Privacy Act and Identity Documents: Compliance Guide

Collecting a copy of an identity document is routine for most businesses. It is also one of the highest-risk processing activities under the Privacy Act 1988 and the Australian Privacy Principles (APPs). An identity document contains sensitive personal information -- a unique number, photograph, signature, and sometimes biometric data -- whose non-compliant processing exposes the business to civil penalties of up to AUD 50 million under the enhanced penalty regime. This guide covers the applicable rules, OAIC guidance, and the concrete measures required to process identity documents in full compliance.

This article is for informational purposes only and does not constitute legal, financial, or regulatory advice. Regulatory references are accurate as of the publication date. Consult a qualified professional for guidance specific to your situation.

The Legal Framework: What the Privacy Act Says About Identity Documents

The Privacy Act 1988 does not contain specific provisions for identity documents. Their processing falls under the APPs, supplemented by OAIC guidance and the Notifiable Data Breaches scheme.

The Core Principles That Apply

Five APPs apply directly to the collection and processing of identity documents:

Lawfulness of collection (APP 3). Collecting an identity document must be reasonably necessary for the organisation's functions or activities. Depending on the context, this may be a legal obligation (AML/CTF customer identification), performance of a contract (lease agreement), or reasonably necessary for a business function (verifying a service provider's identity).

Data minimisation (APP 3.4). The organisation must collect only the information reasonably necessary for the stated purpose. This principle has major practical consequences for identity document processing, detailed below.

Storage limitation (APP 11.2). Identity documents cannot be retained indefinitely. When no longer needed and no legal obligation requires retention, the organisation must take reasonable steps to destroy or de-identify the information.

Security (APP 11.1). Identity documents must be protected against misuse, interference, loss, unauthorised access, modification, or disclosure through appropriate technical and organisational measures.

Notification (APP 5). The individual whose identity is being verified must be informed clearly: who collects their data, why, for how long, and what their rights are.

The AML/CTF Act 2006

For reporting entities under the AML/CTF Act 2006, customer identification procedures are mandatory. The Act requires verification of customer identity before establishing a business relationship, with specific requirements for the types of documents that must be collected and verified.

OAIC Guidance: Practical Rules

The OAIC publishes guidance on identity document processing that regulators apply during investigations. The OAIC investigated 2,634 matters in the 2023-24 financial year, with identity document violations (excess collection, failure to destroy, inadequate security) among commonly cited grounds.

When Can You Collect an Identity Document?

The OAIC distinguishes levels of identity verification based on the purpose:

Critical point. Many businesses systematically collect full copies of identity documents when Level 2 verification would suffice. This commonly occurs with real estate agencies demanding front-and-back licence copies for simple property inspections, or companies photocopying visitor IDs at reception.

Data Minimisation Applied to Identity Documents

Data minimisation is the most frequently overlooked principle in identity document processing. The OAIC provides clear guidance.

Collection of unnecessary data. When a document copy is required, data not relevant to the stated purpose should not be collected or should be redacted. For example, when verifying a tenant's identity, the driver licence number is unnecessary and should be obscured.

Data to collect by purpose:

Retention Periods

The Privacy Act and specific legislation impose retention periods that vary by processing purpose and legal basis.

Common mistake. Retaining identity documents of rejected rental applicants is a privacy compliance issue. The OAIC has investigated organisations on this exact point.

Technical Measures to Protect Identity Documents

Identity documents carry a high risk of identity theft in the event of a data breach. APP 11 requires reasonable steps to protect personal information -- and the OAIC's guidance makes the minimum standard explicit.

The OAIC's Guide to Securing Personal Information specifies that organisations should implement encryption, access controls, and audit logging proportionate to the sensitivity of the information (OAIC Guide to Securing Personal Information).

Mandatory Measures per OAIC Guidance

Encryption at rest and in transit. Digital copies of identity documents should be encrypted with a recognised algorithm (AES-256 minimum). Transmissions should use TLS 1.2 or higher.

Strict access controls. Access to identity documents must be limited to individuals with a justified operational need. Access rights should be reviewed regularly. Every access should be logged in an audit trail.

Secure hosting. Identity documents should be hosted on servers with appropriate security certifications. ISO 27001 or SOC 2 certifications are recommended. Australian data hosting is preferred to simplify APP 8 (cross-border disclosure) compliance. Our security page details the standards we meet.

Secure destruction. At the end of the retention period, documents must be destroyed irreversibly (cryptographic erasure or physical destruction of the storage medium). Moving a file to the recycle bin does not constitute compliant destruction.

Recommended Measures for High-Volume Processing

For businesses processing more than 1,000 identity documents per month, additional measures are recommended:

• Privacy Impact Assessment (PIA). Recommended when the processing is likely to have a significant impact on individuals' privacy. Large-scale processing of identity documents falls into this category.
• De-identification of extracted data. Data extracted from documents (name, number) should be de-identified in production databases where possible. The link to the source document should be accessible only in a dedicated secure environment.
• Environment segregation. Production, testing, and development environments must be strictly separated. No real identity documents should be present in test environments.

Individual Rights

The Privacy Act grants individuals rights applicable to identity documents, each requiring a response within a reasonable period (generally 30 days).

Rights Summary Table

Destruction Requests: Practical Scenarios

Scenario 1: A customer requests deletion of their passport copy after cancelling their insurance policy. The insurer can refuse if the legal retention period (7 years under AML/CTF Act) has not elapsed. However, it must inform the customer of the legal basis justifying continued retention and the scheduled destruction date.

Scenario 2: A rejected rental applicant requests deletion of their documents. The agency must destroy all documents promptly. Failure to do so may constitute a breach of APP 11.2.

