What is Australian Privacy Principle 11 (APP 11)?

APP 11 is part of the Privacy Act 1988. It requires organisations covered by the Act to take reasonable steps to protect the personal information they hold from misuse, interference, loss, and unauthorised access, modification or disclosure. It also expects you to destroy or de-identify personal information once you no longer need it, unless the law requires you to keep it. What counts as “reasonable” depends on your size, the sensitivity of the information and the risks you face, which is why evidence matters as much as intent.

Does using CyberGrape make my business compliant with APP 11?

No platform can do that on its own, and we would be wary of any provider that says otherwise. CyberGrape gives you the structure and the evidence trail: an inventory of the information you hold, policy and training records, supplier due diligence, incident records and verified operational evidence. Whether your safeguards are effective still depends on your scope, how you configure the tools, whether your people use them and what the records show.

How do the Tranche 2 AML/CTF reforms affect my privacy obligations?

The Tranche 2 reforms extended AML/CTF obligations to designated non-financial businesses and professions, with full obligations commencing on 1 July 2026. For many newly regulated businesses, that means collecting and keeping more personal information, such as identity documents and customer due diligence records. AML/CTF expects you to hold the right records, and APP 11 expects you to keep them secure and dispose of them properly when they are no longer needed. CyberGrape does not replace AML/CTF advice or an AML/CTF program, but it can help you protect and evidence the handling of that information. Check your specific obligations and retention periods with your legal adviser or AUSTRAC.

What kind of evidence can the platform produce for an auditor, insurer or customer?

It can produce records across all eight areas of APP 11. Examples include the Information Assets inventory (owners, classification, retention periods and disposal methods), policy acknowledgements, training and phishing simulation results, supplier due diligence and agreement checks, incident response records and the Visitors Register. Operational evidence records, such as deletion and disposal or backup restoration, carry a scope, method, event date, expiry and a passed, failed or inconclusive result. A second administrator must verify each one, so nobody signs off their own work.

Can CyberGrape delete or de-identify personal information for us?

CyberGrape records your retention periods and disposal methods, checks supplier secure-destruction terms, and retains the outcome when disposal is carried out. The deletion or de-identification itself still happens in your source systems, backups and supplier environments, and it needs to follow your own processes. The platform helps you define the process, track it and prove it was done.

How CyberGrape Helps You Demonstrate APP 11 Compliance

November 3, 2026

That is the gap the CyberGrape platform is built to close. Here is how it supports each area of APP 11.

Why this matters more after 1 July 2026

The Tranche 2 anti-money laundering and counter-terrorism financing (AML/CTF) reforms expanded regulatory obligations to designated non-financial businesses and professions (DNFBPs), with full obligations commencing on 1 July 2026.

For many of these businesses, meeting AML/CTF obligations means collecting and keeping more personal information than before, such as identity documents and customer due diligence records. That information is exactly what APP 11 expects you to protect, and it is attractive to attackers.

In practice, this means two sets of expectations now sit side by side:

AML/CTF expects you to collect, verify and keep the right records.
APP 11 expects you to keep those records secure, limit who can see them, and destroy or de-identify them when they are no longer needed.

If your business is newly in scope, the practical question is how to run both without building two separate evidence trails. The areas below show where one platform can support both.

1. Governance, culture and training

Privacy culture starts with clear ownership. CyberGrape supports policy approval, versioning and review cycles, and records staff policy acknowledgements. Training completion and phishing simulation results from usecure are retained as evidence, alongside competence records with validity dates. Gaps become assigned remediation tasks, not forgotten spreadsheet rows.

2. Internal practices, procedures and systems

Reasonable steps begin with knowing what you hold. The Information Assets inventory records owners, classification, format, location, whether the information is personal, who the data subjects are, the legal obligations, retention periods and disposal methods. Each asset links to the systems, suppliers, risks and controls around it, with review dates and a change history.

For a newly regulated business, this is a natural place to record where customer identification and due diligence records live and what obligations apply to them.

3. ICT and digital security

CyberGrape brings together signals from endpoint protection, identity, email, network, patching, cloud posture and backup tools. Instead of relying on someone’s recollection that “we have MFA everywhere”, you can see what each connected tool actually reports, and where a source has gone quiet.

4. Access security

Role-based permissions, MFA, SSO, and SCIM-driven deactivation and session revocation help ensure the right people have the right access. Access revocation and asset return can also be recorded as reviewable evidence.

5. Third-party and cloud providers

Your obligations do not stop at your own network. If an identity verification service, case management tool or cloud provider handles your customers’ information, you still need to be able to show you have assessed it. CyberGrape tracks supplier due diligence, assurance reports, agreements, review dates and offboarding. Agreement checks cover data protection terms, incident notification, subcontracting, audit rights, information transfer and secure destruction.

6. Physical security

The Visitors Register supports QR sign-in, host notification, purpose of visit, arrival and departure times, badges, signatures and export. It gives you a defensible record of who was on site and why. It complements, rather than replaces, the physical controls themselves, such as locks, escorts and restricted-area enforcement.

7. Data breach response

Incident response plans, tasks and exercises sit alongside a full incident lifecycle, from reporting through containment, recovery and closure. Personal data involvement and notification status are tracked, lessons learned are captured, and remediation actions are linked back to the incident. Deciding whether a breach is notifiable under the NDB scheme remains a considered judgement for your organisation.

8. Destruction and de-identification

Retention periods, disposal methods and supplier secure-destruction checks are recorded in the platform, and deletion and disposal outcomes can be retained as evidence. Actually deleting or de-identifying data inside source systems, backups and supplier environments still depends on your processes. CyberGrape helps you define, track and prove it.

This matters for AML/CTF records too. Where you are required to keep records for a set period, the retention decision and the later disposal both need to be deliberate and evidenced. Confirm the applicable retention requirements for your business with your legal adviser or AUSTRAC guidance.

Evidence that someone checked

Writing “we delete data after seven years” is easy. Showing that you did it is the hard part. CyberGrape’s operational evidence workflow records findings for privacy processing, physical security validation, deletion and disposal, access revocation, backup restoration and more. Each record carries a scope, method, evidence reference, event date, expiry and a passed, failed or inconclusive result. A second administrator must verify it, so nobody marks their own homework.

What the platform cannot do alone

No platform makes you compliant. Compliance depends on your scope, how you configure the tools, whether people use them, and whether the safeguards work in practice. A connected provider or a green dashboard does not prove complete protection.

CyberGrape also does not replace AML/CTF advice or an AML/CTF program. It helps you protect the personal information those obligations require you to hold, and gives you the evidence trail to answer, with confidence, the question APP 11 asks.

Where to start

If your business is newly caught by the Tranche 2 reforms, or you simply want to see how you measure up against APP 11, we can walk you through the platform and map your current safeguards to each area above.

Contact CyberGrape: [email protected] | +61 7 2104 7524 | cybergrape.io/contact