{"id":"F2017L01396","name":"Privacy (Australian Government Agencies — Governance) APP Code 2017","slug":"privacy-australian-government-agencies-governance-app-code-2017","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":144217,"registerId":"commonwealth-F2017L01396-current","compilationNumber":null,"startDate":"2026-04-03","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Part 1","sectionType":"part","heading":"Introduction","content":"## Part 1—Introduction\n\n## 1 Name\n\n(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.\n\n(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.\n\n## 2 Commencement\n\nThis APP code comes into force on 1 July 2018.\n\n## 3 Authority\n\nThis APP code has been developed under section 26G of the Privacy Act 1988.\n\n4 Preamble\n\nAPP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.\n\nAPP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.\n\n## 5 Definitions\n\n> Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:\n\n> Note: (a) APP code;\n\n> Note: (b) Commissioner;\n\n> Note: (c) personal information;\n\n> Note: (d) privacy impact assessment; and\n\n> Note: (e) sensitive information.\n\nIn this APP code:\n\nAct means the Privacy Act 1988.\n\nAgency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.\n\nAPP means an Australian Privacy Principle as set out in the Act.\n\nhandling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.\n\nOAIC means the Office of the Australian Information Commissioner.\n\nPIA means privacy impact assessment.\n\nPrivacy Champion has the meaning given by section 11.\n\nprivacy management plan has the meaning given by section 9.\n\nPrivacy Officer has the meaning given by section 10.\n\n## 6 Objectives\n\nThe objectives of this APP code are to:\n\n## (a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;\n\n## (b) enhance the privacy capability and accountability of agencies;\n\n## (c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and\n\n## (d) build community trust and confidence in the personal information handling practices of agencies.\n\n## 7 Agencies bound by this APP code\n\nThis APP code is binding on all agencies as defined in section 5 of this APP code.\n\nNote: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.\n\n## 8 Application of this APP code to APP 1.2\n\nFor the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.\n\nNote 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.\n\nNote 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.\n\n  \n\n# Part 2—Privacy management and governance\n\n### 9 Privacy management plan\n\n## (1) An agency must have a privacy management plan.\n\n## (2) A privacy management plan is a document that:\n\n## (a) identifies specific, measurable privacy goals and targets; and\n\n## (b) sets out how an agency will meet its compliance obligations under APP 1.2.\n\n(3) An agency must measure and document its performance against its privacy management plan at least annually.\n\n### 10 Privacy Officer\n\n(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.\n\n(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.\n\n(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.\n\n(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.\n\n(5) An agency must ensure that the following Privacy Officer functions are carried out:\n\n## (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;\n\n(b) maintaining a record of the agency's personal information holdings;\n\n(c) assisting with the preparation of PIAs conducted under section 12;\n\n(d) maintaining the agency’s register of PIAs as required by section 15; and\n\n(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.\n\n### 11 Privacy Champion\n\n(1) An agency must, at all times, have a designated Privacy Champion.\n\n(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.\n\n(3) The Privacy Champion must be a senior official within the agency.\n\n(4) An agency must ensure that the following Privacy Champion functions are carried out:\n\n(a) promoting a culture of privacy within the agency that values and protects personal information;\n\n(b) providing leadership within the agency on broader strategic privacy issues;\n\n(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and\n\n(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.\n\n(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.\n\n  \n\n## PART 3—PIAs\n\n### 12 Conduct of PIA\n\n(1) An agency must conduct a PIA for all high privacy risk projects.\n\n(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.\n\nNote: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.\n\n13 Publication of PIA\n\nAn agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.\n\n14 Joint PIA\n\nIf two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.\n\n15 Register of PIAs\n\n(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.\n\n(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.\n\n## PART 4—Internal privacy capability\n\n### 16 Privacy education and training\n\n(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.\n\n(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.\n\n### 17 Regular review of internal privacy processes\n\n(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:\n\n(a) privacy policy prepared for the purposes of APP 1; and\n\n(b) privacy notice prepared for the purposes of APP 5.\n\n(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.","sortOrder":0},{"sectionNumber":"1","sectionType":"part","heading":"Name","content":"## 1 Name\n\n(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.\n\n(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.","sortOrder":1},{"sectionNumber":"2","sectionType":"part","heading":"Commencement","content":"## 2 Commencement\n\nThis APP code comes into force on 1 July 2018.","sortOrder":2},{"sectionNumber":"3","sectionType":"part","heading":"Authority","content":"## 3 Authority\n\nThis APP code has been developed under section 26G of the Privacy Act 1988.\n\n4 Preamble\n\nAPP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.\n\nAPP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.","sortOrder":3},{"sectionNumber":"5","sectionType":"part","heading":"Definitions","content":"## 5 Definitions\n\n> Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:\n\n> Note: (a) APP code;\n\n> Note: (b) Commissioner;\n\n> Note: (c) personal information;\n\n> Note: (d) privacy impact assessment; and\n\n> Note: (e) sensitive information.\n\nIn this APP code:\n\nAct means the Privacy Act 1988.\n\nAgency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.\n\nAPP means an Australian Privacy Principle as set out in the Act.\n\nhandling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.\n\nOAIC means the Office of the Australian Information Commissioner.\n\nPIA means privacy impact assessment.\n\nPrivacy Champion has the meaning given by section 11.\n\nprivacy management plan has the meaning given by section 9.\n\nPrivacy Officer has the meaning given by section 10.","sortOrder":4},{"sectionNumber":"6","sectionType":"part","heading":"Objectives","content":"## 6 Objectives\n\nThe objectives of this APP code are to:","sortOrder":5},{"sectionNumber":"(a) set out specific requirements that a","sectionType":"part","heading":"(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;","content":"## Part 1—Introduction\n\n## 1 Name\n\n(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.\n\n(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.\n\n## 2 Commencement\n\nThis APP code comes into force on 1 July 2018.\n\n## 3 Authority\n\nThis APP code has been developed under section 26G of the Privacy Act 1988.\n\n4 Preamble\n\nAPP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.\n\nAPP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.\n\n## 5 Definitions\n\n> Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:\n\n> Note: (a) APP code;\n\n> Note: (b) Commissioner;\n\n> Note: (c) personal information;\n\n> Note: (d) privacy impact assessment; and\n\n> Note: (e) sensitive information.\n\nIn this APP code:\n\nAct means the Privacy Act 1988.\n\nAgency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.\n\nAPP means an Australian Privacy Principle as set out in the Act.\n\nhandling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.\n\nOAIC means the Office of the Australian Information Commissioner.\n\nPIA means privacy impact assessment.\n\nPrivacy Champion has the meaning given by section 11.\n\nprivacy management plan has the meaning given by section 9.\n\nPrivacy Officer has the meaning given by section 10.\n\n## 6 Objectives\n\nThe objectives of this APP code are to:\n\n## (a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;\n\n## (b) enhance the privacy capability and accountability of agencies;\n\n## (c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and\n\n## (d) build community trust and confidence in the personal information handling practices of agencies.\n\n## 7 Agencies bound by this APP code\n\nThis APP code is binding on all agencies as defined in section 5 of this APP code.\n\nNote: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.\n\n## 8 Application of this APP code to APP 1.2\n\nFor the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.