Privacy Compliance Questionnaire

All fields marked with an asterisk are mandatory*
Contact details
Company Name:*
Contact or Privacy Officer name*
Privacy Officer email*
Telephone*
ADIA privacy compliance questionnaire
You must answer all of these questions to validate membership
1. Has your organisation appointed a Data Privacy Officer DPO?*
Question information

Organisations are required to appoint a staff member to act as its data privacy officer. The data privacy officer should implement and oversee a privacy compliance strategy and respond to privacy enquiries and complaints. The privacy officer must have knowledge of privacy legislation and keep abreast of future changes.
- Yes
- No
2. Have your employees undergone privacy training over the past 12 months?*
Question information

Organisations should ensure staff working with personal information (PI) are familiar with the Australian Privacy Principles (APPs) and the Privacy Code and are aware of how they impact on its business practices. Training on the privacy laws and the privacy policy should be provided to all staff within the organisation. See the ADIA Academy for Privacy Law Training modules.
- Yes
- No
If the answer is yes, when was the training held and how many employees participated?
Training date:
No. of Employees:
If you answered no, please see for further information and tools.
3. Have you conducted an internal privacy audit over the past 12 months?*
Question information

The purpose of a privacy audit is to identify an organisations’ personally identifiable information PII policy and procedures and determine whether this process complies with the privacy laws of Australia and the industry Privacy Code. There is a positive obligation on member organisations to implement practices and systems to ensure organisations comply with the APPs and the Code. If your organisation requires assistance please refer to www.dataandinsights.com.au training portal.
- Yes
- No
4. Does your organisation have a compliant privacy policy available to the public?*
Question information

Ensure your company’s privacy policy meets the APP’s requirements including how an individual can access and seek correction of personal information, enquire or complain about a breach and if personal information will be disclosed to overseas recipients, in which countries recipients are likely to be located. See Privacy Code APP1 and www.dataandinsights.com.au/member-services/privacy
- Yes
- No
5. Are your privacy collection statements compliant with the APP’s and the Privacy Code?*
Question information

Members are required to update their collection statement/s to comply with the Privacy Code and APP5 to align with the manner in which it uses and discloses personal information. See Privacy Code APP5 and www.dataandinsights.com.au
- Yes
- No
6. Does your organisation conduct Privacy Impact Assessments (PIA) for new projects?*
Question information

A PIA is a process that should be adopted to understand personal information flows and privacy impact in respect of any new project to be undertaken. This will help to manage privacy risks during the course of a project and avoid breaches of the APPs. In respect of any project to be undertaken, a threshold assessment should be conducted to assess whether your organisation will be collecting, using or disclosing any personal information. If the answer to this question is ‘yes’, your organisation should undertake a PIA to identify and assess possible privacy issues.
Further information in respect of the process for conducting a PIA, including a guidance note and checklist, can be obtained from the OAIC website and ADIA Privacy site or training portal. See here in the first instance www.oaic.gov.au/privacy/guidance-and-advice/guide-to-undertaking-privacy-impact-assessments/
- Yes
- No
7. Does your organisation have a privacy protocol (rules) and information security system in place?*
Question information
Organisations should prepare policies and protocols (rules) in respect of:
- The collection, management, retention and use of contact lists or PI databases
- Provisions to deal with privacy in respect of any outsourcing or supplier contracts where personal information may be handled;
- Data security practices and procedures (including encryption, firewalls, restricted access and regular complex password changes, anti-virus software and backups to be stored securely in a separate location); and
- The removal, destruction or de-identification of data that is no longer required.
Additional resources are available from ADIA and include ISO 20252 and Privacy Compliance Guideline & Information Security (IDSCS) certification program.
- Privacy Law, ISO 20252 and information/data security is available via the ADIA Academy
- Yes
- No
8. Does your organisation have an inquiry and complaint program in place?*
Question information

Organisations need to ensure that they implement practices, procedures and systems for handling enquiries and complaints with respect to its compliance with the industry Code and the APPs. To ensure the process is fair and consistent, complaints and enquiries should be referred to a single point of contact being the Privacy Officer.
ADIA encourages members to analyse any enquiries and/or complaints over time to identify trends and improvement opportunities.
Working under the Privacy Code members are encouraged to refer to www.dataandinsights.com.au/member-services/privacy reporting procedures.
- Yes
- No
9. Does your organisation conduct regular audits?*
Question information

Data security Audits should be conducted (outside of your annual ISO 20252 audit) at regular intervals to review what steps your organisation currently takes to ensure personal information is up to date, complete and accurate and in respect of disclosure that it is relevant. Make sure audits focus on RISKS as identified in the PIA risk assessment as well as measure compliance to policies and protocols. It’s imperative that organisations review what steps are currently taken to ensure personal information collected is protected from misuse, interference, loss and from unauthorised access, modification or disclosure. See Privacy Code APP11.
- Yes
- No
10. Is your privacy officer aware they are required to report any potential or actual privacy breaches to ADIA?*
Question information

ADIA member organisations must report to the Code Administrator on the number, nature and outcomes of any serious (or systemic) complaints received about a potential breach. To assist members with this legal requirement ADIA has developed an online guideline and reporting mechanism that can be accessed at www.dataandinsights.com.au/member-services/privacy
Members are required to advise ADIA in regards to any serious or systemic complaints received and/or breaches that remain unresolved.
For further details on our data breach process please contact ADIA Secretariat on 0460 012 092 or email sarah@dataandinsights.com.au Alternatively, visit the member section at www.dataandinsights.com.au/member-services/privacy
- Yes
- No
11. Did your organisation receive any complaints in FY2022 related to Privacy?*
Question information

For the purpose of this question, complaints are broadly defined to include any issues or concerns raised about privacy or the collection, use of disclosure of personal information (i.e., not just alleged breaches of the ADIA privacy Code or APPs).
- Yes
- No
If yes, your company received complaints:
How many of these complaints were resolved to the satisfaction of the person who made the complaint?
What issues or concerns were raised in the complaints (Select all that apply)?
- Concern about how personal contact details were obtained
- Concern about why personal information was collected – for what purpose
- Concern about personal information being provided to clients and other third parties
- Concern about information security /risk of data breach
- Concern about where and how long your personal data is stored
- Concern about how many times the personal information will be used
- Concern that the PI may not be accurate
Other (please specify):

Privacy Compliance Questionnaire

ADIA Privacy Compliance checklist 2022

Contact details

ADIA privacy compliance questionnaire

Privacy pages

Recent news