In August 2026 the OAIC (the Office of the Australian Information Commissioner, the privacy regulator) published a Privacy Essentials Checklist for AML/CTF reporting entities: 14 questions on how a business with AML/CTF obligations handles personal information. Below we take the OAIC Privacy Essentials Checklist one question at a time: what it means, what a yes looks like for a small firm, and where it comes from. Questions are quoted exactly; the numbers are ours.
In short: the Privacy Act applies to personal information you handle for AML/CTF work, whatever your turnover. The checklist is the OAIC’s list of basics. It is a starting point, not the whole law.
Who the OAIC Privacy Essentials Checklist is for
It is for AML/CTF reporting entities and their authorised agents (who carry out customer identification for them), including the Tranche 2 accountants, lawyers, conveyancers, real estate professionals and trust and company service providers whose obligations started on 1 July 2026. Small businesses ($3 million turnover or less) are usually outside the Privacy Act, but not for their AML/CTF work (Privacy Act s 6E(1A)): see our guide to the Privacy Act for AML/CTF businesses. “Section A” and so on below are sections of the OAIC’s Privacy guidance for reporting entities under the AML/CTF Act. An APP is an Australian Privacy Principle, a core rule of the Privacy Act.
Questions 1 to 4: people and risk
1. Does your organisation have someone responsible for overall privacy management?
Meaning. One person or team is accountable for privacy, in a role the OAIC says should be “appropriately resourced”.
A yes looks like a named privacy officer who knows it. In a small firm it can be the owner, alongside their other work.
Source: the checklist; Section A (APP 1).
2. Does your organisation have a privacy policy?
Meaning. A plain-English account of what personal information you collect, how, and how and why you use it, clearly expressed and up to date (APP 1.3).
A yes looks like a current policy covering your AML/CTF handling (an otherwise exempt small business need cover only that). From 10 December 2026 it must also describe certain automated decisions (APP 1.7 to 1.9).
Source: Section A (APP 1).
3. Does your organisation have a process for recording and considering privacy risks and issues?
Meaning. Privacy risks reach the person in charge, who decides what to do.
A yes looks like the OAIC’s examples: a privacy risk register that management signs off, privacy as a standing item at team meetings, and a privacy impact assessment of your AML/CTF systems. A small firm’s register can be a simple list.
Source: the checklist; the ID document fact sheet.
4. Does your organisation have a process for assessing a third party for privacy risk when procuring their solution or service?
Meaning. You check a provider before it handles client information.
A yes looks like reading its terms on personal information, asking for its privacy policy, security policy and breach plan, checking for past incidents, privacy terms in the contract, and confirmed deletion at the end. You are generally accountable for an overseas provider’s mishandling (APP 8).
Source: Sections N and G.
Questions 5 to 7: clients, collection and use
5. Does your organisation take reasonable steps to notify your customers why their personal information is being collected and how it will be used?
Meaning. APP 5, the collection notice rule: tell clients who you are, what you collect and why, the law requiring or authorising it, what happens if it is not provided, who you usually share it with (AUSTRAC included), whether it may go overseas, and how to see or correct it.
A yes looks like a short collection notice at onboarding (the OAIC has a template), never given where that would be inconsistent with tipping-off rules (AML/CTF Act s 123).
Source: Section E (APP 5).
6. Does your organisation only collect the minimum amount of personal information you need to carry out your AML/CTF obligations or your other functions and activities?
Meaning. APP 3.2: only what is “reasonably necessary”, which you must be able to justify. AML/CTF obligations are not a “blank cheque”, the OAIC says; convenient is not enough.
A yes looks like checking only who the law requires (at an auction, the vendor and successful buyer, not every bidder), and no ID copies for convenience: sight the document, record the fields you need, or use verification that returns yes or no.
Source: Section B (APP 3); the ID document fact sheet.
7. Does your organisation only use and disclose personal information for the purpose you collected it, or where an exception applies?
Meaning. APP 6: another use needs consent or an exception. What the AML/CTF Act requires or authorises, such as a suspicious matter report to AUSTRAC, needs no consent.
A yes looks like files opened for the work, not curiosity, and KYC details never reused (for marketing, say) without consent or an exception.
Source: Section F (APP 6).
Questions 8 to 11: holding, securing and deleting
8. Does your organisation have an inventory of your personal information holdings?
Meaning. A list of the kinds of personal information you hold. The OAIC calls it best practice.
