Part 2- Businesses must only collect personal information when reasonably necessary

Part 2 of a four-part series on your business' responsibilities related to cyber attacks and data breaches

Protect your business by only collecting personal information you need

The best way to protect your business from a data breach is to avoid collecting any personal information. Of course, this often goes against commercial goals. However, as suggested by the Office of the Information Commissioner (OAIC), businesses must consider whether it is necessary to collect and hold personal information to carry out their functions or activities.¹

Two of the Australian Privacy Principles (APP) impose obligations on businesses at the personal information collection stage.

The first, APP 3, imposes obligations on the collection of solicited personal information. This applies to information that a business 'requests'. Examples include credit account forms, employment applications responding to job ads, credit card payment records and CCTV footage.