Covers Australian Privacy Principle entities and covered handling of personal information.

The main requirements are to process personal information transparently and lawfully; minimise and secure data; manage access and correction; govern use, disclosure and cross-border transfer.

Personal-data protection follows information through collection, use, storage, sharing and deletion. The organisation deciding the purpose of processing can have different responsibilities from a supplier processing information on its behalf. Identifying those roles makes it possible to connect notices, permissions, contracts and security controls to the actual handling of customer and transaction data.

The practical questions are what information is needed, why it is used, who receives it, how long it is retained and how individuals can exercise the rights available under the relevant framework. Payment execution, financial-crime prevention, legal record keeping and optional marketing are different purposes. A basis for one purpose should not be treated as unlimited permission for every other use.

Security and privacy overlap but are not identical. Preventing unauthorised access does not alone answer whether an authorised use is lawful, while a privacy notice does not replace effective access control or incident response. Cross-border processing and outsourced services add further relationships that need to be understood within the instrument's territorial and substantive scope.

The instrument also addresses reporting and evidence: notify eligible data breaches and maintain privacy, consent, security and response records.