Data Quality Check · APP 10 quality of personal information

Is My Personal Information Accurate and Up to Date?

Q: What does APP 10 of the Privacy Act require?

APP 10 (Quality of personal information) requires an APP entity to take reasonable steps to ensure the personal information it collects is accurate, up to date and complete, and that the personal information it uses or discloses is — having regard to the purpose of that use or disclosure — accurate, up to date, complete and relevant.

Q: Does APP 10 apply to information that's just sitting in storage?

The APP 10.2 obligation is tied to the purpose of use or disclosure. Information that is no longer used or disclosed for any ongoing purpose carries minimal quality risk, though it may still need to be destroyed or de-identified under APP 11.2 once it's no longer needed.

Q: How does APP 10 relate to automated decision-making?

Where personal information feeds an automated decision — credit scoring, eligibility assessment, or risk rating — inaccurate or outdated inputs compound directly into an inaccurate outcome about a real person. This makes APP 10 quality steps especially important for systems covered by the ADM disclosure obligation commencing 10 December 2026.

Select the ways your business holds and uses personal information. Get an instant APP 10 check across 18 common Australian scenarios.

Under APP 10 of the Privacy Act 1988 (Cth), a business must take reasonable steps to ensure the personal information it collects is accurate, up to date and complete, and that information it uses or discloses is — having regard to the purpose of that use or disclosure — accurate, up to date, complete and relevant. Select the scenarios below to see where your processes need attention.

Last updated: 2 July 2026

How each scenario is scored

Result	Meaning
Compliant	There's no ongoing use or disclosure the information is relied on for, or you've confirmed you take reasonable steps to keep it accurate, up to date, complete and relevant
Gap	The information is still used or disclosed on an ongoing basis, and no active accuracy or currency process is confirmed

Why data quality is easy to overlook

Most privacy attention goes to what's collected and how it's protected. APP 10 covers something quieter — whether the information a business already holds still reflects reality. A customer's address changes, an employee's emergency contact goes stale, a purchased marketing list ages the moment it's licensed. None of that is a security incident, but each one is a live APP 10 obligation the moment the information is used or disclosed again.

The obligation scales with use, not just storage. APP 10.2 asks what accuracy, currency, completeness and relevance actually means "having regard to the purpose" of a specific use or disclosure — a dormant, unused record carries far less quality risk than data feeding an automated credit decision or a recurring payroll run. That's the distinction this check applies to each scenario.

Free diagnostic tool

Data quality check

Select every scenario where your business holds personal information. For each one still in ongoing use, tell us whether you currently take reasonable steps to keep it accurate, up to date, complete and relevant. You'll get an instant APP 10 report at a permanent URL you can revisit or share.

Business name (optional)

Which scenarios apply to your business?

Select all that apply. Where information is still in ongoing use, tell us whether you currently keep it accurate and up to date.

Customer & sales records

Repeat customer's shipping or billing address reused for future orders An outdated address on a repeat order can misdirect goods or invoices — APP 10.2 expects a way to catch and correct this before each use.

Yes, we keep it current No

Stored payment or bank details reused for recurring billing Expired or cancelled payment details cause failed charges and customer disputes if there's no periodic revalidation.

Yes, we keep it current No

Contact details in a closed support ticket no longer used to reach the customer No ongoing use Once a ticket is closed and the details aren't used again, there's no ongoing use or disclosure for APP 10 to attach to.

Contact details from a quote request that never converted to a sale No ongoing use A dormant record with no further contact or decision made about the individual carries minimal quality risk.

Marketing & CRM

CRM contact profile used for ongoing email or SMS marketing Stale job titles, employers or preferences lead to misdirected or irrelevant marketing — APP 10.2 applies to every send.

Yes, we keep it current No

Marketing list purchased or licensed from a third-party data broker Bought lists degrade quickly; using one without checking currency and accuracy at the point of use is a common APP 10 gap.

Yes, we keep it current No

Unsubscribed contacts kept only on a do-not-contact suppression list No ongoing use A suppression-only entry isn't used to contact anyone — it only needs to remain identifiable enough to keep suppressing.

Employment & HR

Current employee's emergency contact details An emergency contact is only useful if it's current — this is a classic case where "reasonably necessary" quality steps matter most when least convenient to run.

Yes, we keep it current No

Current employee's bank account and address details used for payroll Outdated bank or address details cause misdirected pay and incorrect group certificates.

Yes, we keep it current No

Personnel file of a terminated employee kept only for statutory retention No ongoing use A file retained purely to meet a recordkeeping obligation, with no further use or disclosure, doesn't need active upkeep.

Automated decision-making & scoring

Financial and identity data feeding an automated credit or risk-scoring decision Inaccurate inputs to an automated decision compound into an inaccurate outcome about a real person — this is one of the highest-stakes APP 10 scenarios.

Yes, we keep it current No

Personal data automatically assessed to determine eligibility for a loan, tenancy, insurance or job Because the ADM disclosure regime from 10 December 2026 requires explaining how these systems work, the underlying data quality has to withstand scrutiny.

Yes, we keep it current No

Historical data snapshot used to train a model in the past, no longer linked to a live decision about that individual No ongoing use If the snapshot no longer feeds any current use or disclosure about an identifiable individual, APP 10's ongoing-accuracy obligation doesn't attach to it.

Vendor & third-party data

Contact and account data synced from a vendor CRM or integration used to service the customer A one-way or infrequent sync can silently drift from the source of truth — reasonable steps mean checking the sync, not just trusting it.

Yes, we keep it current No

ABN or ASIC register lookup captured for a single point-in-time transaction No ongoing use A snapshot taken and used once, for a transaction that's already complete, isn't being relied on again.

Regulated & compliance records

Identity verification details for an active AML/CTF-regulated customer relationship AML/CTF reporting entities are expected to periodically re-verify identity information for ongoing relationships, not just at onboarding.

Yes, we keep it current No

Append-only disclosure log entry recording what was disclosed, to whom and when No ongoing use A log entry is a historical record of an event, not a live profile — it should stay exactly as recorded, not be "updated".

Clinical or health record used for ongoing patient care Health information errors carry direct safety consequences — APP 10 and a patient's APP 13 correction rights both bear on keeping these current.

Yes, we keep it current No

When you need a data quality check

— You've never reviewed how or whether customer, employee or vendor records get updated
— You're newly covered by the Privacy Act following the 1 July 2026 threshold removal
— Personal information feeds an automated credit, eligibility or risk-scoring decision
— You buy, license or sync data from a third-party list or vendor CRM
— You're preparing for an OAIC inquiry or a compliance audit

Frequently asked questions

What does APP 10 of the Privacy Act require?

APP 10 requires a business to take reasonable steps to ensure personal information it collects is accurate, up to date and complete, and that information it uses or discloses is accurate, up to date, complete and relevant, having regard to the purpose of that use or disclosure.

Does APP 10 apply to information that's just sitting in storage?

The APP 10.2 obligation is tied to ongoing use or disclosure. Information no longer relied on for any purpose carries minimal quality risk, though it may still need destruction or de-identification under APP 11.2.

How does APP 10 relate to automated decision-making?

Inaccurate or outdated inputs to an automated decision compound directly into an inaccurate outcome about a real person, making quality steps especially important for systems covered by the ADM disclosure obligation from 10 December 2026.

What does the free data quality check check?

It checks the scenarios you select against a catalogue of 18 common Australian scenarios, flagging which need an active accuracy and currency process under APP 10, and which carry minimal quality risk because there's no ongoing use.

Select your scenarios above to get an instant APP 10 data quality report.

Get my data quality report →