Australia's privacy regulator is doing compliance checks for the first time ever, and a lot of businesses are about to get caught out
The Australia privacy regulator has just launched its first-ever compliance sweep as of this month.
The Office of the Australian Information Commissioner (OAIC) is reviewing privacy policies of 60 selected businesses that collect personal information across different sectors, think real estate open homes, car rental companies, pharmacies, car dealerships, second-hand dealers, hairdressing salons and more.
The compliance sweep is focused on checking if organisations are transparent about how they collect, use, and store customer data, including how they work with third-party suppliers and international vendors.
This caught my attention because it's exactly the gap I see when I review privacy policies for clients.
What they are checking is whether an organisations privacy policy acutally matches what they do with customer data. Not just whether you have one.
I work in this space and honestly, most businesses either don't have one in place or it's definately not reviewed and updated annually. Most privavcy policy were written 5 years ago and hasn't been touched since.
Most organisations haven't kept their privacy policy up to date with how they actually operate now. Maybe they added a new system or implemented an AI agent into their customer service department. Changed who has access to data. Or forgot that an application no longer in use still stores personal or sensitive information. Started collecting information differently.
Most businesses think they're compliant, until I review their privacy policy against their actual practices.
The disconnect is usually significant:
Their privacy policy says one thing, but operational processes do another
Collection methods have changed as their business has grown, but the policy hasn't and often the documented business processes haven't either
There's no clear line between what's documented and what's secured
Privacy isn't just a legal document issue. It's also a governance, business process and security issue.
If you're not confident your privacy policy really reflects how your business operates, now is the time to address it, especially if you cannot clearly explain what data you collect, what you do with customer data, where it lives, and who can access it.
The regulator doesn’t care if a lawyer or AI wrote it. They care if it's accurate and matches how your business handles the collected data, and if not then penalties and notices apply.
If you've been putting off reviewing your privacy policy, or haven't written one that's publicly available, this is probably your nudge.