\n\nNote 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.\n\nNote 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.\n\n  \n\n# Part 2—Privacy management and governance\n\n### 9 Privacy management plan\n\n## (1) An agency must have a privacy management plan.\n\n## (2) A privacy management plan is a document that:\n\n## (a) identifies specific, measurable privacy goals and targets; and\n\n## (b) sets out how an agency will meet its compliance obligations under APP 1.2.\n\n(3) An agency must measure and document its performance against its privacy management plan at least annually.\n\n### 10 Privacy Officer\n\n(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.\n\n(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.\n\n(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.\n\n(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.\n\n(5) An agency must ensure that the following Privacy Officer functions are carried out:\n\n## (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;\n\n(b) maintaining a record of the agency's personal information holdings;\n\n(c) assisting with the preparation of PIAs conducted under section 12;\n\n(d) maintaining the agency’s register of PIAs as required by section 15; and\n\n(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.\n\n### 11 Privacy Champion\n\n(1) An agency must, at all times, have a designated Privacy Champion.\n\n(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.\n\n(3) The Privacy Champion must be a senior official within the agency.\n\n(4) An agency must ensure that the following Privacy Champion functions are carried out:\n\n(a) promoting a culture of privacy within the agency that values and protects personal information;\n\n(b) providing leadership within the agency on broader strategic privacy issues;\n\n(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and\n\n(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.\n\n(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.\n\n  \n\n## PART 3—PIAs\n\n### 12 Conduct of PIA\n\n(1) An agency must conduct a PIA for all high privacy risk projects.\n\n(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.\n\nNote: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.\n\n13 Publication of PIA\n\nAn agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.\n\n14 Joint PIA\n\nIf two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.\n\n15 Register of PIAs\n\n(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.\n\n(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.\n\n## PART 4—Internal privacy capability\n\n### 16 Privacy education and training\n\n(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.\n\n(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.\n\n### 17 Regular review of internal privacy processes\n\n(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:\n\n(a) privacy policy prepared for the purposes of APP 1; and\n\n(b) privacy notice prepared for the purposes of APP 5.\n\n(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.","sortOrder":6},{"sectionNumber":"(b) enhance the privacy capability and a","sectionType":"part","heading":"(b) enhance the privacy capability and accountability of agencies;","content":"## Part 1—Introduction\n\n## 1 Name\n\n(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.\n\n(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.\n\n## 2 Commencement\n\nThis APP code comes into force on 1 July 2018.\n\n## 3 Authority\n\nThis APP code has been developed under section 26G of the Privacy Act 1988.\n\n4 Preamble\n\nAPP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.\n\nAPP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.\n\n## 5 Definitions\n\n> Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:\n\n> Note: (a) APP code;\n\n> Note: (b) Commissioner;\n\n> Note: (c) personal information;\n\n> Note: (d) privacy impact assessment; and\n\n> Note: (e) sensitive information.\n\nIn this APP code:\n\nAct means the Privacy Act 1988.\n\nAgency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.\n\nAPP means an Australian Privacy Principle as set out in the Act.\n\nhandling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.\n\nOAIC means the Office of the Australian Information Commissioner.\n\nPIA means privacy impact assessment.\n\nPrivacy Champion has the meaning given by section 11.\n\nprivacy management plan has the meaning given by section 9.\n\nPrivacy Officer has the meaning given by section 10.\n\n## 6 Objectives\n\nThe objectives of this APP code are to:\n\n## (a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;\n\n## (b) enhance the privacy capability and accountability of agencies;\n\n## (c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and\n\n## (d) build community trust and confidence in the personal information handling practices of agencies.\n\n## 7 Agencies bound by this APP code\n\nThis APP code is binding on all agencies as defined in section 5 of this APP code.\n\nNote: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.\n\n## 8 Application of this APP code to APP 1.2\n\nFor the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.\n\nNote 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.\n\nNote 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.\n\n  \n\n# Part 2—Privacy management and governance\n\n### 9 Privacy management plan\n\n## (1) An agency must have a privacy management plan.\n\n## (2) A privacy management plan is a document that:\n\n## (a) identifies specific, measurable privacy goals and targets; and\n\n## (b) sets out how an agency will meet its compliance obligations under APP 1.2.\n\n(3) An agency must measure and document its performance against its privacy management plan at least annually.\n\n### 10 Privacy Officer\n\n(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.\n\n(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.\n\n(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.\n\n(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.\n\n(5) An agency must ensure that the following Privacy Officer functions are carried out:\n\n## (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;\n\n(b) maintaining a record of the agency's personal information holdings;\n\n(c) assisting with the preparation of PIAs conducted under section 12;\n\n(d) maintaining the agency’s register of PIAs as required by section 15; and\n\n(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.\n\n### 11 Privacy Champion\n\n(1) An agency must, at all times, have a designated Privacy Champion.\n\n(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.\n\n(3) The Privacy Champion must be a senior official within the agency.\n\n(4) An agency must ensure that the following Privacy Champion functions are carried out:\n\n(a) promoting a culture of privacy within the agency that values and protects personal information;\n\n(b) providing leadership within the agency on broader strategic privacy issues;\n\n(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and\n\n(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.\n\n(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.\n\n  \n\n## PART 3—PIAs\n\n### 12 Conduct of PIA\n\n(1) An agency must conduct a PIA for all high privacy risk projects.\n\n(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.\n\nNote: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.\n\n13 Publication of PIA\n\nAn agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.\n\n14 Joint PIA\n\nIf two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.\n\n15 Register of PIAs\n\n(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.\n\n(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.\n\n## PART 4—Internal privacy capability\n\n### 16 Privacy education and training\n\n(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.\n\n(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.\n\n### 17 Regular review of internal privacy processes\n\n(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:\n\n(a) privacy policy prepared for the purposes of APP 1; and\n\n(b) privacy notice prepared for the purposes of APP 5.\n\n(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.","sortOrder":7},{"sectionNumber":"(c) promote good privacy governance with","sectionType":"part","heading":"(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and","content":"## Part 1—Introduction\n\n## 1 Name\n\n(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.\n\n(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.\n\n## 2 Commencement\n\nThis APP code comes into force on 1 July 2018.\n\n## 3 Authority\n\nThis APP code has been developed under section 26G of the Privacy Act 1988.\n\n4 Preamble\n\nAPP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.\n\nAPP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.\n\n## 5 Definitions\n\n> Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:\n\n> Note: (a) APP code;\n\n> Note: (b) Commissioner;\n\n> Note: (c) personal information;\n\n> Note: (d) privacy impact assessment; and\n\n> Note: (e) sensitive information.\n\nIn this APP code:\n\nAct means the Privacy Act 1988.