A yes looks like a document or spreadsheet noting, for each kind: why you hold it, the law behind it, where it is stored, who can access it, how long you keep it, and whether it is sensitive or shared. Not the information itself.
Source: the checklist; the guidance’s “Privacy Tip”.
9. Does your organisation have cyber security processes and controls in place to secure personal information you hold for AML/CTF purposes?
Meaning. APP 11.1: reasonable technical and organisational steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure.
A yes looks like multi-factor authentication, role-based access, software updates and audit logs. A small firm may scale this, but taking no steps would not be reasonable.
Source: Section I (APP 11).
10. Does your organisation have a process to identify and manage a data breach?
Meaning. A data breach is personal information lost, or accessed or disclosed without authority: a hacked database, or details sent to the wrong person.
A yes looks like a documented plan with roles for leadership, legal advisers and IT. Take all reasonable steps to assess a suspected breach within 30 days (Privacy Act s 26WH(2)); if serious harm is likely, notify the OAIC and the people affected, or only the OAIC where telling a person would be inconsistent with a secrecy provision such as tipping off (s 26WP).
Source: the checklist; Section K.
11. Does your organisation have processes in place to ensure that personal information is de-identified or destroyed once it is no longer needed, including for any AML/CTF purposes?
Meaning. APP 11.2: reasonable steps to destroy or de-identify information you no longer need, unless a law or a court or tribunal order requires you to keep it.
A yes looks like someone deleting on a schedule, and the record of each ID check kept, not a copy of the ID: s 111 of the AML/CTF Act requires records of your customer due diligence, not scanned ID. For firms that were reporting entities before 31 March 2026, the OAIC says copies made before then can be kept for 7 years after the relationship ends or the last occasional transaction; a firm that joined on 1 July 2026 should ask its adviser.
Source: Section J (APP 11); the ID document fact sheet.
Questions 12 to 14: requests, threats and training
12. Does your organisation have processes for receiving and responding to privacy enquiries, complaints or requests from an individual that relates to their personal information? This should also include access and correction requests.
Meaning. People can ask to see (APP 12) or correct (APP 13) their information, or complain.
A yes looks like your privacy officer checking identity and replying within a reasonable time (usually 30 days for access, the OAIC says; it recommends 30 days for complaints). Refuse access that would tip someone off about a suspicious matter report, without saying why.
Source: the checklist; Sections A, L and M.
13. Does your organisation monitor and address new security risks and threats that may be relevant to the personal information you hold in relation to your AML/CTF obligations?
Meaning. Threats change, so keep watching.
A yes looks like a subscription to the OAIC’s Information Matters newsletter and the Australian Cyber Security Centre’s alerts, acted on, software updates included.
Source: the checklist.
14. Does your organisation provide privacy training to your staff on how to appropriately handle and protect personal information in relation to or in connection with their AML/CTF Act obligations?
Meaning. Staff understand your privacy obligations and their own part in them.
A yes looks like everyone who handles client information trained in privacy and cyber security fundamentals, and someone who will “monitor and enforce training completion”.
Source: the checklist; Section J.
How to work through the checklist
- Start with question 1: everything else needs an owner.
- Mark each question yes, partly or not yet.
- Turn each gap into a dated task, riskiest first, and revisit it when things change.
How CompliDesk helps
CompliDesk’s Privacy Hub has five steps: answer questions to produce a privacy policy and collection notice; download the policy; check the list of client information it builds from your records; write your plan for lost or stolen information; then the OAIC’s 14 questions, five of which it ticks itself. It records breaches and requests to see or fix information, counting the days. ID photos and selfies are deleted 30 days after each check is finished, from 15 December 2026; the record of the check stays.
The Hub is included in every CompliDesk monthly plan at no extra cost: see pricing and our Privacy Act compliance page.
General information, not legal advice.
Answer the 14 questions with your records in front of you
CompliDesk’s Privacy Hub builds your privacy policy, your list of client information and your plan for lost or stolen information, then takes you through the OAIC checklist. Sign up free today.
Get Started FreeFrequently Asked Questions
Related reading: Privacy Act compliance for AML reporting entities · Privacy training for staff · Data breach response plan template · How long to keep a copy of ID · Your AUSTRAC enrolment triggered Privacy Act obligations