APP 10: Quality of Personal Information

Last updated 22 July 2026 · Reviewed by The PrivacyReady compliance team

The short answer

Australian Privacy Principle 10 requires you to take reasonable steps to ensure the personal information you collect, use, and disclose is accurate, up to date, and complete, having regard to the purpose of that use or disclosure. It is a standard of ongoing diligence rather than a one-off check — data that was accurate when collected can become stale, and APP 10 expects you to have some process for keeping it current where accuracy matters to how it's used.

Governing provision	Privacy Act 1988 (Cth), Schedule 1, APP 10
Standard	Reasonable steps to keep information accurate, up to date, and complete
Applies at	Both collection and any subsequent use or disclosure
Risk driver	Higher stakes decisions based on the data raise the bar for what's "reasonable"
Related principle	APP 13 gives individuals a right to request correction

What APP 10 actually requires

The obligation applies at two points: when you collect information (APP 10.1) and whenever you use or disclose it (APP 10.2). The reasonableness of the steps required scales with the significance of the use — a minor internal mailing list has a lower bar than data feeding a decision that materially affects someone, such as a credit or eligibility assessment.

"Complete" matters as much as "accurate." Information that is technically correct but missing important context can still fail APP 10 if the gap leads to an unfair or mistaken outcome — for example, an outdated address used to send a legally significant notice.

Who this applies to

Any business relying on stored personal information to make decisions, communicate with individuals, or feed it into another system — which in practice is nearly every business with a CRM, customer database, or automated workflow.

Common SME failure modes

No process to prompt customers to update their details — contact information silently goes stale over years.
Relying on old data for significant decisions without a freshness check — for example, using an outdated income figure in a credit assessment.
Duplicate or conflicting records across systems, with no reconciliation process.
Ignoring correction requests that would otherwise flag and fix a quality issue at the source.

Practical compliance steps

Build a periodic prompt for customers to confirm or update their details, particularly for long-lived relationships.
For any automated or high-stakes use of stored data, add a freshness or verification step before acting on it.
Reconcile duplicate records across systems where practical.
Treat every correction request under APP 13 as a signal to check for the same error elsewhere in your records.

Frequently asked questions

How often do I need to actively check that my data is still accurate?

There is no fixed schedule in the Act — the standard is "reasonable steps" relative to how the data is used. Higher-stakes uses (credit decisions, eligibility assessments) warrant more frequent verification than low-stakes uses like an occasional newsletter.

Am I responsible for data quality issues that originated with a third-party data source?

Yes, in relation to your own use and disclosure of that information — APP 10 attaches to you as the entity holding and using the data, regardless of where it originally came from.

Does APP 10 mean I have to proactively contact every customer to check their details?

Not necessarily proactively for every record — the obligation is about reasonable steps proportionate to the significance of the use. A practical approach for most SMEs is prompting updates at natural touchpoints (renewal, repeat purchase, annual review) rather than a blanket outreach campaign.

Use the free Data Quality Check to see how your business holds and refreshes personal information against APP 10, across 18 common Australian scenarios.

Check my data quality practices →