\n\nAgency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.\n\nAPP means an Australian Privacy Principle as set out in the Act.\n\nhandling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.\n\nOAIC means the Office of the Australian Information Commissioner.\n\nPIA means privacy impact assessment.\n\nPrivacy Champion has the meaning given by section 11.\n\nprivacy management plan has the meaning given by section 9.\n\nPrivacy Officer has the meaning given by section 10.\n\n## 6 Objectives\n\nThe objectives of this APP code are to:\n\n## (a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;\n\n## (b) enhance the privacy capability and accountability of agencies;\n\n## (c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and\n\n## (d) build community trust and confidence in the personal information handling practices of agencies.\n\n## 7 Agencies bound by this APP code\n\nThis APP code is binding on all agencies as defined in section 5 of this APP code.\n\nNote: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.\n\n## 8 Application of this APP code to APP 1.2\n\nFor the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.\n\nNote 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.\n\nNote 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.\n\n  \n\n# Part 2—Privacy management and governance\n\n### 9 Privacy management plan\n\n## (1) An agency must have a privacy management plan.\n\n## (2) A privacy management plan is a document that:\n\n## (a) identifies specific, measurable privacy goals and targets; and\n\n## (b) sets out how an agency will meet its compliance obligations under APP 1.2.\n\n(3) An agency must measure and document its performance against its privacy management plan at least annually.\n\n### 10 Privacy Officer\n\n(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.\n\n(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.\n\n(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.\n\n(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.\n\n(5) An agency must ensure that the following Privacy Officer functions are carried out:\n\n## (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;\n\n(b) maintaining a record of the agency's personal information holdings;\n\n(c) assisting with the preparation of PIAs conducted under section 12;\n\n(d) maintaining the agency’s register of PIAs as required by section 15; and\n\n(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.\n\n### 11 Privacy Champion\n\n(1) An agency must, at all times, have a designated Privacy Champion.\n\n(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.\n\n(3) The Privacy Champion must be a senior official within the agency.\n\n(4) An agency must ensure that the following Privacy Champion functions are carried out:\n\n(a) promoting a culture of privacy within the agency that values and protects personal information;\n\n(b) providing leadership within the agency on broader strategic privacy issues;\n\n(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and\n\n(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.\n\n(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.\n\n  \n\n## PART 3—PIAs\n\n### 12 Conduct of PIA\n\n(1) An agency must conduct a PIA for all high privacy risk projects.\n\n(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.\n\nNote: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.\n\n13 Publication of PIA\n\nAn agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.\n\n14 Joint PIA\n\nIf two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.\n\n15 Register of PIAs\n\n(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.\n\n(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.\n\n## PART 4—Internal privacy capability\n\n### 16 Privacy education and training\n\n(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.\n\n(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.\n\n### 17 Regular review of internal privacy processes\n\n(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:\n\n(a) privacy policy prepared for the purposes of APP 1; and\n\n(b) privacy notice prepared for the purposes of APP 5.\n\n(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.","sortOrder":8},{"sectionNumber":"(d) build community trust and confidence","sectionType":"part","heading":"(d) build community trust and confidence in the personal information handling practices of agencies.","content":"## Part 1—Introduction\n\n## 1 Name\n\n(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.\n\n(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.\n\n## 2 Commencement\n\nThis APP code comes into force on 1 July 2018.\n\n## 3 Authority\n\nThis APP code has been developed under section 26G of the Privacy Act 1988.\n\n4 Preamble\n\nAPP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.\n\nAPP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.\n\n## 5 Definitions\n\n> Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:\n\n> Note: (a) APP code;\n\n> Note: (b) Commissioner;\n\n> Note: (c) personal information;\n\n> Note: (d) privacy impact assessment; and\n\n> Note: (e) sensitive information.\n\nIn this APP code:\n\nAct means the Privacy Act 1988.\n\nAgency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.\n\nAPP means an Australian Privacy Principle as set out in the Act.\n\nhandling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.\n\nOAIC means the Office of the Australian Information Commissioner.\n\nPIA means privacy impact assessment.\n\nPrivacy Champion has the meaning given by section 11.\n\nprivacy management plan has the meaning given by section 9.\n\nPrivacy Officer has the meaning given by section 10.\n\n## 6 Objectives\n\nThe objectives of this APP code are to:\n\n## (a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;\n\n## (b) enhance the privacy capability and accountability of agencies;\n\n## (c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and\n\n## (d) build community trust and confidence in the personal information handling practices of agencies.\n\n## 7 Agencies bound by this APP code\n\nThis APP code is binding on all agencies as defined in section 5 of this APP code.\n\nNote: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.\n\n## 8 Application of this APP code to APP 1.2\n\nFor the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.\n\nNote 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.\n\nNote 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.\n\n  \n\n# Part 2—Privacy management and governance\n\n### 9 Privacy management plan\n\n## (1) An agency must have a privacy management plan.\n\n## (2) A privacy management plan is a document that:\n\n## (a) identifies specific, measurable privacy goals and targets; and\n\n## (b) sets out how an agency will meet its compliance obligations under APP 1.2.\n\n(3) An agency must measure and document its performance against its privacy management plan at least annually.\n\n### 10 Privacy Officer\n\n(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.\n\n(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.\n\n(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.\n\n(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.\n\n(5) An agency must ensure that the following Privacy Officer functions are carried out:\n\n## (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;\n\n(b) maintaining a record of the agency's personal information holdings;\n\n(c) assisting with the preparation of PIAs conducted under section 12;\n\n(d) maintaining the agency’s register of PIAs as required by section 15; and\n\n(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.\n\n### 11 Privacy Champion\n\n(1) An agency must, at all times, have a designated Privacy Champion.\n\n(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.\n\n(3) The Privacy Champion must be a senior official within the agency.\n\n(4) An agency must ensure that the following Privacy Champion functions are carried out:\n\n(a) promoting a culture of privacy within the agency that values and protects personal information;\n\n(b) providing leadership within the agency on broader strategic privacy issues;\n\n(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and\n\n(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.\n\n(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.\n\n  \n\n## PART 3—PIAs\n\n### 12 Conduct of PIA\n\n(1) An agency must conduct a PIA for all high privacy risk projects.\n\n(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.\n\nNote: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.\n\n13 Publication of PIA\n\nAn agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.\n\n14 Joint PIA\n\nIf two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.\n\n15 Register of PIAs\n\n(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.\n\n(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.\n\n## PART 4—Internal privacy capability\n\n### 16 Privacy education and training\n\n(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.\n\n(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.\n\n### 17 Regular review of internal privacy processes\n\n(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:\n\n(a) privacy policy prepared for the purposes of APP 1; and\n\n(b) privacy notice prepared for the purposes of APP 5.