What does the Privacy Act say about storing personal information in the cloud?

Shifting to the cloud can make good business sense, but there’s a lot to weigh up and it’s important to understand that you're still responsible for what happens to the information once it's in the cloud.

For instance, it’s your agency's responsibility to make sure that personal information is transferred and stored safely, can be provided if the individual concerned requests it, can be corrected if necessary, is destroyed when it is no longer needed, etc.

You also need to make sure your staff are trained to use the new system safely, and check if your privacy statement needs to be updated to reflect this change.

We have guidance that provides more detail on your obligations when using third party providers [PDF, 267 KB], including cloud service providers (opens to PDF, 267KB). You may want to consider doing a privacy impact assessment(external link) to help identify and manage any additional potential risks your agency may face.

Read the current IT Professionals Cloud Code(external link).

Updated October 2025