Last updated 29 October 2026
1. Purpose
The Barrack St Compliance Co (BSCC) has chosen to be treated as an organisation for the purposes of the Privacy Act 1988 (Cth) (the Act). BSCC has been listed on the Office of the Australian Information Commissioner Register of Entities that have opted in to Privacy Act coverage. We are a registered organisation under the Privacy Act 1988 and the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth). The BSCC will only collect information necessary to deliver our services.
The BSCC is committed to protecting the privacy of the organisations we provide services to and the personal information they provide. The Australian Privacy Principles (APPs) require us to notify the organisations we provide services to about the personal information we collect. This includes information about our processes and systems for collection, access, correction and complaints.
Our Privacy Statement is provided to prospective clients in the proposal documentation they receive and a copy is maintained on our website.
1.1 Collection of information
The BSCC provides internal auditing services to private entities and regulatory auditing services to federal and state government agencies. During an audit we review and may record a range of personal information to meet our contractual obligations in line with Vocational Education and Training (VET) standards and other government regulations and guidelines. This information is collected to inform the completion of internal Audit Reports and Audit Reports conducted on behalf of regulatory bodies.
The BSCC staff will also keep all personal and sensitive information secure, and only disclose such information with the written permission of the client or staff member.
The BSCC privacy policy applies to all BSCC staff and is relevant for personal information relating to all BSCC clients and staff. All new staff will be required to agree to and sign off on the BSCC’s Privacy Policy as part of their employment contract. Privacy training is a mandatory part of all induction training for new staff.
2. Scope
In Australia, privacy law generally relates to the protection of an individual’s personal information. Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.
The Privacy Act includes thirteen Australian Privacy Principles (APPs). The APPs set out standards, rights and obligations for the handling, holding, accessing and correction of personal information (including sensitive information).
The Privacy Act also contains provisions that deal with:
- tax file numbers
- credit-related information
3. Policy
In order to be compliant with the Act, the BSCC has incorporated the 13 Australian Privacy Principles into our systems and practices across all functions. The application of the 13 Australian Privacy Principles to the BSCC policy and procedures is outlined below:
APP 1 – Open and transparent management of personal information
APP 1 ensures that APP entities manage personal information in an open and transparent way. This includes having a clearly expressed and up to date APP privacy policy.
The BSCC Privacy Statement is posted on the website. This Statement will provide advice on how a client can progress an access request and/or how to raise a concern about privacy. The BSCC’s staff are provided a copy of this Privacy Policy in their induction training manual.
APP 2 – Anonymity and pseudonymity
APP 2 requires APP entities to give individuals the option of not identifying themselves, or of using a pseudonym. Limited exceptions apply.
This principle does not apply to the services offered by the BSCC. However, the BSCC recognises that an individual client’s participation in the BSCC’s services should not be disclosed to a third party other than those identified under APP 2. The BSCC’s staff must be mindful of all communication with clients including details provided in telephone messages and direct mail which may inadvertently disclose participation.
APP 3 – Collection of solicited personal information
APP 3 outlines when an APP entity can collect personal information that is solicited. It applies higher standards to the collection of ‘sensitive’ information.
In relation to an Internal Audit BSCC will obtain consent from an organisation to collect personal information as part of the BSCC Agreement to provide services. The BSCC Agreement will include a clause declaring that the client has obtained the consent of its individual employees to permit this information to be collected in a lawful manner and without undue coercion or intrusiveness.
The purpose for the BSCC collecting information from a client about its staff and students is to oversight personal information including personnel qualifications and curriculum vitae.
At the time of signing an Agreement with the BSCC, the Director will inform the client of the following:
- their rights to access their personal information
- the purpose of the collection of this information
- third parties to whom the BSCC may disclose their personal information if any
- relevant and related laws; and
- potential consequences of not providing all or part of their personal information
This information will be provided in the form of the BSCC Privacy Statement.
