Staff privacy essentials

Personal information is any information about an identified or reasonably identifiable person: a name, an email address, a photo, a customer number, a health note. Everyone who handles it shares responsibility for keeping it safe. Most privacy incidents start with an ordinary mistake, so small habits matter.

Handling personal information

• Do collect only what you need for the task in front of you.
• Do store it in approved systems, not on personal devices, personal email or USB drives.
• Do lock your screen and secure paper files when you step away.
• Don’t look up records you do not need for your work, including about people you know.
• Don’t keep spreadsheets or exports after the job is done.

Email

The OAIC has said that emailing personal information to the wrong recipient is the most common cause of human error breaches.

• Do check every recipient before you press send, especially when the address has autofilled.
• Do protect sensitive attachments, for example with password protection or encryption, as the OAIC suggests.
• Do use secure document systems rather than leaving sensitive information sitting in your inbox and sent items.
• Don’t forward long email chains without checking what earlier messages contain.

Generative AI tools

The OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available AI chatbots.

• Do use only AI tools your organisation has approved, and follow its rules for them.
• Don’t paste client, customer, staff or health information into a public AI tool.
• Do check AI output before you rely on it or send it.

Reporting a suspected breach

A lost laptop, a misdirected email, a suspicious login, a file shared with the wrong person: report it straight away. The OAIC’s guidance says a response plan should set out who staff must inform immediately if they suspect a data breach, and that a quick response is critical.

• Do report immediately to the person or team your organisation has named, even if you are not sure it is a breach.
• Don’t try to fix it quietly, delete evidence or wait to see what happens.

Next step

Lexora helps organisations build a privacy governance framework, including staff guidance, training and breach reporting lines. To discuss what would suit your team, book a free 20-minute call.

General information, not legal advice. Follow your organisation’s own policies, and ask your privacy officer if you are unsure.