\n\n(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.","sortOrder":9},{"sectionNumber":"7","sectionType":"part","heading":"Agencies bound by this APP code","content":"## 7 Agencies bound by this APP code\n\nThis APP code is binding on all agencies as defined in section 5 of this APP code.\n\nNote: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.","sortOrder":10},{"sectionNumber":"8","sectionType":"part","heading":"Application of this APP code to APP 1.2","content":"## 8 Application of this APP code to APP 1.2\n\nFor the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.\n\nNote 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.\n\nNote 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.","sortOrder":11},{"sectionNumber":"Part 2","sectionType":"part","heading":"Privacy management and governance","content":"## Part 1—Introduction\n\n## 1 Name\n\n(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.\n\n(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.\n\n## 2 Commencement\n\nThis APP code comes into force on 1 July 2018.\n\n## 3 Authority\n\nThis APP code has been developed under section 26G of the Privacy Act 1988.\n\n4 Preamble\n\nAPP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.\n\nAPP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.\n\n## 5 Definitions\n\n> Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:\n\n> Note: (a) APP code;\n\n> Note: (b) Commissioner;\n\n> Note: (c) personal information;\n\n> Note: (d) privacy impact assessment; and\n\n> Note: (e) sensitive information.\n\nIn this APP code:\n\nAct means the Privacy Act 1988.\n\nAgency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.\n\nAPP means an Australian Privacy Principle as set out in the Act.\n\nhandling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.\n\nOAIC means the Office of the Australian Information Commissioner.\n\nPIA means privacy impact assessment.\n\nPrivacy Champion has the meaning given by section 11.\n\nprivacy management plan has the meaning given by section 9.\n\nPrivacy Officer has the meaning given by section 10.\n\n## 6 Objectives\n\nThe objectives of this APP code are to:\n\n## (a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;\n\n## (b) enhance the privacy capability and accountability of agencies;\n\n## (c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and\n\n## (d) build community trust and confidence in the personal information handling practices of agencies.\n\n## 7 Agencies bound by this APP code\n\nThis APP code is binding on all agencies as defined in section 5 of this APP code.\n\nNote: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.\n\n## 8 Application of this APP code to APP 1.2\n\nFor the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.\n\nNote 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.\n\nNote 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.\n\n  \n\n# Part 2—Privacy management and governance\n\n### 9 Privacy management plan\n\n## (1) An agency must have a privacy management plan.\n\n## (2) A privacy management plan is a document that:\n\n## (a) identifies specific, measurable privacy goals and targets; and\n\n## (b) sets out how an agency will meet its compliance obligations under APP 1.2.\n\n(3) An agency must measure and document its performance against its privacy management plan at least annually.\n\n### 10 Privacy Officer\n\n(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.\n\n(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.\n\n(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.\n\n(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.\n\n(5) An agency must ensure that the following Privacy Officer functions are carried out:\n\n## (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;\n\n(b) maintaining a record of the agency's personal information holdings;\n\n(c) assisting with the preparation of PIAs conducted under section 12;\n\n(d) maintaining the agency’s register of PIAs as required by section 15; and\n\n(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.\n\n### 11 Privacy Champion\n\n(1) An agency must, at all times, have a designated Privacy Champion.\n\n(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.\n\n(3) The Privacy Champion must be a senior official within the agency.\n\n(4) An agency must ensure that the following Privacy Champion functions are carried out:\n\n(a) promoting a culture of privacy within the agency that values and protects personal information;\n\n(b) providing leadership within the agency on broader strategic privacy issues;\n\n(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and\n\n(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.\n\n(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.\n\n  \n\n## PART 3—PIAs\n\n### 12 Conduct of PIA\n\n(1) An agency must conduct a PIA for all high privacy risk projects.\n\n(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.\n\nNote: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.\n\n13 Publication of PIA\n\nAn agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.\n\n14 Joint PIA\n\nIf two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.\n\n15 Register of PIAs\n\n(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.\n\n(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.\n\n## PART 4—Internal privacy capability\n\n### 16 Privacy education and training\n\n(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.\n\n(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.\n\n### 17 Regular review of internal privacy processes\n\n(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:\n\n(a) privacy policy prepared for the purposes of APP 1; and\n\n(b) privacy notice prepared for the purposes of APP 5.\n\n(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.","sortOrder":12},{"sectionNumber":"9","sectionType":"division","heading":"Privacy management plan","content":"## Part 1—Introduction\n\n## 1 Name\n\n(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.\n\n(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.\n\n## 2 Commencement\n\nThis APP code comes into force on 1 July 2018.\n\n## 3 Authority\n\nThis APP code has been developed under section 26G of the Privacy Act 1988.\n\n4 Preamble\n\nAPP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.\n\nAPP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.\n\n## 5 Definitions\n\n> Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:\n\n> Note: (a) APP code;\n\n> Note: (b) Commissioner;\n\n> Note: (c) personal information;\n\n> Note: (d) privacy impact assessment; and\n\n> Note: (e) sensitive information.\n\nIn this APP code:\n\nAct means the Privacy Act 1988.\n\nAgency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.\n\nAPP means an Australian Privacy Principle as set out in the Act.\n\nhandling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.\n\nOAIC means the Office of the Australian Information Commissioner.\n\nPIA means privacy impact assessment.\n\nPrivacy Champion has the meaning given by section 11.\n\nprivacy management plan has the meaning given by section 9.\n\nPrivacy Officer has the meaning given by section 10.\n\n## 6 Objectives\n\nThe objectives of this APP code are to:\n\n## (a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;\n\n## (b) enhance the privacy capability and accountability of agencies;\n\n## (c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and\n\n## (d) build community trust and confidence in the personal information handling practices of agencies.\n\n## 7 Agencies bound by this APP code\n\nThis APP code is binding on all agencies as defined in section 5 of this APP code.\n\nNote: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.\n\n## 8 Application of this APP code to APP 1.2\n\nFor the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.\n\nNote 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.\n\nNote 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.\n\n  \n\n# Part 2—Privacy management and governance\n\n### 9 Privacy management plan\n\n## (1) An agency must have a privacy management plan.\n\n## (2) A privacy management plan is a document that:\n\n## (a) identifies specific, measurable privacy goals and targets; and\n\n## (b) sets out how an agency will meet its compliance obligations under APP 1.2.\n\n(3) An agency must measure and document its performance against its privacy management plan at least annually.\n\n### 10 Privacy Officer\n\n(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.\n\n(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.\n\n(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.\n\n(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.\n\n(5) An agency must ensure that the following Privacy Officer functions are carried out:\n\n## (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;\n\n(b) maintaining a record of the agency's personal information holdings;\n\n(c) assisting with the preparation of PIAs conducted under section 12;\n\n(d) maintaining the agency’s register of PIAs as required by section 15; and\n\n(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.