Privacy and Confidentiality Policy Template - Australia

Purpose and legal effect of a privacy and confidentiality policy

A Privacy and Confidentiality Policy outlines how an organisation collects, uses, stores, shares, protects, and disposes of personal and confidential information. It informs individuals of their rights in relation to data privacy and demonstrates the organisation’s commitment to lawful and ethical data handling. While not a contract, it may have binding effect in employment or commercial relationships and forms part of the organisation’s governance and compliance framework.

This template has been designed to:

• 1. Describe the types of personal, sensitive, and confidential information collected and the purposes for which it is used;
• 2. Explain how information is securely stored, accessed, and disclosed (internally and externally);
• 3. Establish procedures for data subject access, correction, and complaints;
• 4. Clarify the organisation’s responsibilities under the Privacy Act 1988 (Cth) and APPs, including overseas data disclosure obligations;
• 5. Define staff and contractor duties to maintain the confidentiality of organisational and third-party information.

Implementing a clear Privacy and Confidentiality Policy is essential for legal compliance, risk management, trust-building, and professional accountability.

Instructions for completion

Customisation and adaptation

This policy must be tailored to reflect the organisation’s operations, regulatory environment, and data practices. Key areas requiring customisation include:

• The categories of data collected and the purposes for collection (e.g. client records, employee data, medical history, financial information);

• Specific references to third-party systems, cloud storage, cross-border data transfers, or subcontracted processors;

• Internal roles responsible for privacy compliance (e.g. Privacy Officer, Data Controller, IT Manager);

• Sector-specific laws such as the Health Records Act 2001 (Vic) or Telecommunications Act 1997 (Cth), if applicable.

Legal and regulatory considerations

This policy must comply with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). Where applicable, it should also reflect obligations under:

• The Notifiable Data Breaches (NDB) Scheme (Part IIIC of the Privacy Act);

• The General Data Protection Regulation (GDPR) if the organisation handles data of EU residents;

• Confidentiality clauses in contracts with clients, suppliers, or employees.

Supplementary notes

• This policy should be accessible on the organisation’s website and distributed to all employees, contractors, and relevant third parties.

• It should be incorporated into onboarding, induction, and training materials.

• The policy should be reviewed at least annually or following legislative amendments, IT system upgrades, or significant organisational changes.

• Maintain version control and a log of updates for audit and compliance purposes.

Copyright and intellectual property notice

This document and its contents are subject to copyright protection under the Copyright Act 1968 (Cth) and all applicable intellectual property legislation. Unauthorised use, duplication, adaptation, or distribution is strictly prohibited without the prior written consent of Maguire Legal. Citation of excerpts is permitted only where full attribution is provided.

Legal disclaimer

This document has been prepared by Maguire Legal for general guidance purposes only. It does not constitute, and is not intended to constitute, legal advice. No warranties or representations are made as to its legal effect or suitability for specific circumstances. Users must exercise their own judgment and obtain independent legal advice prior to reliance. Maguire Legal disclaims all liability for any loss or damage arising from use of this document in whole or in part.

About Maguire Legal

Maguire Legal is an Australian law firm combining legal advice on all aspects of Australian employment, commercial, corporate and workplace relations law with exceptional business research skills and management development designed to build business capability in Australian enterprises of all types and size.

See Maguire Legal's full collection of essential templates for Australian small businesses.