Privacy, data and AI governance glossary

Australian Privacy Principles (APPs). The 13 principles in the Privacy Act that govern how covered organisations handle personal information.

Automated decision-making. A decision made, or substantially and directly assisted, by a computer program. From 10 December 2026, certain ones must be described in privacy policies.

Collection notice. The information an organisation must give people when it collects their personal information (APP 5).

Critical data. The data an organisation relies on most for decisions, reporting or compliance, and so governs most closely.

Data classification. Labelling information by sensitivity, so that security and access rules follow the label.

Data owner and data steward. The owner is accountable for a data set; the steward looks after its quality and day-to-day use.

Eligible data breach. A breach likely to result in serious harm to individuals, which must be notified under the Notifiable Data Breaches scheme.

Exposure draft. Draft legislation released for comment before it is introduced to Parliament. It is not law.

ISO/IEC 27701. A voluntary international standard for privacy information management systems. Certification comes only from accredited bodies.

ISO/IEC 42001. A voluntary international standard for AI management systems. Certification comes only from accredited bodies.

NIST AI Risk Management Framework. A voluntary US framework for managing AI risk, often used as a reference point.

Personal information. Information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Privacy impact assessment (PIA). A structured review of how a project or system will affect privacy, done before it starts.

Sensitive information. A category of personal information with stricter rules, including health, racial or ethnic origin, and religious beliefs.