\n\n### 11 Privacy Champion\n\n(1) An agency must, at all times, have a designated Privacy Champion.\n\n(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.\n\n(3) The Privacy Champion must be a senior official within the agency.\n\n(4) An agency must ensure that the following Privacy Champion functions are carried out:\n\n(a) promoting a culture of privacy within the agency that values and protects personal information;\n\n(b) providing leadership within the agency on broader strategic privacy issues;\n\n(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and\n\n(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.\n\n(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.\n\n  \n\n## PART 3—PIAs\n\n### 12 Conduct of PIA\n\n(1) An agency must conduct a PIA for all high privacy risk projects.\n\n(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.\n\nNote: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.\n\n13 Publication of PIA\n\nAn agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.\n\n14 Joint PIA\n\nIf two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.\n\n15 Register of PIAs\n\n(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.\n\n(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.\n\n## PART 4—Internal privacy capability\n\n### 16 Privacy education and training\n\n(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.\n\n(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.\n\n### 17 Regular review of internal privacy processes\n\n(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:\n\n(a) privacy policy prepared for the purposes of APP 1; and\n\n(b) privacy notice prepared for the purposes of APP 5.\n\n(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.","sortOrder":13},{"sectionNumber":"(1) An agency must have a privacy manage","sectionType":"part","heading":"(1) An agency must have a privacy management plan.","content":"## Part 1—Introduction\n\n## 1 Name\n\n(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.\n\n(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.\n\n## 2 Commencement\n\nThis APP code comes into force on 1 July 2018.\n\n## 3 Authority\n\nThis APP code has been developed under section 26G of the Privacy Act 1988.\n\n4 Preamble\n\nAPP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.\n\nAPP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.\n\n## 5 Definitions\n\n> Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:\n\n> Note: (a) APP code;\n\n> Note: (b) Commissioner;\n\n> Note: (c) personal information;\n\n> Note: (d) privacy impact assessment; and\n\n> Note: (e) sensitive information.\n\nIn this APP code:\n\nAct means the Privacy Act 1988.\n\nAgency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.\n\nAPP means an Australian Privacy Principle as set out in the Act.\n\nhandling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.\n\nOAIC means the Office of the Australian Information Commissioner.\n\nPIA means privacy impact assessment.\n\nPrivacy Champion has the meaning given by section 11.\n\nprivacy management plan has the meaning given by section 9.\n\nPrivacy Officer has the meaning given by section 10.\n\n## 6 Objectives\n\nThe objectives of this APP code are to:\n\n## (a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;\n\n## (b) enhance the privacy capability and accountability of agencies;\n\n## (c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and\n\n## (d) build community trust and confidence in the personal information handling practices of agencies.\n\n## 7 Agencies bound by this APP code\n\nThis APP code is binding on all agencies as defined in section 5 of this APP code.\n\nNote: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.\n\n## 8 Application of this APP code to APP 1.2\n\nFor the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.\n\nNote 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.\n\nNote 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.\n\n  \n\n# Part 2—Privacy management and governance\n\n### 9 Privacy management plan\n\n## (1) An agency must have a privacy management plan.\n\n## (2) A privacy management plan is a document that:\n\n## (a) identifies specific, measurable privacy goals and targets; and\n\n## (b) sets out how an agency will meet its compliance obligations under APP 1.2.\n\n(3) An agency must measure and document its performance against its privacy management plan at least annually.\n\n### 10 Privacy Officer\n\n(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.\n\n(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.\n\n(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.\n\n(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.\n\n(5) An agency must ensure that the following Privacy Officer functions are carried out:\n\n## (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;\n\n(b) maintaining a record of the agency's personal information holdings;\n\n(c) assisting with the preparation of PIAs conducted under section 12;\n\n(d) maintaining the agency’s register of PIAs as required by section 15; and\n\n(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.\n\n### 11 Privacy Champion\n\n(1) An agency must, at all times, have a designated Privacy Champion.\n\n(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.\n\n(3) The Privacy Champion must be a senior official within the agency.\n\n(4) An agency must ensure that the following Privacy Champion functions are carried out:\n\n(a) promoting a culture of privacy within the agency that values and protects personal information;\n\n(b) providing leadership within the agency on broader strategic privacy issues;\n\n(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and\n\n(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.\n\n(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.\n\n  \n\n## PART 3—PIAs\n\n### 12 Conduct of PIA\n\n(1) An agency must conduct a PIA for all high privacy risk projects.\n\n(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.\n\nNote: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.\n\n13 Publication of PIA\n\nAn agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.\n\n14 Joint PIA\n\nIf two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.\n\n15 Register of PIAs\n\n(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.\n\n(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.\n\n## PART 4—Internal privacy capability\n\n### 16 Privacy education and training\n\n(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.\n\n(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.\n\n### 17 Regular review of internal privacy processes\n\n(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:\n\n(a) privacy policy prepared for the purposes of APP 1; and\n\n(b) privacy notice prepared for the purposes of APP 5.\n\n(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.","sortOrder":14},{"sectionNumber":"(2) A privacy management plan is a docum","sectionType":"part","heading":"(2) A privacy management plan is a document that:","content":"## Part 1—Introduction\n\n## 1 Name\n\n(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.\n\n(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.\n\n## 2 Commencement\n\nThis APP code comes into force on 1 July 2018.\n\n## 3 Authority\n\nThis APP code has been developed under section 26G of the Privacy Act 1988.\n\n4 Preamble\n\nAPP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.\n\nAPP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.\n\n## 5 Definitions\n\n> Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:\n\n> Note: (a) APP code;\n\n> Note: (b) Commissioner;\n\n> Note: (c) personal information;\n\n> Note: (d) privacy impact assessment; and\n\n> Note: (e) sensitive information.\n\nIn this APP code:\n\nAct means the Privacy Act 1988.\n\nAgency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.\n\nAPP means an Australian Privacy Principle as set out in the Act.\n\nhandling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.\n\nOAIC means the Office of the Australian Information Commissioner.\n\nPIA means privacy impact assessment.\n\nPrivacy Champion has the meaning given by section 11.\n\nprivacy management plan has the meaning given by section 9.\n\nPrivacy Officer has the meaning given by section 10.\n\n## 6 Objectives\n\nThe objectives of this APP code are to:\n\n## (a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;\n\n## (b) enhance the privacy capability and accountability of agencies;\n\n## (c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and\n\n## (d) build community trust and confidence in the personal information handling practices of agencies.\n\n## 7 Agencies bound by this APP code\n\nThis APP code is binding on all agencies as defined in section 5 of this APP code.\n\nNote: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.\n\n## 8 Application of this APP code to APP 1.2\n\nFor the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.\n\nNote 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.\n\nNote 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.