Scenario 3: A former employee requests deletion of their ID copy 8 years after leaving. The company must proceed with destruction, as the 7-year retention period has expired.

Privacy Act and Automated Document Verification

Using automated document validation solutions raises specific privacy questions, particularly regarding automated decision-making and data processing arrangements.

Automated Decision-Making

While the Privacy Act does not contain specific provisions equivalent to GDPR Article 22 on automated decision-making, the OAIC expects that decisions with significant impact on individuals should involve appropriate human oversight. An automatic file rejection based on identity document non-compliance should include the ability for human review.

To remain compliant, the business should:

• Inform the individual that automated processing may be involved.
• Guarantee the right to human review (an operator must be able to review the file).
• Explain the logic behind the decision (reason for rejection, unmet criterion).

Third-Party Processing Arrangements

When a business uses an external provider for document verification, the Privacy Act requires appropriate contractual arrangements to protect personal information. This should specify:

• The nature and purpose of the processing.
• The types of personal information processed.
• The security measures implemented by the provider.
• The conditions for sub-contracting.
• The terms for data return and destruction at contract end.
• The conditions for audit by the contracting organisation.

Cross-Border Disclosure

The choice of document verification provider must factor in cross-border disclosure implications. APP 8 requires that before disclosing personal information to an overseas recipient, the organisation must take reasonable steps to ensure the recipient does not breach the APPs. Australian-hosted solutions eliminate this compliance complexity.

Privacy Compliance Checklist for Identity Documents

Here are the actions to verify to ensure your identity document processing is compliant.

Before Collection

• Verify that collecting the identity document is reasonably necessary for your functions (APP 3).
• Confirm that the required verification level (declarative, simple, enhanced) matches the stated purpose.
• Draft or update the privacy collection notice (APP 5) including: identity of the collecting entity, purpose, retention period, and individual rights.
• Conduct a Privacy Impact Assessment if processing is large-scale.

During Processing

• Apply data minimisation: do not collect data not necessary for the stated purpose.
• Encrypt collected documents (at rest and in transit).
• Restrict access to authorised personnel only, with access logging.
• If using an external verification provider, verify the existence of appropriate contractual protections and confirm Australian or approved-jurisdiction data hosting.
• If automated decisions are made, guarantee the right to human review and decision explanation.

After Processing

• Schedule automatic destruction of documents at the end of the retention period.
• Implement a process for responding to access and correction requests (APP 12, APP 13) within 30 days.
• Document the processing in your APP 1 privacy policy.
• Audit process compliance annually.

Balancing Privacy Compliance and Operational Efficiency

Privacy Act compliance and operational efficiency are not contradictory. The most advanced automated document verification solutions build privacy requirements in natively: automatic data minimisation, end-to-end encryption, scheduled destruction, full audit trails, and the right to human review.

CheckFile designed its document validation platform with native privacy compliance. Documents are processed with end-to-end encryption and automatically destroyed at the expiration of the retention period you define. Every processing action is logged and auditable. Our platform processes over 180,000 documents per month with a 94.8% fraud detection rate and an average verification time of 4.2 seconds. Explore our pricing to find the plan that fits your document volume, or contact our team for a demo and a compliance audit of your current document workflows.

For a comprehensive overview, see our document compliance complete guide.

Go further

To dive deeper into this topic, explore our complete guide on document verification.

---

Frequently Asked Questions

When can a business legally collect a copy of an identity document under the Privacy Act?

Collecting a full copy of an identity document is only justified when enhanced verification is required by law or is reasonably necessary for the organisation's functions. The OAIC distinguishes three levels of verification: declarative (just a name, no document needed), simple verification (sighting of the document without a copy, or a partial copy), and enhanced verification for legal obligations such as AML/CTF customer identification, employment contracts, or regulated transactions. Many businesses systematically collect full document copies when a lower level of verification would suffice, which may constitute a breach of APP 3.

How long can a business retain identity document copies in Australia?

Retention periods depend on the legal basis for processing. AML/CTF customer identification documents must be retained for 7 years after the end of the business relationship, as required by the AML/CTF Act 2006. Copies held under an employment contract should be destroyed 7 years after the employee leaves. For accepted rental applications, documents may be retained for the duration of the lease plus the applicable limitation period. For rejected applications, all documents must be destroyed promptly. Retaining rejected applicant documents beyond a reasonable period may breach APP 11.2.

What technical measures are required to protect stored identity documents?

APP 11 and OAIC guidance require reasonable steps proportionate to the sensitivity of the information. This includes encryption at rest (AES-256 recommended) and TLS 1.2 or higher for transmissions. Access to identity documents must be restricted to individuals with a justified operational need, access rights should be reviewed regularly, and every access should be logged. Secure destruction must be irreversible at the end of the retention period. For organisations processing more than 1,000 identity documents per month, a Privacy Impact Assessment is recommended.

What are the penalties for privacy breaches involving identity documents?

Under the enhanced penalty regime introduced in 2022, serious or repeated interferences with privacy can attract civil penalties of up to AUD 50 million, three times the value of any benefit obtained, or 30% of the entity's adjusted turnover in the relevant period -- whichever is greatest. The OAIC also has the power to issue infringement notices, accept enforceable undertakings, and make determinations requiring compensation to affected individuals.

What are the obligations when using an automated document verification system?

Using an automated verification system requires appropriate contractual protections with the provider, ensuring personal information is handled in accordance with the APPs. The OAIC expects human oversight for decisions with significant impact on individuals. The provider arrangement should specify data location, security measures, sub-contracting conditions, and destruction terms.