Taking reasonable steps to ensure the security of personal information
Australian businesses collect and hold personal information every day from customer details and employee records to financial information, identification documents and confidential business records.
Protecting this information is an important part of privacy and information security.
Under Australian Privacy Principle 11 (APP 11), organisations covered by the Privacy Act 1988 (Cth) must take reasonable steps to protect personal information from misuse, interference and loss, as well as unauthorised access, modification or disclosure. When personal information is no longer needed, organisations must also take reasonable steps to destroy or de-identify it, unless an exception applies.
But what does taking reasonable steps to ensure the security of personal information actually mean?
In this guide, we explain APP 11, what the OAIC considers reasonable steps, how businesses can protect personal information throughout its lifecycle, and why secure document destruction should form part of an effective information security process.
Important: This article provides general information only and is not legal advice. Record retention requirements vary depending on your industry, the type of information and applicable Australian laws.
What is Australian Privacy Principle 11?
Australian Privacy Principle 11, commonly referred to as APP 11, deals with the security of personal information.
APP 11.2 requires an APP entity that holds personal information to take reasonable steps to protect that information from:
- Misuse
- Interference
- Loss
- Unauthorised access
- Unauthorised modification
- Unauthorised disclosure
APP 11.2 also requires an organisation to take reasonable steps to destroy or de-identify personal information when it is no longer needed for a purpose for which it may be used or disclosed under the Australian Privacy Principles, subject to applicable exceptions.
This means privacy protection does not stop when information is collected or stored.
Businesses should consider security throughout the entire information lifecycle.
What does taking reasonable steps to ensure the security of personal information means?
There is no single security measure that every Australian business must use.
The OAIC explains that what constitutes reasonable steps depends on the circumstances of each organisation.
Factors can include:
- The size and resources of the organisation
- The nature and complexity of its operations
- The amount of personal information held
- The sensitivity of the information
- The possible consequences if the information is compromised
- The practical implications and cost of security measures
- Whether a security measure creates additional privacy risks
Generally, the more sensitive the information and the greater the potential harm from a breach, the stronger the security measures that may be appropriate.
What reasonable steps should businesses take?
The OAIC’s APP 11 guidance identifies several areas that organisations should consider when protecting personal information.
These include:
- Governance, culture and training
- Internal policies, procedures and systems
- ICT security
- Access security
- Third-party providers
- Data breaches
- Physical security
- Destruction and de-identification
- Appropriate standards
These measures should work together as part of a broader information security strategy.
1. Governance, culture and employee training
Employees play an important role in protecting personal information.
Businesses should establish a culture where employees understand their responsibilities when handling confidential information.
Training can cover:
- How personal information should be handled
- Who can access confidential records
- How information should be stored
- How confidential documents should be disposed of
- What to do if information is lost or accidentally disclosed
- How to report a suspected data breach
Clear responsibilities and regular training can help reduce the risk of accidental disclosure or inappropriate handling.
2. Internal policies, procedures and systems
Businesses should have documented policies and procedures for managing personal information.
These can cover the entire information lifecycle:
Collect → Use → Store → Access → Retain → Destroy or De-identify
A documented information management process can help employees understand what should happen to personal information at each stage.
It can also help businesses identify information that is no longer required and determine when it should be securely destroyed or de-identified.
3. ICT security
Personal information stored electronically should be protected using appropriate technical security measures.
Depending on the organisation, these may include:
- Strong passwords
- Multi-factor authentication
- Encryption
- Firewalls
- Secure backups
- Software updates
- Malware protection
- Access monitoring
- Security testing
- Restricted administrator access
However, protecting personal information is not only an IT responsibility.
Paper records can contain the same sensitive information as digital records and require appropriate physical security.
4. Access security
Businesses should consider who actually needs access to personal information.
Access should generally be limited to authorised people who require the information to perform their role.
Appropriate controls may include:
- User permissions
- Password protection
- Physical access restrictions
- Secure storage areas
- Visitor controls
- Access logs
- Regular reviews of employee access
Limiting unnecessary access can reduce the risk of unauthorised use or disclosure.
5. Third-party providers
Many businesses use external providers to store, process, transport or destroy personal information.
This can include:
- Cloud providers
- IT companies
- Records storage companies
- Payroll providers
- Document destruction companies
- Other outsourced service providers
The OAIC explains that an organisation may still hold personal information when it outsources storage to a third party if it retains the right or power to deal with that information.
Businesses should therefore consider the security practices of suppliers handling personal information on their behalf.
6. Data breach preparedness
Reasonable information security also includes preparing for the possibility of a data breach.
Businesses should have procedures for identifying, containing and responding to incidents involving personal information.