\n\n  \n\n# Part 2—Privacy management and governance\n\n### 9 Privacy management plan\n\n## (1) An agency must have a privacy management plan.\n\n## (2) A privacy management plan is a document that:\n\n## (a) identifies specific, measurable privacy goals and targets; and\n\n## (b) sets out how an agency will meet its compliance obligations under APP 1.2.\n\n(3) An agency must measure and document its performance against its privacy management plan at least annually.\n\n### 10 Privacy Officer\n\n(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.\n\n(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.\n\n(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.\n\n(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.\n\n(5) An agency must ensure that the following Privacy Officer functions are carried out:\n\n## (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;\n\n(b) maintaining a record of the agency's personal information holdings;\n\n(c) assisting with the preparation of PIAs conducted under section 12;\n\n(d) maintaining the agency’s register of PIAs as required by section 15; and\n\n(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.\n\n### 11 Privacy Champion\n\n(1) An agency must, at all times, have a designated Privacy Champion.\n\n(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.\n\n(3) The Privacy Champion must be a senior official within the agency.\n\n(4) An agency must ensure that the following Privacy Champion functions are carried out:\n\n(a) promoting a culture of privacy within the agency that values and protects personal information;\n\n(b) providing leadership within the agency on broader strategic privacy issues;\n\n(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and\n\n(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.\n\n(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.\n\n  \n\n## PART 3—PIAs\n\n### 12 Conduct of PIA\n\n(1) An agency must conduct a PIA for all high privacy risk projects.\n\n(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.\n\nNote: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.\n\n13 Publication of PIA\n\nAn agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.\n\n14 Joint PIA\n\nIf two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.\n\n15 Register of PIAs\n\n(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.\n\n(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.\n\n## PART 4—Internal privacy capability\n\n### 16 Privacy education and training\n\n(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.\n\n(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.\n\n### 17 Regular review of internal privacy processes\n\n(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:\n\n(a) privacy policy prepared for the purposes of APP 1; and\n\n(b) privacy notice prepared for the purposes of APP 5.\n\n(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.","sortOrder":15},{"sectionNumber":"(a) identifies specific, measurable priv","sectionType":"part","heading":"(a) identifies specific, measurable privacy goals and targets; and","content":"## Part 1—Introduction\n\n## 1 Name\n\n(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.\n\n(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.\n\n## 2 Commencement\n\nThis APP code comes into force on 1 July 2018.\n\n## 3 Authority\n\nThis APP code has been developed under section 26G of the Privacy Act 1988.\n\n4 Preamble\n\nAPP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.\n\nAPP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.\n\n## 5 Definitions\n\n> Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:\n\n> Note: (a) APP code;\n\n> Note: (b) Commissioner;\n\n> Note: (c) personal information;\n\n> Note: (d) privacy impact assessment; and\n\n> Note: (e) sensitive information.\n\nIn this APP code:\n\nAct means the Privacy Act 1988.\n\nAgency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.\n\nAPP means an Australian Privacy Principle as set out in the Act.\n\nhandling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.\n\nOAIC means the Office of the Australian Information Commissioner.\n\nPIA means privacy impact assessment.\n\nPrivacy Champion has the meaning given by section 11.\n\nprivacy management plan has the meaning given by section 9.\n\nPrivacy Officer has the meaning given by section 10.\n\n## 6 Objectives\n\nThe objectives of this APP code are to:\n\n## (a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;\n\n## (b) enhance the privacy capability and accountability of agencies;\n\n## (c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and\n\n## (d) build community trust and confidence in the personal information handling practices of agencies.\n\n## 7 Agencies bound by this APP code\n\nThis APP code is binding on all agencies as defined in section 5 of this APP code.\n\nNote: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.\n\n## 8 Application of this APP code to APP 1.2\n\nFor the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.\n\nNote 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.\n\nNote 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.\n\n  \n\n# Part 2—Privacy management and governance\n\n### 9 Privacy management plan\n\n## (1) An agency must have a privacy management plan.\n\n## (2) A privacy management plan is a document that:\n\n## (a) identifies specific, measurable privacy goals and targets; and\n\n## (b) sets out how an agency will meet its compliance obligations under APP 1.2.\n\n(3) An agency must measure and document its performance against its privacy management plan at least annually.\n\n### 10 Privacy Officer\n\n(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.\n\n(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.\n\n(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.\n\n(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.\n\n(5) An agency must ensure that the following Privacy Officer functions are carried out:\n\n## (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;\n\n(b) maintaining a record of the agency's personal information holdings;\n\n(c) assisting with the preparation of PIAs conducted under section 12;\n\n(d) maintaining the agency’s register of PIAs as required by section 15; and\n\n(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.\n\n### 11 Privacy Champion\n\n(1) An agency must, at all times, have a designated Privacy Champion.\n\n(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.\n\n(3) The Privacy Champion must be a senior official within the agency.\n\n(4) An agency must ensure that the following Privacy Champion functions are carried out:\n\n(a) promoting a culture of privacy within the agency that values and protects personal information;\n\n(b) providing leadership within the agency on broader strategic privacy issues;\n\n(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and\n\n(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.\n\n(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.\n\n  \n\n## PART 3—PIAs\n\n### 12 Conduct of PIA\n\n(1) An agency must conduct a PIA for all high privacy risk projects.\n\n(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.\n\nNote: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.\n\n13 Publication of PIA\n\nAn agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.\n\n14 Joint PIA\n\nIf two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.\n\n15 Register of PIAs\n\n(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.\n\n(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.\n\n## PART 4—Internal privacy capability\n\n### 16 Privacy education and training\n\n(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.\n\n(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.\n\n### 17 Regular review of internal privacy processes\n\n(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:\n\n(a) privacy policy prepared for the purposes of APP 1; and\n\n(b) privacy notice prepared for the purposes of APP 5.\n\n(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.","sortOrder":16},{"sectionNumber":"(b) sets out how an agency will meet its","sectionType":"part","heading":"(b) sets out how an agency will meet its compliance obligations under APP 1.2.","content":"## (b) sets out how an agency will meet its compliance obligations under APP 1.2.\n\n(3) An agency must measure and document its performance against its privacy management plan at least annually.","sortOrder":17},{"sectionNumber":"10","sectionType":"division","heading":"Privacy Officer","content":"### 10 Privacy Officer\n\n(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.\n\n(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.\n\n(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.\n\n(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.\n\n(5) An agency must ensure that the following Privacy Officer functions are carried out:","sortOrder":18},{"sectionNumber":"(a) handling of internal and external pr","sectionType":"part","heading":"(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;","content":"## (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;\n\n(b) maintaining a record of the agency's personal information holdings;\n\n(c) assisting with the preparation of PIAs conducted under section 12;\n\n(d) maintaining the agency’s register of PIAs as required by section 15; and\n\n(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.","sortOrder":19},{"sectionNumber":"11","sectionType":"division","heading":"Privacy Champion","content":"### 11 Privacy Champion\n\n(1) An agency must, at all times, have a designated Privacy Champion.