17Regular review of internal privacy processes

17 Regular review of internal privacy processes

(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:

(a) privacy policy prepared for the purposes of APP 1; and

(b) privacy notice prepared for the purposes of APP 5.

(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.