Candidate data privacy comes down to three habits: collect only what the job needs, keep it where few people can reach it, and delete it when there is no reason left to hold it. A licence photo, a visa record, a tax file number (TFN) or a set of bank details does real damage if it lands in the wrong inbox.
Whether the Privacy Act covers your business depends mostly on turnover, and unsuccessful applicants are treated differently from employees. This guide draws on the Office of the Australian Information Commissioner (OAIC) and the Fair Work Ombudsman. It is general information, so check the linked government sources or get advice for your own situation.
What candidate information should you collect, and what can you leave?
Collect what the role needs at the stage you have reached, and leave the rest. The OAIC's guidelines on Australian Privacy Principle 3 say an organisation may only collect personal information that is reasonably necessary for its functions or activities, and that collection should be limited to the minimum necessary. Sensitive information also needs the person's consent unless an exception applies. For a warehouse or food plant, that looks like this:
- Licence and ticket photos - note that you sighted the licence, its class and its expiry date. Keep the image only if you have a reason to.
- Visa or work rights evidence - ask the person you intend to hire, not every applicant. For right-to-work checks and privacy duties in general terms, see Chandler's guide to legal considerations when hiring blue collar workers.
- TFN and bank details - these are for tax and payroll, so ask after the offer is accepted, not at application.
Does the Privacy Act apply to your business?
It applies to businesses with annual turnover above $3 million and to some smaller ones, so many small businesses are outside it. The OAIC's small business guidance defines a small business as one with annual turnover of $3 million or less. Regardless of turnover, the Act covers businesses such as health service providers, those trading in personal information, Commonwealth contractors, businesses related to a covered business and those that have opted in. Its checklist also asks about turnover in earlier financial years, so work through it.
The Australian Privacy Principles treat applicants and employees differently. The OAIC's employee records exemption page says a private sector employer's handling of employee records for current and former employment is exempt in certain circumstances. It does not cover unsuccessful job applicants, although pre-employment check records become exempt once the person is employed. The Fair Work Ombudsman still says employee records are private and confidential, so give staff files the same care.
Chandler Personnel's privacy policy, written for people it registers for work placements, shows one plain layout for telling candidates what happens to their details: why information is collected, how it is used, who it may be disclosed to and how a person can see it.
How should you store and share ID documents?
Keep ID documents in one controlled place with named access, not scattered across inboxes, phones and shared folders. The OAIC's guide to securing personal information says what counts as reasonable steps depends on the circumstances. Keeping ID documents on a shared drive anyone can open is the habit to break first.
- One home - a locked cabinet for paper, and one folder with an owner for digital copies.
- Need-to-know access - for tax file numbers, the OAIC's guidance says recipients must restrict access to staff who need to handle the information, and the same habit suits licence and bank details.
- Email - the securing guide says email is not a secure form of communication. It suggests checking the recipient's address first and sending sensitive information as an encrypted or password-protected attachment.
- Phones and logins - the guide asks whether you have considered remote wiping for lost devices. The OAIC also publishes advice from the Australian Cyber Security Centre, which names phishing as a common way to obtain credentials and recommends multi-factor authentication for remote access and sensitive data.
When does a data breach have to be reported?
A covered organisation must notify affected people and the OAIC when a breach is likely to result in serious harm. The OAIC's when to report page says an eligible data breach under the Notifiable Data Breaches scheme involves unauthorised access to, unauthorised disclosure of, or loss of personal information the organisation holds. It must be likely to result in serious harm to one or more individuals, and remedial action must not have prevented that risk. An organisation that suspects one must quickly assess whether serious harm is likely.
The OAIC's examples of a data breach include a lost or stolen device and information mistakenly given to the wrong person, so ordinary office mistakes can start the process. Only a breach that is likely to cause serious harm has to be reported. Notices to individuals must include recommended steps.
What should you do after a lost phone or a mis-sent email?
Act as soon as you notice, then document what you did. For example, a payroll coordinator at a Melbourne food plant sends a new starter's licence and bank details to the wrong address. A sensible order is:
- Contain it - ask the recipient to delete the email without forwarding it, lock or remotely wipe a lost phone, and reset passwords if an account may be compromised.
- Write it down - what was exposed, whose details, when, and who has them now.
- Assess the harm - a licence copy with date of birth and bank details together carries more risk than a CV with a phone number.
- Notify if required - if the breach is eligible, tell the individuals and the OAIC. If you are unsure, read the OAIC page or get advice.
- Fix the cause - stop sending IDs as plain attachments, for example.
How long should you keep recruitment records?
Employee time and wages records must be kept for 7 years, but that does not decide how long to keep a rejected applicant's file. The Fair Work Ombudsman's record-keeping page says employers have to keep time and wages records for 7 years, and that employee records are private and confidential. Its list covers pay, hours, leave, super and termination details, not copies of licences or ID, so do not assume the 7 years extends to them.
For unsuccessful candidates, neither the OAIC nor the Fair Work Ombudsman pages linked in this guide give a fixed period. Under Australian Privacy Principle 11.2, covered organisations must take reasonable steps to destroy or de-identify personal information once it is no longer needed, unless the law requires them to retain it. How long to keep them is therefore your call: choose a period you can justify and write it down. Other rules, such as those for right-to-work check records, may carry their own periods, so check them before you delete anything.
If you hire through an agency for some roles, agree which files stay with it and which stay with you. For the wider choice between hiring in-house and using an agency, Chandler's comparison of in-house recruitment and agencies sets out cost, speed and flexibility.
Related Resources
- About the Notifiable Data Breaches scheme
- The Australian Privacy Principles
- How to report a data breach to the OAIC
- Data breach preparation and response guide
- Fair Work Ombudsman record-keeping fact sheet
- Request staff form
Frequently Asked Questions
Does the Privacy Act apply to small businesses?
Most small businesses are not covered, but some are. The OAIC defines a small business as one with annual turnover of $3 million or less, and says some businesses are covered regardless of turnover.
Can I keep a copy of a candidate's driver licence or visa?
Often yes, but only if you need it. If the Privacy Act covers you, collection must be reasonably necessary and limited to the minimum, so record the check and keep the image only if you have a clear reason. Store any copy in one access-controlled place.
How long do I keep employee time and wages records?
The Fair Work Ombudsman says employers have to keep time and wages records for 7 years. They must be legible, in English and readily accessible to a Fair Work Inspector.
How long do I keep an unsuccessful candidate's details?
No fixed period appears in the OAIC or Fair Work Ombudsman pages linked in this guide. If the Privacy Act covers you, Australian Privacy Principle 11.2 requires reasonable steps to destroy or de-identify information once it is no longer needed. Set a period, write it down, and delete on schedule.
Candidate Data Privacy Starts With Collecting Less
Candidate data privacy is mostly small, repeatable habits: ask for less, keep it in one place, send it carefully and delete it on schedule. Chandler Personnel provides labour hire and permanent recruitment if you want help with the hiring itself. Write a one-page rule on who may hold ID copies, how they are sent and when files are destroyed. This week, list every place candidate IDs currently sit and move them to one.
