EN 1090 vs Australian Privacy Act
EN 1090
European standard for steel and aluminium structural execution
Australian Privacy Act
Australian federal law regulating personal information privacy
Quick Verdict
EN 1090 mandates CE marking for structural steel/aluminium in EU construction, while Australian Privacy Act enforces data protection via APPs for Australian entities. Fabricators use EN 1090 for market access; organizations adopt Privacy Act to avoid massive fines and ensure compliance.
EN 1090
EN 1090 Execution of steel and aluminium structures
Key Features
- Execution Classes (EXC1-4) scale requirements to risk
- Factory Production Control certification enables CE marking
- Mandates welding quality per ISO 3834 standards
- Full material traceability from procurement to delivery
- Ongoing Notified Body surveillance ensures conformity
Australian Privacy Act
Privacy Act 1988 (Cth)
Key Features
- 13 Australian Privacy Principles (APPs) for data lifecycle
- Notifiable Data Breaches (NDB) scheme for serious harm
- APP 8 accountability for cross-border disclosures
- APP 11 reasonable steps for security and retention
- OAIC enforcement with penalties up to AUD 50M
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
EN 1090 Details
What It Is
EN 1090 is the European harmonized standard family for execution and conformity assessment of structural steel and aluminium components under the Construction Products Regulation (CPR). It comprises EN 1090-1 (conformity), EN 1090-2 (steel), and EN 1090-3 (aluminium), using a risk-based approach via Execution Classes (EXC1-4) to scale requirements proportionally to failure consequences, service conditions, and production complexity.
Key Components
- Factory Production Control (FPC) Documented system for traceability, inspection, and processes, certified by Notified Bodies.
- Welding management aligned with ISO 3834, tolerances, corrosion protection, NDT.
- Declaration of Performance (DoP) and CE marking.
- Ongoing surveillance audits.
Why Organizations Use It
Mandated for EU market access of load-bearing components; reduces liability, ensures quality, enables high-risk projects (EXC3/4). Builds trust, cuts rework, supports sustainability via traceability.
Implementation Overview
Phased: gap analysis, FPC development, personnel training (e.g., Responsible Welding Coordinator), ITT/ITC, NB certification. Targets fabricators in construction; 6-12 months typical, with continuous surveillance.
Australian Privacy Act Details
What It Is
The Privacy Act 1988 (Cth) is Australia's foundational federal regulation for privacy protection. It regulates handling of personal information by government agencies and private sector organizations exceeding $3 million turnover (plus targeted small businesses). Primary purpose: balance individual privacy with information flows via principles-based 13 Australian Privacy Principles (APPs).
Key Components
- 13 APPs spanning collection, use/disclosure, security (APP 11), cross-border (APP 8), and rights (APP 12-13)
- Notifiable Data Breaches (NDB) scheme for serious harm incidents
- OAIC oversight with guidance, audits, investigations
- No certification; compliance via policies, self-assessments, enforcement
Why Organizations Use It
- Mandatory for APP entities to avoid penalties up to AUD 50M/30% turnover
- Risk management for breaches, vendor oversight
- Builds trust, enables cross-border operations
- Strategic governance amid reforms (children's privacy, AI)
Implementation Overview
- Phased: discovery/gaps, policy/controls, security/incident readiness, audits
- Applies economy-wide, extraterritorial via Australian link
- Ongoing; OAIC assessments, no formal certification
Key Differences
| Aspect | EN 1090 | Australian Privacy Act |
|---|---|---|
| Scope | Execution and conformity of steel/aluminium structures | Handling of personal and sensitive information lifecycle |
| Industry | Construction, fabrication (EU/EEA market access) | All sectors with >$3M turnover (Australia-wide) |
| Nature | Harmonized technical standard for CE marking | Mandatory federal regulation with civil penalties |
| Testing | FPC certification, AVCP audits by Notified Bodies | OAIC assessments, NDB breach notifications, no certification |
| Penalties | Market exclusion, no CE marking, certification withdrawal | Up to $50M fines, 30% turnover, enforcement actions |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about EN 1090 and Australian Privacy Act
EN 1090 FAQ
Australian Privacy Act FAQ
You Might also be Interested in These Articles...
Why applying the NIST CSF Standard is a Life-Saver!
Discover why NIST CSF 2.0 is a life-saver for organizations. This flexible framework's 6 functions—Govern, Identify, Protect, Detect, Respond, Recover—boost res
SOC 2 Trust Services Criteria in Plain English: Side-by-Side Decoder with Real-World Analogies
Decode SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy) into plain English with tables, TL;DRs & analogies
NIST CSF 2.0 Govern Function Deep Dive: Building Executive Cybersecurity Governance from Scratch
Step-by-step blueprint for NIST CSF 2.0 Govern function: templates, RACI matrices, metrics to elevate cybersecurity governance to boardroom level. Reduce breach
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Explore More Comparisons
See how EN 1090 and Australian Privacy Act compare against other standards