Employee Monitoring Law Planner
Sources

Australian Privacy Principles (APPs)

Law. Placed at Australian locations, when you say the Privacy Act applies. Read 30 Sep 2026; 4 provisions cited by the planner.

What does Australian Privacy Principles (APPs) require?

Notify individuals of the collection of their personal information and the matters set out in APP 5. Also cited: 1, open and transparent management of personal information; 3, collection of solicited personal information.

APP 5Notification of the collection of personal information

Notify individuals of the collection of their personal information and the matters set out in APP 5.

What a reviewer asks to see: Collection notices (APP 5 matters); Timing of notification
Where monitoring plans usually fall short: No collection notice; Notice missing APP 5 matters
Source: Australian Privacy Principles (APPs), read 30 Sep 2026
APP 1Open and transparent management of personal information

Manage personal information in an open and transparent way, including having a clearly expressed and up-to-date APP privacy policy.

What a reviewer asks to see: Published APP privacy policy; Evidence of open data-handling practices; Policy review records
Where monitoring plans usually fall short: No APP privacy policy; Policy out of date; Practices not transparent
Source: Australian Privacy Principles (APPs), read 30 Sep 2026
APP 3Collection of solicited personal information

Only collect personal information that is reasonably necessary for the entity's functions or activities, by lawful and fair means.

What a reviewer asks to see: Justification of necessity for collection; Lawful and fair collection methods; Heightened protection for sensitive information
Where monitoring plans usually fall short: Over-collection; Unlawful/unfair collection; Sensitive info collected without consent
Source: Australian Privacy Principles (APPs), read 30 Sep 2026
APP 11Security of personal information

Take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, and destroy or de-identify it when no longer needed.

What a reviewer asks to see: A documented set of technical safeguards (access control, encryption, system and network protections) and organisational safeguards (policy, staff training, contracts, governance) covering the whole life of the information, from collection through to destruction or de-identification; A layered design so a single failure never leaves personal information exposed to misuse, interference, loss, unauthorised access, unauthorised modification or unauthorised disclosure; A destruction or de-identification practice triggered the moment every lawful purpose for keeping the information has ended, with a record that it actually ran; The reasonable-steps judgement behind the chosen measures, naming the entity's size, resources, the sensitivity of the information held and the harm a breach would cause; For a franchise, dealership or multi-entity arrangement, a clear allocation of which entity owns which part of the security measures
Where monitoring plans usually fall short: Security built from technical controls alone, with no matching organisational measures such as policy, staff training, contracts or governance covering the same risk; No destruction or de-identification once the original purpose for holding the information has lapsed, even where no other lawful ground to keep it exists; One security standard applied across the board regardless of how sensitive the information is or how large the entity is, instead of a reasoned judgement against those factors; Protection only considered once information is already held, with no thought given to it at the point collection is being decided
Source: Australian Privacy Principles (APPs), read 30 Sep 2026

Open the full text on compliance.theartofservice.com

See the specimen plan run Plan your own list