Protecting Customer Data — Privacy Act and GDPR Basics

The Australian Privacy Act 1988 (Privacy Act) and the 13 Australian Privacy Principles (APPs) govern how businesses handle personal information. The Privacy Act applies to organisations with annual turnover over $3M — and smaller organisations that provide health services (which includes apps handling health-related data like BathCheck and ShowerBuddy). Key requirements: (1) Collection limitation — only collect personal information necessary for your function. (2) Use limitation — only use personal information for the purpose it was collected. (3) Disclosure limitation — don't disclose personal information to third parties without consent. (4) Security — take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. (5) Transparency — have a privacy policy that explains collection, use, and disclosure. For BathCheck: NDIS client assessment data is sensitive health information. The Privacy Act requires additional protections: explicit consent before collection, enhanced security measures, and specific limitations on use and disclosure. You need a data processing agreement with any third-party services that handle this data (cloud hosting, analytics, AI APIs). Anthropic's API, Supabase, and your hosting provider should all have data processing agreements in place.

GDPR applies if you have users in the European Union — even if your company is Australian. For a niche Australian accessibility app, EU users may be minimal, but the legislation applies to anyone accessing your service from the EU. GDPR's core requirements: lawful basis for processing (consent, legitimate interest, or contractual necessity), right to access (users can request all data you hold on them), right to erasure ('right to be forgotten'), data portability (users can request their data in machine-readable format), privacy by design (data minimisation, pseudonymisation), and breach notification (72 hours to report significant breaches to the relevant authority). Practical implications for small SaaS: implement a data deletion workflow (when a customer cancels, what data is deleted and when?), an export endpoint (allow users to download their data), and a breach response plan. These are not just legal requirements — they're user trust signals. An NDIS provider asking 'what happens to our clients' data if we cancel?' should get a clear, documented answer.