The BSCC will only collect Sensitive Information
- if the client or staff member provides consent to do so,
- the information is required or authorised by law,
- the information is required to prevent or lessen a serious and imminent threat to the life or health of an individual, or
- the information is necessary in relation to a legal claim.
APP 4 – Dealing with unsolicited personal information
Where an organisation receives unsolicited personal information, it must determine whether it would have been permitted to collect the information under APP 3. If so, APPs 5 to 13 will apply to that information.
If the unsolicited personal information could not have been collected under APP 3, and the information is not contained in a Commonwealth record, the BSCC recognises its obligation to destroy or de-identify that information as soon as practicable, but only if it is lawful and reasonable to do so.
APP 5 – Notification of the collection of personal information
APP 5 specifies certain matters about which an organisation must generally make an individual aware, at the time, or as soon as practicable after, the organisation collects their personal information.
The BSCC recognises that it is required to notify individuals about the access, correction and complaints processes in the BSCC Privacy Policy, and also whether there are any likely overseas recipients of individuals’ information.
APP 6 – Use or disclosure of personal information
Information collected will only be used, or disclosed, for the primary purpose for which it was collected.
The BSCC provides internal auditing services to private entities and regulatory auditing services to federal and state government agencies. During an audit we review and may record a range of personal information to meet our contractual obligations in line with Vocational Education and Training (VET) standards and other government regulations and guidelines.
This information is collected to inform the completion of internal Audit Reports and Audit Reports conducted on behalf of regulatory bodies. The personal information collected relates to the following groups:
Staff
Personal information that may be reviewed about staff from organisations audited by the BSCC includes:
- copies of qualifications
- copies of CVs
- general employment and HR information
Personal information that may be recorded about staff of organisations audited by the BSCC includes:
- name (for purpose of informing the Audit Report)
- gaps in evidence against VET standards
- gaps in evidence against the audited organisation’s management system
Students
Personal information that may be reviewed about students of organisations audited by the BSCC includes:
- enrolment details
- details (including outcomes) of training / assessment undertaken
- student file contents
Personal information that may be recorded about students of organisations audited by the BSCC includes:
- name (for the purpose of informing the Audit Report)
- the program the student is enrolled into
- gaps in evidence against VET standards
Clients
Personal information that may be reviewed and recorded about clients’ contacts includes:
- names, titles and contact details (address, phone and email)
- qualifications, CVs and work experience
- employer information
- other information relevant to delivering our services
The BSCC’s staff will not sell, disclose or distribute personal information to any third party other than where contractually obliged to do so (i.e. Commonwealth, state and territory government departments and agencies) or in providing a service where the client would reasonably expect such a disclosure and this has been agreed to, demonstrated by the signing of a contract for services (the BSCC Agreement).
The BSCC notes that the only exceptions to these disclosure rules relate to the release of personal information due to public interest requirements such as law enforcement, public or individual health and safety. These exceptions include where the use or disclosure is reasonably necessary:
- to assist in locating a missing person
- to establish, exercise or defend a legal or equitable claim, or
- for the purposes of a confidential alternative dispute resolution.
APP 7 – Direct marketing
Generally, organisations may only use or disclose personal information for direct marketing purposes if an exception, listed in APPs 7.2 to 7.5, applies. (See the OAIC Australian Privacy Principles.)
Note: APP 7.5 permits contracted service providers for Commonwealth contracts to use or disclose personal information for the purpose of direct marketing if certain conditions are met.
The BSCC may only use or disclose personal information for direct marketing purposes where the individual has either consented to their personal information being used for direct marketing, or has a reasonable expectation that their personal information will be used for this purpose, and conditions relating to opt-out mechanisms are met. The BSCC will ask consultants, contractors or employees to sign a Consent to Release form before their personal information is used to market BSCC services.
APP 8 – Cross-border disclosure of personal information
An organisation in Australia or an external Territory may only transfer personal information to someone in a foreign country subject to very stringent conditions governing transborder data flows. (See the OAIC Australian Privacy Principles.)
