Personally Identifiable Information (PII) is any data that can identify an individual directly or indirectly.
Direct Identifiers
Category
Examples
Name
Full name, maiden name, alias
Government IDs
SSN, passport, driver's license, TFN (AU)
Financial
Bank account, credit card numbers
Contact
Email, phone, physical address
Biometric
Fingerprints, facial recognition, voice
Indirect Identifiers (Quasi-identifiers)
Category
Examples
Location
IP address, GPS coordinates, ZIP/postcode
Device
Device ID, MAC address, browser fingerprint
Demographic
Age, gender, ethnicity, occupation
Behavioral
Purchase history, browsing patterns
Key insight: Combining quasi-identifiers can uniquely identify individuals even without direct identifiers.
🇪🇺 GDPR (European Union)
Applies to: Any organization processing EU residents' data, regardless of location.
Core Principles (Article 5)
Principle
Requirement
Lawfulness, Fairness, Transparency
Process data legally with clear communication
Purpose Limitation
Collect only for specified, legitimate purposes
Data Minimization
Collect only what's necessary
Accuracy
Keep data accurate and up to date
Storage Limitation
Retain only as long as necessary
Integrity & Confidentiality
Ensure appropriate security
Accountability
Demonstrate compliance
Lawful Bases for Processing
Basis
When to Use
Consent
Freely given, specific, informed, unambiguous
Contract
Necessary for contract performance
Legal Obligation
Required by law
Vital Interests
Protect someone's life
Public Task
Official authority or public interest
Legitimate Interests
Business need balanced against rights
Individual Rights (Data Subject Rights)
Right
Description
Response Time
Access
Obtain copy of their data
1 month
Rectification
Correct inaccurate data
1 month
Erasure ("Right to be Forgotten")
Delete their data
1 month
Restrict Processing
Limit how data is used
1 month
Data Portability
Receive data in machine-readable format
1 month
Object
Stop certain processing
Without delay
Automated Decision-Making
Human review of automated decisions
1 month
GDPR Compliance Checklist
## Lawful Basis & Transparency- [ ] Document lawful basis for each processing activity
- [ ] Maintain records of processing activities (Article 30)
- [ ] Privacy policy is clear, accessible, updated
## Data Security- [ ] Encryption at rest and in transit
- [ ] Pseudonymization where possible
- [ ] Data Protection Impact Assessment (DPIA) for high-risk processing
- [ ] Breach notification process (72 hours to authority)
## Governance- [ ] Data Protection Officer (DPO) appointed if required
- [ ] Data Processing Agreements with third parties
- [ ] EU representative appointed (if outside EU)
## Individual Rights- [ ] Process to handle access requests
- [ ] Process to handle deletion requests
- [ ] Process to handle data portability requests
- [ ] Consent mechanism (opt-in, not opt-out)
2025-2026 Updates
Update
Impact
Simplified Record-Keeping (May 2025)
Organizations <750 employees only need records for high-risk processing
Enhanced Enforcement Procedures (June 2025)
Additional procedural rules for cross-border cases
AI Act Integration
Additional requirements for AI systems processing personal data
🇦🇺 Australian Privacy Principles (APPs)
Applies to: Organizations with annual turnover >$3M AUD, government agencies, health service providers, and some others.
The 13 APPs
APP
Title
Key Requirement
APP 1
Open & Transparent Management
Have a clear, up-to-date privacy policy
APP 2
Anonymity & Pseudonymity
Allow anonymous/pseudonymous dealings where practical
APP 3
Collection of Solicited Information
Only collect necessary info; higher bar for sensitive info
APP 4
Unsolicited Personal Information
Assess and destroy if wouldn't have been collected
APP 5
Notification of Collection
Tell individuals what you're collecting and why
APP 6
Use or Disclosure
Only for primary purpose or permitted secondary purposes
APP 7
Direct Marketing
Opt-out required; sensitive info needs consent
APP 8
Cross-Border Disclosure
Ensure overseas recipients comply with APPs
APP 9
Government Identifiers
Don't adopt government IDs as your own identifier
APP 10
Quality of Information
Keep data accurate, complete, up to date
APP 11
Security of Information
Protect from misuse, loss, unauthorized access
APP 12
Access to Information
Provide access when requested
APP 13
Correction of Information
Correct inaccurate information
Sensitive Information (Higher Protection)
Under Australian law, sensitive information includes:
Health information
Genetic information
Biometric data
Racial or ethnic origin
Political opinions
Religious beliefs
Sexual orientation
Criminal record
Trade union membership
Rule: Sensitive information generally requires consent to collect.