\n\n(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.\n\n(3) The Privacy Champion must be a senior official within the agency.\n\n(4) An agency must ensure that the following Privacy Champion functions are carried out:\n\n(a) promoting a culture of privacy within the agency that values and protects personal information;\n\n(b) providing leadership within the agency on broader strategic privacy issues;\n\n(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and\n\n(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.\n\n(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.","sortOrder":20},{"sectionNumber":"PART 3","sectionType":"part","heading":"PIAs","content":"## Part 1—Introduction\n\n## 1 Name\n\n(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.\n\n(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.\n\n## 2 Commencement\n\nThis APP code comes into force on 1 July 2018.\n\n## 3 Authority\n\nThis APP code has been developed under section 26G of the Privacy Act 1988.\n\n4 Preamble\n\nAPP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.\n\nAPP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.\n\n## 5 Definitions\n\n> Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:\n\n> Note: (a) APP code;\n\n> Note: (b) Commissioner;\n\n> Note: (c) personal information;\n\n> Note: (d) privacy impact assessment; and\n\n> Note: (e) sensitive information.\n\nIn this APP code:\n\nAct means the Privacy Act 1988.\n\nAgency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.\n\nAPP means an Australian Privacy Principle as set out in the Act.\n\nhandling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.\n\nOAIC means the Office of the Australian Information Commissioner.\n\nPIA means privacy impact assessment.\n\nPrivacy Champion has the meaning given by section 11.\n\nprivacy management plan has the meaning given by section 9.\n\nPrivacy Officer has the meaning given by section 10.\n\n## 6 Objectives\n\nThe objectives of this APP code are to:\n\n## (a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;\n\n## (b) enhance the privacy capability and accountability of agencies;\n\n## (c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and\n\n## (d) build community trust and confidence in the personal information handling practices of agencies.\n\n## 7 Agencies bound by this APP code\n\nThis APP code is binding on all agencies as defined in section 5 of this APP code.\n\nNote: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.\n\n## 8 Application of this APP code to APP 1.2\n\nFor the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.\n\nNote 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.\n\nNote 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.\n\n  \n\n# Part 2—Privacy management and governance\n\n### 9 Privacy management plan\n\n## (1) An agency must have a privacy management plan.\n\n## (2) A privacy management plan is a document that:\n\n## (a) identifies specific, measurable privacy goals and targets; and\n\n## (b) sets out how an agency will meet its compliance obligations under APP 1.2.\n\n(3) An agency must measure and document its performance against its privacy management plan at least annually.\n\n### 10 Privacy Officer\n\n(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.\n\n(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.\n\n(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.\n\n(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.\n\n(5) An agency must ensure that the following Privacy Officer functions are carried out:\n\n## (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;\n\n(b) maintaining a record of the agency's personal information holdings;\n\n(c) assisting with the preparation of PIAs conducted under section 12;\n\n(d) maintaining the agency’s register of PIAs as required by section 15; and\n\n(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.\n\n### 11 Privacy Champion\n\n(1) An agency must, at all times, have a designated Privacy Champion.\n\n(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.\n\n(3) The Privacy Champion must be a senior official within the agency.\n\n(4) An agency must ensure that the following Privacy Champion functions are carried out:\n\n(a) promoting a culture of privacy within the agency that values and protects personal information;\n\n(b) providing leadership within the agency on broader strategic privacy issues;\n\n(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and\n\n(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.\n\n(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.\n\n  \n\n## PART 3—PIAs\n\n### 12 Conduct of PIA\n\n(1) An agency must conduct a PIA for all high privacy risk projects.\n\n(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.\n\nNote: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.\n\n13 Publication of PIA\n\nAn agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.\n\n14 Joint PIA\n\nIf two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.\n\n15 Register of PIAs\n\n(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.\n\n(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.\n\n## PART 4—Internal privacy capability\n\n### 16 Privacy education and training\n\n(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.\n\n(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.\n\n### 17 Regular review of internal privacy processes\n\n(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:\n\n(a) privacy policy prepared for the purposes of APP 1; and\n\n(b) privacy notice prepared for the purposes of APP 5.\n\n(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.","sortOrder":21},{"sectionNumber":"12","sectionType":"division","heading":"Conduct of PIA","content":"### 12 Conduct of PIA\n\n(1) An agency must conduct a PIA for all high privacy risk projects.\n\n(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.\n\nNote: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.\n\n13 Publication of PIA\n\nAn agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.\n\n14 Joint PIA\n\nIf two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.\n\n15 Register of PIAs\n\n(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.\n\n(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.","sortOrder":22},{"sectionNumber":"PART 4","sectionType":"part","heading":"Internal privacy capability","content":"## Part 1—Introduction\n\n## 1 Name\n\n(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.\n\n(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.\n\n## 2 Commencement\n\nThis APP code comes into force on 1 July 2018.\n\n## 3 Authority\n\nThis APP code has been developed under section 26G of the Privacy Act 1988.\n\n4 Preamble\n\nAPP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.\n\nAPP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.\n\n## 5 Definitions\n\n> Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:\n\n> Note: (a) APP code;\n\n> Note: (b) Commissioner;\n\n> Note: (c) personal information;\n\n> Note: (d) privacy impact assessment; and\n\n> Note: (e) sensitive information.\n\nIn this APP code:\n\nAct means the Privacy Act 1988.\n\nAgency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.\n\nAPP means an Australian Privacy Principle as set out in the Act.\n\nhandling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.\n\nOAIC means the Office of the Australian Information Commissioner.\n\nPIA means privacy impact assessment.\n\nPrivacy Champion has the meaning given by section 11.\n\nprivacy management plan has the meaning given by section 9.\n\nPrivacy Officer has the meaning given by section 10.\n\n## 6 Objectives\n\nThe objectives of this APP code are to:\n\n## (a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;\n\n## (b) enhance the privacy capability and accountability of agencies;\n\n## (c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and\n\n## (d) build community trust and confidence in the personal information handling practices of agencies.\n\n## 7 Agencies bound by this APP code\n\nThis APP code is binding on all agencies as defined in section 5 of this APP code.\n\nNote: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.\n\n## 8 Application of this APP code to APP 1.2\n\nFor the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.\n\nNote 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.\n\nNote 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.\n\n  \n\n# Part 2—Privacy management and governance\n\n### 9 Privacy management plan\n\n## (1) An agency must have a privacy management plan.\n\n## (2) A privacy management plan is a document that:\n\n## (a) identifies specific, measurable privacy goals and targets; and\n\n## (b) sets out how an agency will meet its compliance obligations under APP 1.2.