Where do the answers from an online form go after Submit?

After Submit, in order

1. DispatchSent at dispatch: the form is dispatched when the communication leaves an information system under the control of the sender, unless the parties agreed otherwise.
2. Held securelyThe Act's security principle applies from the moment the answers are held, and since 11 December 2024 it includes technical and organisational measures.
3. A request to see themAn organisation must respond to a request for access to personal information within a reasonable period; the OAIC considers 30 days a reasonable period.
4. No longer neededOnce the business no longer needs the answers for a purpose the Act allows, and no exception applies, it must take reasonable steps to destroy them or ensure they are de-identified.

Keeping answers secure

APP 11.1, in the Act's words: if an APP entity holds personal information, the entity must take such steps as are reasonable in the circumstances to protect the information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

Since 11 December 2024 the clause has carried a new subclause. APP 11.3 says that, for the purposes of 11.1 and 11.2, and without limiting those subclauses or any other provision of the Act, such steps include technical and organisational measures. The OAIC records how it applies: APP 11.3 applies to information held after 11 December 2024, regardless of whether the information was acquired or created before or after that commencement.

The OAIC's guide makes one suggestion directly about the practice: for the purposes of APP 11, you should document the internal practices, procedures and systems that you use to protect personal information.

If the protections fail, a second scheme takes over. The Notifiable Data Breaches scheme commenced as part of the Privacy Act on 22 February 2018. Businesses covered by the Privacy Act 1988 must report eligible data breaches to the Office of the Australian Information Commissioner, and, subject to some exceptions, must notify individuals who are likely to suffer serious harm as a result of an eligible data breach.

Where answers go overseas

Where the answers are likely to be disclosed to recipients overseas has to be said in two places: in the notice at collection, and in the privacy policy. The notice rule: the APP 5.2 matters include whether the entity is likely to disclose the personal information to overseas recipients, and, if it is practicable to specify them, the countries. The policy rule: an APP Privacy Policy must set out whether personal information is likely to be disclosed to overseas recipients and the countries in which such recipients are likely to be located, if it is practicable to specify those countries in the policy (APP 1.4(f) and 1.4(g)). The two requirements are complements.

Where specifying the countries is not practicable, the OAIC offers options: a link in the privacy policy to a regularly updated list of those countries, accessible from the entity's website, or identifying general regions, such as European Union countries, instead.

Before the disclosure happens, there is a duty on the discloser: an APP entity must take reasonable steps to ensure that the overseas recipient does not breach the APPs, other than APP 1, in relation to the information, unless an exception applies, such as the individual having given informed consent. And the disclosure itself must comply with APP 6.1: the information may only be disclosed for the primary purpose for which it was collected, unless the individual has consented to the disclosure or an exception applies.

Answering an access request

Someone who filled in a form can ask to see what it collected. An organisation must respond to a request for access to personal information within a reasonable period; the OAIC considers 30 days a reasonable period. An agency must respond to a request for access to personal information within 30 days.

Destroying what you no longer need

The destruction rule, read whole: if an APP entity holds personal information about an individual, and the entity no longer needs the information for any purpose for which it may be used or disclosed under the APPs, and the information is not contained in a Commonwealth record, and the entity is not required by or under an Australian law, or a court/tribunal order, to retain it, the entity must take such steps as are reasonable in the circumstances to destroy the information or to ensure that it is de-identified.

The carve-outs are inside the rule itself: a Commonwealth record, or a legal retention requirement, takes the case out of it. Where the rule does apply, the OAIC notes that one or the other of destruction or de-identification may be more appropriate in some cases. The OAIC puts the duty plainly elsewhere: where an entity no longer needs personal information for any purpose for which the information may be used or disclosed under the APPs, the entity must take reasonable steps to destroy the information or ensure that it is de-identified, unless an exception applies.