Privacy training for staff at AML/CTF businesses: what to cover, how often, and how to record it

If your firm has AML/CTF obligations, the OAIC (the Office of the Australian Information Commissioner, the privacy regulator) wants to know whether your staff are trained in privacy. It is the last of the 14 questions on its Privacy Essentials Checklist for AML/CTF reporting entities (August 2026). This guide covers privacy training for staff at an accounting, legal, conveyancing or real estate firm: what to cover, how often, and how to record it, using only what the OAIC’s guidance says.

This is the privacy side; for the AML/CTF side, see AML employee training requirements.

What the OAIC asks about privacy training for staff

Question 14 of the checklist reads:

The OAIC’s guidance beside it is three sentences:

So there are three parts: what staff learn (your obligations, and their part in them), the level (the fundamentals of privacy and cyber security), and the follow-up (someone checks it is done).

Training comes up twice more. Question 11, on deleting information, says to “ensure staff are adequately trained and aware of the need for de-identification or destruction”. And Section J of the OAIC’s Privacy guidance for reporting entities under the AML/CTF Act lists “conducting regular training and monitoring to ensure compliance” among the reasonable steps for keeping and destroying information under APP 11. (An APP is an Australian Privacy Principle, one of the core rules of the Privacy Act.)

Why staff privacy training matters in a small business

Small businesses (turnover of $3 million or less) are usually outside the Privacy Act. A firm with AML/CTF obligations is not, for the personal information it handles for, or in connection with, that work (Privacy Act s 6E(1A)). Our guide to the Privacy Act for AML/CTF businesses explains how far that reaches.

Most of that handling is done by staff. The OAIC calls AML/CTF records a “honey pot” for criminals, and says holding more information for longer may increase the risk of unauthorised access by staff or contractors. One of its two examples of a data breach is information given to the wrong person by mistake.

Privacy Act training for employees also supports APP 1.2: reasonable steps to put in place practices, procedures and systems that ensure you comply with the APPs, and to receive and respond to privacy enquiries and complaints. Section A adds that staff should be able to recognise a privacy complaint.

Who needs it

• Everyone who handles client information for your AML/CTF work: whoever onboards clients, runs identity checks, reviews screening results, files documents or answers client emails.
• Your privacy officer, in more depth. The checklist says one or more staff should handle privacy enquiries, complaints, and access and correction requests in a timely manner. In a small firm that may be one person who also does other work.
• Whoever looks after your IT. The checklist says to include staff like IT in your data breach response, because their support is needed both to prevent a breach and to identify the people affected.

What to cover in privacy training for employees

Nine topics, each drawn from the OAIC guidance. Add your own procedures to them: who your privacy officer is, where client files live, and the wording of your collection notice.

1. Why the Privacy Act applies to your AML/CTF work. The OAIC’s three questions: is it personal information; is the firm otherwise exempt, for example as a small business; and is the information handled for, or in connection with, AML/CTF obligations? (Privacy Act s 6E(1A); the OAIC’s “Is it personal information?” decision tree)
2. Personal and sensitive information. The details and ID documents you collect for customer due diligence are personal information. Some is sensitive and more strongly protected: health information, a criminal record, or biometric information used to verify identity, such as a selfie matched to an ID. The OAIC’s view is that consent should generally be sought before biometric verification for customer due diligence. (Section D)
3. Collect only what is reasonably necessary. AML/CTF obligations are not a “blank cheque”. Do not take a copy of an ID just because it is convenient; at an auction, check the vendor and the successful buyer, not every bidder; and leave unrelated details off the file (the OAIC’s example is a health condition found in a media search on a job applicant). (APP 3.2; Section B; the ID document fact sheet)
4. Tell clients why, and never tip anyone off. Staff should know your collection notice and when it goes out (APP 5). They must never disclose anything that would or could reasonably be expected to prejudice an investigation, such as the existence of a suspicious matter report. (Section E; AML/CTF Act s 123)
5. Use information only for the reason it was collected. Another use needs consent or an exception. What the AML/CTF Act requires, such as a suspicious matter report to AUSTRAC, needs no consent. (APP 6; Section F)
6. Privacy and cyber security basics. Multi-factor authentication (two-step sign-in), sound passwords, software updates, each person using their own login so audit logs are accurate, and keeping client information inside the firm’s systems. (APP 11.1; Section I; checklist questions 9 and 14)
7. Keep the record, not the copy. The AML/CTF Act requires records of your customer due diligence (s 111), not scanned copies of ID documents. Staff should know your deletion schedule, who runs it, and any other law that requires a copy (the OAIC’s example is e-conveyancing rules). (APP 11.2; Section J; checklist question 11)
8. Recognise a request or complaint, and pass it on. People can ask to see their information (APP 12), ask you to correct it (APP 13), or complain. It goes to the privacy officer, because the firm must answer an access request within a reasonable time (usually 30 days, the OAIC says) and must never reveal a suspicious matter report in its reply. (Sections A, L and M)
9. Spot a data breach and report it at once. Information lost, or accessed or disclosed without authority, is a data breach, and responding quickly reduces the harm. The firm takes all reasonable steps to assess it within 30 days (Privacy Act s 26WH(2)), and tells the OAIC and the people affected if serious harm is likely; where telling a person would be inconsistent with a secrecy provision such as tipping off, it tells only the OAIC (s 26WP). (Section K)

How often should staff do privacy training?

The OAIC does not set a fixed interval. Its guidance speaks of “regular training and monitoring”, and the checklist asks you to “monitor and enforce training completion”. In its worked example, a club facing changed AML/CTF obligations identifies that it needs to complete staff training ahead of the change.

A practical rhythm:

• when someone joins, before they handle client information;
• a refresher once a year;
• when something changes: a new system, a new obligation, or after a breach or a near miss.

That rhythm is our suggestion, not a legal requirement.

How to record staff privacy training

“Monitor and enforce training completion” needs a record. The guidance does not set its format, so keep it simple:

1. List everyone who handles client information for your AML/CTF work.
2. Choose the material and note its date or version, so you know who trained on what.
3. Give each person a due date.
4. Record each completion: name, role, date, what was covered, and how understanding was checked, such as a short quiz.
5. Follow up anyone overdue. Enforcing completion can be as simple as no client files until it is done.
6. Set the next date for each person.
7. Keep the record with your privacy documents, beside your completed OAIC privacy checklist.

How CompliDesk helps

CompliDesk’s staff training includes a 15-minute privacy lesson, written from the OAIC guidance, with a short quiz, and shows which of your team have finished it. It covers the nine topics above.

The Privacy Hub then walks you through five steps, from your privacy policy and collection notice to a plan for lost or stolen information, ending with the OAIC’s 14 questions; CompliDesk ticks five of them itself. CompliDesk deletes ID document photos and selfies 30 days after each identity check is finished, from 15 December 2026, and keeps the record of the check. The Privacy Hub is included in every CompliDesk monthly plan at no extra cost: see pricing.

This is general information, not legal advice. Get independent advice on how the rules apply to your firm.

Frequently Asked Questions

Related reading: Privacy Act compliance for AML reporting entities · The OAIC privacy checklist, question by question · AML employee training requirements · Data breach response plan template · Access requests and tipping off