\n\n(3) An agency must measure and document its performance against its privacy management plan at least annually.\n\n### 10 Privacy Officer\n\n(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.\n\n(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.\n\n(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.\n\n(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.\n\n(5) An agency must ensure that the following Privacy Officer functions are carried out:\n\n## (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;\n\n(b) maintaining a record of the agency's personal information holdings;\n\n(c) assisting with the preparation of PIAs conducted under section 12;\n\n(d) maintaining the agency’s register of PIAs as required by section 15; and\n\n(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.\n\n### 11 Privacy Champion\n\n(1) An agency must, at all times, have a designated Privacy Champion.\n\n(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.\n\n(3) The Privacy Champion must be a senior official within the agency.\n\n(4) An agency must ensure that the following Privacy Champion functions are carried out:\n\n(a) promoting a culture of privacy within the agency that values and protects personal information;\n\n(b) providing leadership within the agency on broader strategic privacy issues;\n\n(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and\n\n(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.\n\n(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.\n\n  \n\n## PART 3—PIAs\n\n### 12 Conduct of PIA\n\n(1) An agency must conduct a PIA for all high privacy risk projects.\n\n(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.\n\nNote: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.\n\n13 Publication of PIA\n\nAn agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.\n\n14 Joint PIA\n\nIf two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.\n\n15 Register of PIAs\n\n(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.\n\n(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.\n\n## PART 4—Internal privacy capability\n\n### 16 Privacy education and training\n\n(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.\n\n(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.\n\n### 17 Regular review of internal privacy processes\n\n(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:\n\n(a) privacy policy prepared for the purposes of APP 1; and\n\n(b) privacy notice prepared for the purposes of APP 5.\n\n(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.","sortOrder":23},{"sectionNumber":"16","sectionType":"division","heading":"Privacy education and training","content":"### 16 Privacy education and training\n\n(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.\n\n(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.","sortOrder":24},{"sectionNumber":"17","sectionType":"division","heading":"Regular review of internal privacy processes","content":"### 17 Regular review of internal privacy processes\n\n(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:\n\n(a) privacy policy prepared for the purposes of APP 1; and\n\n(b) privacy notice prepared for the purposes of APP 5.\n\n(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.","sortOrder":25}],"analysis":{"flash_summary":{"complexity_score":4,"scope_assessment":{"changed":false,"description":"Scope remains limited to agencies as defined in the code (explicitly excluding Ministers) and operates as a code under the Privacy Act to specify how agencies must comply with APP 1.2. It does not broaden the Act’s coverage of acts or practices; rather, it imposes governance and process requirements on entities already within the Act’s agency definition (see s5, s7, s8)."},"complexity_factors":["Multiple mandatory roles and functions to set up (privacy management plan, Privacy Officer, Privacy Champion) with distinct duties (ss9–11).","Recurring documentation and reporting obligations (annual measurement against plan, PIA register, publication of registers/PIAs) create ongoing administrative burden (ss9(3),13,15).","PIA trigger uses a subjective ‘reasonable consideration’ test, giving agencies discretion on when a PIA is required and creating legal uncertainty (s12(2)).","Cross‑references to the Privacy Act and Commissioner powers mean oversight and enforcement depend on external statutory mechanisms (notes to s12, s8).","Notification requirement to OAIC (contact details for Privacy Officer) concentrates monitoring and increases interaction costs (s10(3)).","Prescriptive training and review cycles for staff handling personal information impose operational and resourcing demands (ss16–17).","Source text contains extensive repetition and duplication, which complicates navigation and practical compliance (document drafting issue)."],"plain_english_summary":"This code requires Australian Government agencies (not Ministers) to put in place concrete privacy governance: keep a privacy management plan, appoint a Privacy Officer and a senior Privacy Champion, run privacy impact assessments for high‑risk projects, publish and register PIAs, provide staff training and regularly review privacy processes (ss9–17). Agencies pay the compliance costs and decide when a project is ‘high privacy risk’ under a ‘reasonable’ standard; the OAIC can be notified of contacts, request registers and investigate (ss10(3),12(2),15,8)."},"kimi_summary":{"_metrics":{"provider":"moonshot","completionTokens":2194},"content_quality":"ok","complexity_score":3,"scope_assessment":{"changed":false,"description":"The Code remains tightly focused on its original purpose: specifying how agencies comply with Australian Privacy Principle 1.2 (open and transparent management of personal information). It implements governance requirements directly tied to APP 1 without expanding into unrelated regulatory areas."},"complexity_factors":["Cross-references to the *Privacy Act 1988* (e.g., sections 26G, 33D, and APP 1.2) require reading external provisions to fully understand obligations","Reliance on external statutory definitions (e.g., 'agency', 'personal information', 'Commissioner') rather than self-contained definitions","Subjective threshold for triggering obligations: agencies must self-assess 'high privacy risk' for projects (section 12)","Permissive provisions allowing flexibility (e.g., Privacy Officer may also be Privacy Champion; joint PIAs permitted between agencies) create conditional logic","Approximately 9 specific definitions and 4 Parts with 17 sections total—compact but requiring statutory context"],"plain_english_summary":"This is a legally binding rulebook (called an **APP Code**) made under the *Privacy Act 1988* that tells Australian Government agencies exactly how they must manage and protect your personal information.\n\n**Who does this affect?**\nAll Australian Government **agencies** (like departments and statutory bodies), but not individual Ministers.\n\n**What does it require?**\nInstead of vague suggestions, this Code creates hard obligations. Agencies must:\n\n*   **Write a Privacy Management Plan**: A public document setting measurable privacy goals (not just 'we care about privacy') and reviewing progress annually.\n*   **Appoint two key roles**:\n    *   A **Privacy Officer** (the operational expert who handles complaints and tracks what personal info the agency holds); and\n    *   A **Privacy Champion** (a senior executive who drives a privacy-focused culture and reports to the agency's leadership).\n    *   *Note: One person can do both jobs if needed.*\n*   **Conduct Privacy Impact Assessments (PIAs)**: Before starting any 'high privacy risk' project (anything new that could significantly impact people's privacy), agencies must analyse the risks and publish a register of these assessments on their website.\n*   **Train staff**: All new staff must learn about privacy, and anyone who handles personal information must get refresher training every year.\n*   **Keep systems up to date**: Regularly review internal procedures to make sure they still work.\n\n**Why does this matter?**\nThis Code makes privacy governance concrete and accountable. It forces agencies to treat personal information as a valuable asset that needs active protection, not just a compliance afterthought. By requiring public registers of risk assessments and clear accountability roles, it aims to stop privacy breaches before they happen and build public trust in how the government handles sensitive data."},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"}},"importantCases":[],"_links":{"self":"/api/acts/privacy-australian-government-agencies-governance-app-code-2017","history":"/api/acts/privacy-australian-government-agencies-governance-app-code-2017/history","analysis":"/api/acts/privacy-australian-government-agencies-governance-app-code-2017/analysis","conflicts":"/api/acts/privacy-australian-government-agencies-governance-app-code-2017/conflicts","importantCases":"/api/acts/privacy-australian-government-agencies-governance-app-code-2017/important-cases","documents":"/api/acts/privacy-australian-government-agencies-governance-app-code-2017/documents"}}