There are rules which govern the use, disclosure and transfer of personal information by agencies (and bound contracted service providers). The basic rules are:
- Before using personal information, agencies should check it is accurate, complete and up-to-date (IPP 8).
- If the agency holds a range of information about an individual, the agency should only use those parts of the information required for a particular purpose (IPP 9).
- Agencies should generally only use personal information for the purpose it was collected (IPP 10).
- Agencies should generally not give personal information to anyone outside the agency (IPP 11).
- Personal information must not be transferred outside of Australia except in limited circumstances. This commonly applies where an agency posts personal information online, for example, on its website.