Notifiable Data Breaches (NDB) Scheme
When to notify:
Unauthorized access, disclosure, or loss of personal information
Likely to result in serious harm to individuals
Remedial action hasn't prevented serious harm
Timeline:
Notify OAIC and affected individuals as soon as practicable
Assessment must be completed within 30 days
Australian Privacy Act Reform (Ongoing)
The Privacy Act is under review. Expected changes:
Proposed Change
Status
Expanded definition of personal information
Under review
New individual rights (erasure, explanation of AI decisions)
Proposed
Higher penalties
Enacted (up to $50M AUD)
Direct right of action for individuals
Under review
Removal of small business exemption
Under consideration
Cross-Jurisdictional Comparison
Aspect
GDPR (EU)
APP (Australia)
Scope
All organizations processing EU data
>$3M turnover + exceptions
Consent
Must be explicit opt-in
Can be implied in some cases
Right to Erasure
Explicit right
Not explicit (under review)
Breach Notification
72 hours to authority
"As soon as practicable"
Penalties
Up to €20M or 4% global revenue
Up to $50M AUD
Cross-Border Transfer
Adequacy decisions, SCCs, BCRs
Must ensure APP compliance
DPO Required
Yes, in certain cases
No requirement
Code Implementation Patterns
Never Log PII
// ❌ BAD
logger.info(`User ${user.email} logged in from ${user.ipAddress}`);
// ✅ GOOD
logger.info(`User ${hashUserId(user.id)} logged in`);
Encrypt PII at Rest
// Encrypt before storingconst encryptedEmail = encrypt(user.email, encryptionKey);
await db.users.update({ id: user.id, email: encryptedEmail });
// Decrypt only when neededconst email = decrypt(storedUser.email, encryptionKey);
Implement Data Minimization
// ❌ BAD - Fetching everythingconst user = await db.users.findById(id);
return user; // Contains PII you don't need// ✅ GOOD - Select only needed fieldsconst user = await db.users.findById(id, {
select: ['id', 'displayName', 'preferences']
});
return user;
interfaceDataSubjectRequest {
type: 'access' | 'rectification' | 'erasure' | 'portability' | 'objection';
userId: string;
requestedAt: Date;
deadline: Date; // 30 days for GDPRstatus: 'pending' | 'processing' | 'completed' | 'denied';
}
// Implement audit trail for all requestsasyncfunctionhandleDSR(request: DataSubjectRequest) {
await auditLog.record({
action: 'dsr_received',
requestType: request.type,
userId: request.userId,
timestamp: newDate()
});
// Process based on type...
}
Pseudonymization Pattern
// Replace direct identifiers with tokensfunctionpseudonymize(record: UserRecord): PseudonymizedRecord {
return {
pseudoId: generateToken(record.id), // Reversible with keyageGroup: getAgeGroup(record.birthDate), // 18-25, 26-35, etc.region: record.country, // Keep general location// Omit: name, email, exact address, etc.
};
}
Compliance Checklist
For New Projects
## Privacy Impact Assessment- [ ] What PII will be collected?
- [ ] What is the lawful basis (GDPR) / primary purpose (APP)?
- [ ] Is all collected data necessary? (data minimization)
- [ ] How long will data be retained?
- [ ] Who will have access?
- [ ] Will data cross borders?
- [ ] What security measures are in place?
## Technical Implementation- [ ] PII encrypted at rest
- [ ] PII encrypted in transit (TLS 1.2+)
- [ ] Logging excludes PII
- [ ] Consent captured before processing
- [ ] Data subject request endpoints implemented
- [ ] Retention/deletion automation in place
- [ ] Audit logging for PII access
