Privacy requirements applicable to the organisation have been identified, even in an ad-hoc manner.

Privacy requirements applicable to the organisation have been identified, even in an ad-hoc manner.

Context and Guidance: Privacy requirements may be imposed by applicable legislation, for example:

• Federal legislation (Privacy Act, Consumer Data Right);
• State-based legislation (e.g. Health Records and Information Privacy Act 2002 NSW, Health Records Act 2001 VIC, Health Records Privacy and Access Act 1997 ACT).

Privacy requirements may also be imposed by contracts/agreements with customers or suppliers.