AU Privacy & Data Protection Program — Medium Business

01 — WHAT

What is it?

The Privacy & Data Protection Program — AU Medium is a comprehensive, governance-grade privacy compliance program designed for Australian businesses with 16 to 100 staff, fully localised for Australian law. It builds on the Small Business foundation and adds the structures, reporting tools, and management controls that medium-sized Australian organisations need — including department-level Privacy Lead appointments, a tiered approval workflow aligned to the Australian Privacy Principles, a multi-team Notifiable Data Breaches response process, quarterly Senior Leadership Team dashboards, and annual Board-level reporting.
It provides everything needed to govern personal information at scale across multiple departments in full compliance with the Privacy Act 1988 (Cth), all 13 APPs, the Privacy and Other Legislation Amendment Act 2024 (Cth), and the NDB scheme.
________________________________________

02 — WHO

Who is it for?

• Business owners, boards, and senior leadership teams overseeing privacy compliance in Australia
• Australian medium businesses (16–100 staff) with multiple departments managing personal information
• Privacy Officers managing APP compliance across multiple departments and functions
• Department managers and Privacy Leads responsible for data handling in their area
• IT and systems staff managing cloud platforms, AI tools, and overseas data processing
• Contractors and external parties who need documented APP obligations and formal sign-off
________________________________________

03 — WHY

Why does it matter?

At medium business scale, Australian privacy risk is compounded across departments. Multiple teams may independently adopt cloud platforms and AI tools — many of which process data on overseas servers, triggering APP 8 obligations. Direct marketing activities across departments each require a confirmed APP 7 lawful basis. Data breaches can span functions, requiring a coordinated Incident Response Team to meet the 30-day NDB assessment window. And with the statutory tort in force since 10 June 2025, any individual can now sue the business directly in court — no OAIC complaint required first.

Relevant legislation includes:
• Privacy Act 1988 (Cth) — 13 Australian Privacy Principles (APPs 1–13)
• Privacy and Other Legislation Amendment Act 2024 (Cth) — in force 11 December 2024
• Notifiable Data Breaches scheme (Part IIIC Privacy Act 1988) — 30-day assessment window
• Racial Discrimination Act 1975 (Cth)
• Sex Discrimination Act 1984 (Cth)
• Disability Discrimination Act 1992 (Cth)
• Age Discrimination Act 2004 (Cth)
• Fair Work Act 2009 (Cth) — employee records exemption

Without a structured medium-business privacy program, organisations risk:
• APP 8 non-compliance across multiple departments using overseas cloud services and AI tools
• NDB scheme breaches — failing to assess and notify within 30 days across a multi-department organisation
• APP 5 collection notice gaps across different teams and collection points
• Board-level accountability failures when eligible data breaches require OAIC notification
• Direct court proceedings under the statutory tort — in force since June 2025
• APP 1.4 automated decision-making disclosure non-compliance from 11 December 2026
________________________________________

04 — WHEN

When do you need it?

• When multiple departments are independently adopting new systems, AI tools, or cloud services
• When the organisation needs a structured Incident Response Team for NDB scheme compliance
• When the Board requires annual privacy reporting and Privacy Officer attestation
• Before the 10 December 2026 APP 1.4 automated decision-making disclosure deadline — particularly important at medium scale where multiple departments may use AI-assisted systems
• When contractors and external parties need formal, documented APP obligations
• When the organisation needs a tiered approval framework to govern new data activities across departments
________________________________________

05 — WHERE

Where does it apply?

• All departments and functions managing personal information
• Cloud platforms and AI tools across all departments — APP 8 overseas data assessment
• Direct marketing activities across all functions — APP 7 compliance
• Cross-departmental NDB scheme breach assessment and Incident Response Team coordination
• Senior Leadership Team and Board governance and reporting
• Staff and contractor training, acknowledgement, and ongoing compliance
• Individual APP 12 access and APP 13 correction requests across multiple departments
________________________________________

06 — HOW

How does it work?

• Appoint a Privacy Officer and one Department Privacy Lead per function
• Map personal information across all departments — APP 3 basis, sensitive information consent, APP 8 overseas status, and direct marketing APP 7 basis for each collection
• Obtain Board or Senior Leadership Team approval for the Privacy & Data Protection Policy
• Activate the tiered approval workflow for all new data activities across all departments
• Train all staff, managers, Privacy Leads, IT teams, and contractors in their role-specific Australian privacy obligations
• Run monthly department sign-off checks and quarterly SLT dashboards
• Coordinate multi-department Incident Response Team responses to suspected NDB breaches — with SLT immediate notification and Board notification before OAIC
• Present the annual Board Privacy Report with Privacy Officer attestation under Australian law
• Review annually and update for OAIC guidance and legislative changes
________________________________________

07 — INCLUDED

What is included?

• 1.0 Product Document Index
• 1.1 Welcome Pack
• 1.2 Quick Start Guide
• 1.3 60-Day Implementation Roadmap
• 1.4 Programme Navigation Guide
• 2.1 Executive Summary
• 2.2 Board Privacy Report Template
• 3.1 Privacy & Data Protection Policy
• 3.2 Privacy Acceptable Use Policy
• 3.3 Privacy Data Handling Procedure
• 3.4 Privacy Risk Management Policy
• 3.5 Privacy Breach Response Policy
• 3.6 Privacy Approval Workflow Policy
• 3.7 Privacy Document Review & Update Policy
• 4.1 Privacy Breach Response Procedure
• 4.2 Third-Party Data Sharing Procedure
• 4.3 Privacy Impact Assessment Procedure
• 4.4 Individual Access & Correction Procedure
• 5.1 Privacy Impact Assessment Template
• 5.2 Staff Privacy Acknowledgement Form
• 5.3 Individual Access Request Form
• 5.4 Privacy Approval Request Form
• 5.5 Contractor Privacy Obligations Form
• 6.1 Privacy Register
• 6.2 Privacy Breach Register
• 6.3 Privacy Action Plan Register
• 6.4 Training Register
• 6.5 Third-Party Register
• 6.6 Version Control Register
• 6.7 Legislative Update Log
• 7.1 Privacy Monthly Review Checklist
• 7.2 Third-Party Assessment Checklist
• 7.3 Annual Privacy Review Guide
• 7.4 Privacy Dashboard Reporting Guide
• 8.1 Staff Privacy Training Guide
• 8.2 Manager Privacy Training Guide
• 8.3 Privacy Lead Training Guide
• 8.4 IT Systems Privacy Addendum