What It Is

Privacy Act 1988 (Cth) is Australia's primary federal regulation for personal information handling by government agencies and private sector organizations. It establishes a principles-based framework via the 13 Australian Privacy Principles (APPs), covering collection, use, disclosure, security, and individual rights, with a risk-based 'reasonable steps' approach enforced by the OAIC.

Key Components

• **13 APPsGovernance (APP 1), collection (APPs 3-5), use/disclosure (APPs 6-9), integrity/security (APPs 10-11), rights (APPs 12-13).
• NDB scheme for breach notifications.
• Special regimes for credit reporting, TFNs.
• No formal certification; compliance via audits, investigations.

Why Organizations Use It

• Legal compliance for entities over $3M turnover or handling sensitive data.
• Mitigates penalties up to $50M/30% turnover.
• Enhances risk management, trust, cross-border flows.
• Builds reputation, enables data-driven business.

Implementation Overview

• Phased: gap analysis, policy design, controls, training, audits.
• Applies economy-wide, scalable by size/risk.
• OAIC guidance, no certification but assessments required. (178 words)

What It Is

ISO/IEC 27018 is an international code of practice extending ISO/IEC 27001 and ISO/IEC 27002 specifically for protecting personally identifiable information (PII) processed by public cloud service providers (CSPs) acting as PII processors. Published in editions including 2014, 2019, and latest 2025, it addresses cloud-specific privacy risks like multi-tenancy, subprocessors, and cross-border flows through risk-based controls and implementation guidance.

Key Components

• Approximately 25–30 privacy-specific controls mapped to ISO 27001 Annex A themes (Organizational, People, Physical, Technological)
• Core principles: consent/choice, purpose limitation, data minimization, accuracy, transparency, accountability
• Integrated into ISO 27001 ISMS; assessed during certification audits via Statement of Applicability, no standalone certificate

Why Organizations Use It

CSPs use it for market differentiation, procurement acceleration, regulatory alignment (GDPR Article 28, HIPAA), risk reduction, cyber insurance benefits, and building stakeholder trust through transparent PII handling.

Implementation Overview

Start with gap analysis on existing ISMS, update policies/contracts/training, ensure subprocessors compliance. Applicable to CSPs all sizes/industries globally; requires third-party audits within annual ISO 27001 surveillance.