitment to your customers that their private details are safe in your hands.
Frequently Asked Questions
What is a Privacy Impact Assessment?
When do I need a Privacy Impact Assessment?
Is a Privacy Impact Assessment legally required in Australia?
Who is responsible for completing a Privacy Impact Assessment?
How often should I review a Privacy Impact Assessment?
Do small businesses need to do Privacy Impact Assessments?
What are the consequences of not doing a Privacy Impact Assessment?
Explore More Documents
Ready to create your document?
Use our free template or generate a custom version tailored to your needs.
20 free credits on signup — no card needed
We recommend professional review for your specific situation.