Protect client data while meeting identity-check duties
How can an agency balance identity checks with privacy?
Collect and retain information for a clear lawful purpose, protect it and apply the correct disposal rules. AML/CTF duties do not remove privacy responsibilities.
What could change your decision?
- Newly regulated reporting entities need to check Privacy Act coverage.
- Avoid keeping extra ID copies merely for convenience.
- Retention periods may differ across obligations.
What should you compare?
Use the same fields for each option. Record the source and any unanswered question alongside your notes.
- Purpose
- Data needed
- Legal basis
- Access
- Retention rule
- Deletion process
What still needs checking?
Do not set a blanket deletion period without checking applicable law.
What is your next step?
Make a data map showing what is collected, why, where it is held and who can access it.
Which sources support this guide?
- OAIC updated AML/CTF privacy guidance · checked 2026-10-08
- NSW property agency data security · checked 2026-10-08