Employees should know:
- How to report a suspected breach
- Who is responsible for responding
- How affected information should be contained
- What records should be kept
- What notification obligations may apply
Having a documented response process can help an organisation respond more effectively if information is compromised.
7. Physical security
Not all personal information is stored electronically.
Businesses may hold large quantities of personal information in:
- Filing cabinets
- Office drawers
- Archive boxes
- Printed reports
- Employee files
- Customer records
- Invoices
- Contracts
- Applications
- Medical records
Physical security measures can include locked storage, restricted access areas and secure document disposal procedures.
Documents containing personal information should not be left where unauthorised people can access them.
8. Destruction and de-identification
One of the most important parts of the information lifecycle is what happens when information is no longer required.
APP 11.2 requires an APP entity to take reasonable steps to destroy or de-identify personal information when it is no longer needed for a purpose for which it may be used or disclosed under the APPs, subject to exceptions.
Secure destruction can also reduce privacy and security risks because retaining unnecessary information increases the amount of information that could potentially be exposed during a data breach.
For paper records, the OAIC recognises physical destruction methods such as shredding, disintegrating and pulping as possible methods of destroying personal information.
Why secure document destruction matters
Personal information can remain readable long after a business has finished using a document.
Simply putting confidential paperwork into a normal rubbish or recycling bin does not necessarily destroy the information.
The OAIC states that ordinary garbage or recycling collection would not ordinarily constitute reasonable destruction of hard-copy personal information where the information remains readable. Appropriate destruction methods can include processes such as shredding, pulping, pulverising or disintegrating.
This is why secure document destruction should be considered as part of an organisation’s broader information security strategy.
What types of personal information should businesses securely destroy?
Many everyday business documents can contain personal information.
Examples include:
- Customer records
- Customer names and contact details
- Applications
- Identification documents
- Account information
- Service records
- Customer correspondence
- Employee and HR records
- Employee files
- Payroll information
- Recruitment applications
- Performance records
- Leave records
- Personnel correspondence
- Financial records
- Invoices
- Receipts
- Bank documents
- Payment records
- Tax records
- Financial reports
- Legal and professional records
- Contracts
- Agreements
- Legal correspondence
- Case files
- Client records
- Confidential reports
- Medical and personal information
- Patient records
- Medical information
- Health forms
- Personal details
- Referral documents
- Business information
- Internal reports
- Pricing information
- Supplier information
- Business correspondence
- Strategic documents
- Confidential meeting documents
Does every document need to be destroyed?
No.
Taking reasonable steps to ensure the security of personal information does not mean destroying every document immediately.
Some information must be retained because of:
- Australian legislation
- Tax requirements
- Employment obligations
- Legal proceedings
- Court or tribunal orders
- Regulatory requirements
- Contractual obligations
- Industry-specific requirements
- Internal record-keeping policies
Businesses should first determine whether information is still required before authorising destruction.
A simple principle is:
Retain what you are required to retain. Securely destroy what you no longer need.
How should businesses manage confidential documents before destruction?
The security of personal information should continue until the information has actually been destroyed.
- Identify: Determine what personal and confidential information the organisation holds.
- Retain: Determine which records must continue to be kept.
- Review: Regularly identify information that is no longer needed.
- Secure: Keep documents awaiting destruction in a controlled and secure location
- Destroy: Use an appropriate destruction method that makes information irretrievable.
- Document Keep: Appropriate records confirming what was destroyed and when. For businesses handling confidential paper records, locked shredding bins can help keep documents secure between disposal and collection.
Why use secure shredding bins?
A secure shredding bin provides a controlled location for employees to dispose of confidential documents.
Instead of leaving sensitive paperwork in an ordinary office recycling bin, employees can place it directly into a locked container.
This can help businesses:
- Reduce unnecessary access to confidential documents
- Establish a consistent disposal process
- Keep documents secure while awaiting collection
- Separate confidential records from general waste
- Support internal information security procedures. Secure bins can be particularly useful for offices that regularly generate confidential paperwork.
What is a certificate of destruction?
A certificate of destruction provides documented confirmation that material collected for destruction has been destroyed.
For businesses with formal information governance procedures, destruction records can help demonstrate that confidential documents were handled through policies and applicable legal or regulatory requirements.
The exact documentation a business should retain will depend on its internal policies and applicable legal or regulatory requirements.
A practical security check list for Australian businesses
Use this checklist when reviewing how your organisation protects personal information
Information management
☐ Do we know what personal information we hold?
☐ Do we know where it is stored?
☐ Do we know who can access it?
☐ Do we have a documented retention policy?
☐ Do we regularly review information that is no longer required?
