Australian Privacy Principles for Accountants

The Australian Privacy Principles (APPs) are 13 rules governing personal information. For covered accounting practices, they apply from collecting client details to granting access and disposing of records.

The 13 Australian Privacy Principles

The 13 APPs govern how covered practices handle personal information throughout its life. The principle names below follow Schedule 1 of the Privacy Act.

The examples apply those principles to practice work. Use the OAIC’s Australian Privacy Principles guidelines for each rule’s conditions and exceptions.

These examples identify an action for each principle. A privacy policy records your handling arrangements, but staff must also follow them. A privacy policy template helps turn those arrangements into a document clients can read.

Who Must Follow the APPs

The APPs bind APP entities, including covered private-sector organisations and Australian Government agencies. Accounting practices must assess coverage from their business circumstances, rather than assuming every registered practice has the same obligations.

The OAIC’s small-business guidance retains the general exemption for businesses with annual turnover of $3 million or less. Exceptions can bring a small practice within the Act. Opting in also creates coverage.

For example, trading in personal information or providing services under a Commonwealth contract can change the result. Related businesses also require assessment. The Privacy Act coverage guide addresses those wider coverage questions and reforms.

Small practices acting as reporting entities under anti-money laundering and counter-terrorism financing (AML/CTF) law have privacy duties for their AML/CTF activities. The OAIC’s reporting-entity guidance explains that activity-specific coverage.

TFN Obligations Apply Separately

The small-business exemption does not remove the Privacy (Tax File Number) Rule 2015. Practices receiving individuals’ Tax File Number (TFN) information must follow that rule even when the broader APP obligations do not apply.

The OAIC’s TFN guidance distinguishes individuals’ TFNs from those of other legal entities. The rule governs permitted handling and disposal. Receiving a TFN alone does not make every other practice record subject to all 13 APPs.

APP 8 and Overseas Cloud and AI Providers

APP 8 generally requires reasonable steps before an APP entity discloses personal information to an overseas recipient. Those steps must address the recipient’s handling under the APPs, other than APP 1.

Section 16C can make the practice accountable for the overseas recipient’s conduct where APP 8.1 governs the disclosure. It covers conduct outside the recipient’s own APP obligations that would breach the relevant APPs if they applied.

Taking reasonable steps does not itself remove that accountability. The OAIC’s APP 8 guidance explains the conditions and exceptions.

Overseas storage can, in limited circumstances, remain a use within your effective control. Disclosure involves releasing the information’s subsequent handling from that control. Server location alone does not decide the distinction.

The OAIC’s overseas-handling guidance explains why duties remain when a practice retains control. A storage contract must support that control in practice, including limits on subcontractors’ handling.

Assess a Provider Before Sending Client Records

Record the proposed purpose and the minimum information needed. Then assess the provider’s actual arrangements:

• Identify the receiving businesses, overseas support access and subcontractors.
• Read the contract for permitted uses, security obligations and notification of incidents or changed terms.
• Establish how you retrieve or delete information, including retained copies and backups.
• For AI, check whether prompts or uploaded files can be used for model training and which settings restrict that use.
• Record your decision, the terms assessed and who can approve future changes.

The OAIC’s commercial AI guidance recommends avoiding personal information in publicly available AI chatbots. Removing a name alone can leave a client identifiable through the remaining details.

APP 8 has exceptions, including specified legal protections and expressly informed consent. General acceptance of cloud software is not automatically consent to disapply APP 8.1. An exception also does not erase separate collection, use or security obligations.

APP 11: Security and Destruction

APP 11 requires reasonable steps to protect personal information from misuse, interference and loss, as well as unauthorised access, changes or disclosure. Those steps include technical and organisational measures.

For a practice, restrict access by role and protect sign-ins with multifactor authentication. Maintain secure backups and remove access when staff leave. Train staff to recognise a request that would send records to the wrong recipient.

The OAIC’s APP 11 guidance also requires reasonable steps to destroy or de-identify information no longer needed for a permitted purpose. Legal retention requirements and court or tribunal orders can prevent disposal.

Match Retention to the Record

The Tax Practitioners Board’s record-keeping guidance requires service records for at least five years after the tax agent service is provided. This includes BAS services and former clients.

That clock differs from the general business-record rule. For most business records, five years runs from preparation or receipt, or completion of the relevant transaction, whichever is later. Some records need longer retention.

A client’s departure does not cancel a retention requirement. Equally, a five-year minimum does not justify keeping every duplicate forever. Record the legal basis and disposal trigger for each record category, then review copies across your storage locations.

For example, keep a required service record for its applicable period. Separately assess a temporary download copied from that record. Once the copy has no permitted purpose or retention requirement, arrange secure disposal.

Staff Privacy Training

Staff privacy training must explain how your practice handles client information in daily work. The OAIC’s privacy management framework recommends induction and regular training, including for contractors and temporary staff.

Teach staff how to confirm the recipient before sharing records and which providers the practice has approved. Cover TFN restrictions, access and correction requests, retention rules and the person who receives incident reports.

Use scenarios that match each role. For example, ask reception staff how they handle a caller requesting a client’s documents. Ask preparers what they do when an AI tool invites them to upload an entire client file.

Keep a training register with each participant’s name, role and completion date. Record the material’s version, topics covered and any follow-up needed. Repeat training when handling procedures change, and use incidents to address specific gaps.

Finish each session with a practical check. The staff member must identify the approved sharing method and the person to contact when a request falls outside it. Record any correction before they handle that task alone.