Information for businesses

How to collect, store and dispose of identity information

There are good reasons to collect customer information. These include staying connected, tailoring services to individual needs, and improving customer satisfaction and retention.

You can take simple steps to reduce the identity information you collect and store, which helps to protect the information your business holds.

  • Only collect the identity information you need: If you are collecting identity information, you must do so only if it is necessary and directly related to your business. The more identity information a business holds, the greater a target it will be for identity theft, scams and cyber incidents.
  • Store and dispose of identity information responsibly: Protect your business and customers by destroying or de-identifying identity information when it is no longer required. Staff access to this data should be limited.
  • Use Australian Government's identity verification services: the Document Verification Service can help verify your customers’ identity electronically. It checks identity document details provided by users against original records and eliminates the need for businesses to keep records of identity documents. For more information, visit the IDMatch website.

Tips for protecting your business and customers

  • Remember that genuine emails about online government or businesses services will not include links to sign-in pages or ask for your identity information, account details, PIN or passwords.
  • If you are unsure if an email or SMS you have received is genuine, do not click on any links or open any attachments. Do research to find the organisation’s contact details, and contact them directly (for example, using a search engine).
  • If you are unsure about a change to supplier, or employee bank account details, call them to confirm. Do this even if they provided an explanation by email.
  • Never agree to any business proposal on the phone – always ask for an offer in writing.
  • Make sure your business computers have up-to-date security software.
  • Train your staff to look out for scams, potential identity theft or unusual activity.
  • Advise your customers that you will never contact them to ask for their customer login or payment information.
  • Monitor who is mentioning your business name online (for example, using a tool like Google Alerts).
  • Create strong passphrases for your business accounts and update passwords after staffing changes.
  • Limit staff access to identity information to only those with a genuine business need.

Privacy and personal information

If your business is collecting someone’s personal information, you may be required to comply with specific Australian legislation to protect that information. This may include the Privacy Act 1988 (Cth) (Privacy Act) and Australian Privacy Principles.

The Privacy Act regulates the way personal information is handled. It requires businesses to notify individuals that their personal information will be collected, how it will be used and who it will be shared with.

Before collecting someone’s personal information, you should understand the risks involved. You should also make sure there is a legitimate reason for collection.

The Office of the Australian Information Commissioner provides information and a privacy checklist for small businesses that can help you determine whether you need to comply with the Privacy Act and Australian Privacy Principles.

Responding to a data breach

Valuable identity information can be stolen through incidents such as cyber-attacks, data leaks or ransomware infections. Data breaches involving identity information can have a significant impact on your business in terms of cost, productivity, and reputation.

Having a good data breach response plan is essential for all organisations that collect identity information. Detecting and responding to a data breach quickly will prevent further damage to both your business and customers.

Report a data breach early to protect your business and customers from additional harm. You can reach out to:

Help for small businesses

Preventing a data breach is essential. Small businesses can improve their online safety and security with simple, low-cost measures like ensuring software is up to date, backing up data and using two‑factor authentication. If a breach does occur, system or device remediation may be required to ensure recovery. 

  • The Australian Cyber Security Centre has a range of resources to help small businesses protect themselves against common cyber security threats. For more information, you can visit the Small Business Cyber Security Guide and Securing Customer Personal Data for Small to Medium Businesses.
  • The Australian Small Business Advisory Services (ASBAS) provides individual support to Australian small businesses to help grow their digital capabilities. Visit Australian Government Business to find a digital solutions advisor near you.
  • IDCARE’s Small Business Cyber Resilience Service provides a range of tailored support services for small businesses to improve their cyber security and recover from cyber incidents. Call 1800 595 170 or visit the IDCARE website. (Note: There may be a charge for businesses to use this service.)

Related links