Employee security
☐ Are employees trained in privacy and information security?
☐ Do employees understand how confidential documents should be handled?
☐ Do employees know how to report a suspected data breach?
Physical security
☐ Are confidential paper records stored securely?
☐ Is access to physical records restricted?
☐ Are confidential documents separated from general waste?
☐ Are documents awaiting destruction stored in secure containers?
Secure Destruction
☐ Do we have a documented destruction process?
☐ Are confidential documents securely shredded rather than placed directly into recycling?
☐ Do we use an appropriate destruction method?
☐ Do we keep appropriate destruction records?
☐ Do we receive a Certificate of Destruction where appropriate?
Third-party providers
☐ Do we understand how suppliers handle personal information?
☐ Have we considered the security practices of third-party providers?
☐ Are supplier responsibilities clearly defined?
Taking reasonable steps is an ongoing process
Businesses should regularly review whether their security measures remain appropriate as their operations, technology, workforce and the amount of personal information they hold change.
The OAIC recommends considering personal information security throughout the entire information lifecycle — before collection, while information is held and when it is ultimately destroyed or de-identified.
For this reason, secure document destruction should not be treated as an isolated waste-management task.
It can be an important part of a broader privacy and information security process.
A How Nationalshred can help
Nationalshred provides secure document destruction services for Australian Businesses.
Depending on your requirements, confidential documents can be placed into secure shredding bins or other collection options before being collected for destruction.
Nationalshred products and services:
1. Document Shredding Bins
The core NationalShred product range for businesses and households.
- 240L Pre-Paid Shredding Bin – 2 Weeks
- 240L Pre-Paid Shredding Bin – 4 Weeks
- 2 × 240L Pre-Paid Shredding Bins
- One-Off Shredding Bins
- Scheduled Shredding Bins
2. Confidential Shredding Bags and Combos
A flexible alternative to a shredding bin, particularly for smaller quantities.
- Confidential Shredding Bags
- Shredding Bin + Confidential Bag Combo
3. On-Demand & On-Site Shredding
For customers who need their documents destroyed without using a collection bin.
- 15-Minute Load-On-the-Spot Shredding
- On-Site Document Shredding
- Document Shredding Drop-Off – Kogarah
- Bulk Document Shredding
4. Archive & Records Destruction
For businesses clearing old records, files and storage areas.
- Archive Document Shredding
- Bulk Archive Destruction
- Pallet-Loaded Document Destruction
5. Specialised Destruction
For items that require secure destruction beyond standard paper documents.
- Clothing & Uniform Destruction Bags
- Clothing & Uniform Destruction – 240L Bin
- Product Destruction Services
- Secure E-Waste Disposal
6. E-Waste Disposal and Combos
Secure disposal and destruction of electronic items and devices.
- 240L E-Waste Lockable Bin
- Secure E-Waste Destruction Boxes
- Paper + E-Waste Bin Combo
- Secure E-Waste Disposal
7. Custom Shredding Solutions
For customers with unusual volumes, requirements or destruction projects.
- Custom Shredding Solutions
- Large-Volume Document Destruction
- Pallet-Loaded Shredding
- Business & Commercial Shredding Programs
This would make the product offering much easier to understand than listing every individual service separately, while still covering what NationalShred currently sells.
Frequently Asked Questions
Taking reasonable steps implementing appropriate technical and organisational measures to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. What is reasonable depends on the circumstances, including the amount and sensitivity of information held and the potential consequences of a breach.
APP 11 is the Australian Privacy Principle concerning the security of personal information. It requires covered organisations to take reasonable steps to protect personal information and, when it is no longer needed and no exception applies, to destroy or de-identify it.
Yes. APP 11 applies to personal information held in physical records as well as electronic records. Physical security and secure destruction should therefore be considered as part of an organisation’s information security measures.
Generally, confidential paper containing personal information should not simply be placed into ordinary recycling while it remains readable. The OAIC states that ordinary garbage or recycling collection would not ordinarily constitute reasonable destruction of hard-copy personal information.
Shredding can be an appropriate method of physically destroying personal information. The OAIC identifies shredding, disintegrating and pulping as examples of destruction methods that may be used.
Businesses should consider destroying or de-identifying personal information when it is no longer needed for a purpose for which it may be used or disclosed under the APPs, unless an applicable exception requires the information to be retained.
No. Secure shredding can be an important part of protecting and destroying paper-based personal information, but it is only one part of an organisation’s broader privacy and information security responsibilities.
A professional document destruction provider can help businesses establish a controlled process for securely disposing of confidential paper records. However, each organisation remains responsible for determining its retention obligations and ensuring its overall privacy and security practices are appropriate.