BSCC notes the requirements of APP 8. BSCC staff must not disclose a client’s or staff member’s personal information to a recipient in a foreign country. Should such a request be made it must be forwarded to the Privacy Officer.
Some of the service providers BSCC uses to operate its business, such as email and website services, may store information on servers outside Australia.
APP 9 – Adoption, use or disclosure of government related identifiers
APP 9 outlines the limited circumstances when an organisation may adopt a government related identifier of an individual as its own identifier, or use or disclose a government related identifier of an individual. Note that there are exceptions that will permit the adoption of a government related identifier if required or authorised by or under an Australian law or a court/tribunal order.
The BSCC notes this requirement. However, due to the nature of its service, the BSCC does not employ the use of a government identifier of an individual.
APP 10 – Quality of personal information
Under APP 10, an organisation must take reasonable steps to ensure the personal information it collects is accurate, up-to-date and complete. For uses and disclosures, the personal information must be relevant, as well as, accurate, up-to-date and complete, having regard to the purpose of the use or disclosure. Wherever possible, information will be collected directly from the client or staff member via application forms, face-to-face interviews or on the telephone.
The BSCC will take reasonable steps to ensure personal information collected, used or disclosed, is accurate, complete and up to date. The BSCC will protect the information collected by email and electronic devices. Any information provided by the BSCC’s clients electronically will be subject to the client organisation ensuring that it has policy and procedures that comply with the relevant privacy obligations and the BSCC will include this requirement in the terms and conditions relating to Privacy and the release of information included in the BSCC Agreement.
APP 11 – Security of personal information
APP 11 requires an organisation to take reasonable steps to protect the personal information it holds from interference, in addition to misuse and loss, and unauthorised access, modification and disclosure.
APP 11 requires an organisation to take reasonable steps to destroy or de-identify personal information if the organisation no longer needs it for any authorised purpose. Under APP 11 there are two exceptions to this requirement:
- the personal information is contained in a Commonwealth record, or
- the organisation is required by or under an Australian law or a court/tribunal order to retain the information.
The BSCC will develop and maintain systems to review, record, store and destroy personal information securely.
The BSCC will ensure the security of information through electronic and hard copy data access restrictions, staff training, lockable filing cabinets, secure office areas, and clearly documented archiving and record destruction procedures.
All BSCC staff will observe a "clean desk" approach, and all files containing personal information are to be returned to secure storage at the end of each day.
APP 12 – Access to personal information
APP 12 requires an organisation to give an individual access to the personal information that it holds about that individual, unless an exception applies.
There is a requirement for organisations to respond to requests for access within a reasonable period. In addition, organisations must give access in the manner requested by the individual if it is reasonable to do so. If an organisation decides not to give an individual access, it must generally provide written reasons for the refusal and the mechanisms available to complain about the refusal.
If an organisation charges an individual for giving access to the individual’s personal information, the charge must not be excessive, and must not apply to the making of the request.
Upon request, the BSCC staff are able to access and/or correct their personal information held by BSCC. All requests must be forwarded to the BSCC Privacy Officer. Information about access to personal information will be in accordance with BSCC policy and procedures.
In line with the BSCC Agreement and the relevant legislation, summary information of an organisation’s staff and students may be included in internal and regulatory Audit Reports produced by the BSCC.
Internal Audits
A copy of the internal Audit Report will be provided to the organisation’s Chief Executive or the contact person nominated by the Chief Executive.
Regulatory Audits
A copy of the Audit Report will be provided to the regulatory body.
APP 13 – Correction of personal information
APP 13 requires an organisation to take reasonable steps to correct personal information to ensure that, having regard to a purpose for which it is held, it is accurate, up-to-date, complete, relevant and not misleading, if either:
- the organisation is satisfied that it needs to be corrected, or
- an individual requests that their personal information be corrected.
Organisations generally need to notify other APP entities that have been provided with the personal information of any correction, if that notification is requested by the individual.
