Privacy Act Reform Deep Dive: APP 11 (Security and Destruction/ De-Identification)

Proposals for reform of Australia’s Privacy Act were released for consultation on 31 August 2026.  We have covered the proposed reforms at a high-level here.

The proposed changes includes changes to the security obligations in Australian Privacy Principle (APP) 11. APP 11 currently requires organisations to take reasonable steps to secure personal information. It also requires the destruction or de-identification of personal information no longer needed.

In summary, under the proposed changes to APP 11, organisations will now need to identify the personal information they hold, including what they no longer need, consider whether to destroy or de-identify it, and regularly evaluate the effectiveness of their compliance with APP 11 (for example, their destruction and de-identification practices).  This is in addition to existing obligations to take reasonable steps to secure the personal information they hold.

Given the potential impact of these changes, we consider a deeper dive into these security-related aspects worthwhile.

Proposed Changes to APP 11

Security of personal information

The high-level obligation to take reasonable steps to secure personal information remains unchanged.

However, proposed amendments build on that obligation, making it clear that:

• The steps to be taken may include technical or organisational measures (new APP 11.4(a)); and
• The steps must include being able to identify personal information to which the APP 11 obligations apply (including the obligation to destroy or de-identify) (new APP 11.4(b)).

The obligation to identify personal information holdings may introduce a significant new compliance requirement for many organisations. In our experience, few organisations are currently maintaining a data inventory that includes identification of the personal information to which the APP 11 obligations apply. Even fewer organisations have applied destruction or de-identification obligations to their different data holdings.

A new APP 11.5 will also make it clear that organisations must regularly evaluate the effectiveness of compliance with the obligation to secure in APP 11.1 and the obligation to destroy or de-identify personal information if no longer needed in APP 11.2.

As the Consultation Paper notes, regular assessment recognises that security measures and information handling practices may become less effective over time as technologies, business practices and privacy risks evolve. Ongoing evaluation helps ensure an entity’s measures remain effective and appropriate.[1]

Ongoing evaluation of security measures is not a new concept and should be part of most relatively mature security programs.  However, the need to evaluate destruction and de-identification decisions may introduce new obligations.  Ongoing evaluation of de-identification is considered in more detail in the new section.

How does this compare with the previous proposals?

In 2023, the Privacy Act Review Report proposed clarifications specifying that reasonable steps for APP 11 purposes include technical and organisational measures.

However, there were further recommendations in the Report, including:

• proposals for clearer guidance on security, destruction and de-identification,
• identification of the technical and organisational measures which should be implemented within “reasonable steps.” This could have included, for example, measures such as encrypting data, securing access to systems and premises, and undertaking staff training, and
• developing a list of baseline privacy outcomes (rather than prescriptive measures) that entities must consider or achieve.

The Office of the Australian Information Commissioner (OAIC) has recently made a series of determinations that help establish expectations as to what constitutes reasonable steps (see our blog post here).

Although useful by way of guidance, inclusion of reference to those expected security measures, even by way of a note in the APPs themselves, would make it clearer to organisations what technical and organisational measures are expected of them. Similarly, the inclusion of specific baseline privacy outcomes would have provided helpful parameters for organisations looking to formulate their security control program.

De-identification and handling of de-identified information

The proposed reforms are particularly interesting in the way they approach de-identified data.

APP 11 currently requires the destruction or de-identification of personal information no longer needed for any purpose for which the information may be used or disclosed.

The choice between destruction or de-identification reflects that there may be reasons for organisations to retain de-identified data (for example, for research or statistical purposes^[2] or in training AI models).

 De-identification is a mechanism that changes the character of personal information such that it is no longer covered by the Privacy Act – which in turn provides greater scope for organisational use of the data.

This has proven problematic, as more recent best practice recognises that de-identification reflects a state at a particular point in time, one that may change as new data sets and technologies become available.

In response to recognition of the temporal nature of de-identification, an amended definition of ‘de-identified’ will be introduced (Section 6FG). Personal information will be de-identified at a particular time or in particular circumstances, if at that time or in those circumstances it does not relate to an individual who is identified or reasonably identifiable.

The Consultation Paper notes factors that may affect the state of de-identification include technological developments, data availability and the effectiveness of technical and organisational measures to avoid re-identification.[3]

The fact that de-identification is not a static condition and may change over time, and the risk of potential re-identification of de-identified personal information is explicitly recognised by a new ongoing evaluation obligation in APP 11.5. This new responsibility requires regular evaluation of the foreseeable risks that de‑identified information may be able to be re-identified over time.

The amended definition of ‘de-identified’ applies to all data held after the commencement of the new provisions, not just data collected after that time.

There are also exceptions to the obligation to destroy or delete including where the record is part of a Commonwealth record or required to be retained by an Australian law or court/tribunal order.

How does this compare with the previous proposals?

The proposed reforms have not gone as far as the proposals which recommended that APP 11.1 be amended so that APP entities must also take reasonable steps to protect de-identified information.

 However, a middle ground has been found. It recognises the risks of retaining de-identified information and requires the ongoing evaluation of the effectiveness of that de-identification as a risk management response.

Concluding Thoughts

Organisations will now have to be able to identify the personal information they hold, including the information to which the obligation to destroy or de-identify may apply, and regularly evaluate the effectiveness of their security controls and any de-identification measures taken. De-identification is no longer set and forget.

In addition, they will have to demonstrate that they have considered destruction where data is no longer needed for any purpose for which it may be used or disclosed.

Overall, this represents a substantial increase in regulatory obligations.

However, these reforms could have gone further in some important respects. Greater clarity on expected baseline security measures would help organisations understand what “reasonable steps” means in practice, especially as regulatory expectations continue to evolve through OAIC determinations. There is also scope for more transparency around the security measures organisations have implemented, how long they retain information, when and how they destroy it, and how they use de-identified information. Perhaps consideration could also have been given to the right to object to the retention and use of de-identified information?

In any case, the need to regularly evaluate the effectiveness of de-identification measures should keep organisational focus on the management of their de-identified data sets, which is a step forward.

[1] Privacy Reform – Consultation Paper, page 30

[2] Privacy Reform – Consultation Paper, page 29

[3] Privacy Reform – Consultation Paper, page 6