APP 13 contains provisions in relation to associating a statement with the personal information if the organisation refuses to correct the information and the individual requests a statement to be associated.
An organisation must also respond to a correction request or a request to associate a statement by the individual within a reasonable period after the request is made, and must not charge the individual for making the request, for correcting the personal information, or for associating the statement with the personal information.
When refusing an individual’s correction request, an organisation must generally provide the individual with written reasons for the refusal and notify them of available complaint mechanisms.
BSCC will take reasonable steps to correct personal information to ensure that, having regard to a purpose for which it is held, it is accurate, up-to-date, complete, relevant and not misleading, if either:
- BSCC is satisfied that it needs to be corrected; or
- an individual requests that their personal information be corrected.
BSCC will respond to a correction request or to associating a statement with the personal information in cases where BSCC refuses to correct the information and the individual requests a statement to be associated.
The system for maintaining personal information about BSCC staff will be subject to:
- BSCC Personnel Policy and Procedures
- BSCC Privacy Statement
- BSCC Records Management
- BSCC Risk Register
- BSCC Quality Management
4. Definitions
- Australian Privacy Commissioner
- is an independent adjudicator responsible for ensuring compliance to the Act.
- The BSCC Agreement
- refers to the signed contract for services between an organisation and the BSCC.
- The BSCC Privacy Officer
- the designated Privacy Officer for BSCC is the BSCC Director. All requests for access to information or complaints must be forwarded in writing to the Privacy Officer, BSCC, PO Box 519, Dickson ACT 2602, or by email to info [at] barrackst.com.au. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner.
- The BSCC Privacy Statement
- advice provided to BSCC prospective clients explaining why personal information is collected, its purpose, and how it will be used.
- The BSCC Quality Management System
- refers to the folder of documents stored on the BSCC Intranet and that includes all the policies and procedures and forms used by BSCC to control its business systems.
- Commonwealth material
- refers to all Material provided by a Commonwealth organisation or agency for the purposes of a Deed of Standing Offer or Contract or which is copied or derived from that Material, except for Contract Material.
- Commonwealth record
- means:
- a record that is the property of the Commonwealth or of a Commonwealth institution; or
- a record that is to be deemed to be a Commonwealth record by virtue of regulation under the Archives Act 1983
- but does not include a record that is exempt material or is a register or guide maintained in accordance with Part VIII of the Archives Act 1983.
- Internal audit
- refers to internal auditing services provided by the BSCC to private entities
- Personal Information
- "information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion" (Privacy Act 1988, section 6(1) (as amended))
- Regulatory Audit
- refers to regulatory auditing services provided by the BSCC to federal and state government agencies.
- Sensitive Information
- information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, or criminal record; health information; genetic information; biometric information used for automated biometric verification or identification; and biometric templates (Privacy Act 1988, section 6(1)).
- Tax file numbers (TFNs)
- unique numbers issued by the Australian Taxation Office (ATO) to identify individuals, corporations and others who lodge income tax returns with the ATO. The Privacy (Tax File Number) Rule 2015 only applies to the TFN information of individuals and does not apply to TFN information about other legal persons including corporations, partnerships, superannuation funds and trusts. Under the TFN Rule, a TFN recipient must not record, collect, use or disclose TFN information unless this is permitted under taxation, personal assistance or superannuation law.
5. Responsibilities
5.1 Compliance, monitoring and review
The BSCC Director is responsible for ensuring that all staff and contractors follow this policy.
Review of the policy will be undertaken through the BSCC Internal Review processes.
5.2 Reporting
Reporting of any breaches of the Privacy Policy will be documented through the BSCC Continuous Improvement process.
This website
This website does not use advertising cookies. We use Cloudflare Web Analytics to count visits. It does not use cookies or track individual visitors. If you send an enquiry through our contact form, your details are emailed to us by FormSubmit, a third-party form service, and used only to respond to you. The map on our contact page is provided by Google Maps, which is subject to Google’s own privacy policy.