What privacy training should staff be given?

The exact nature of the training provided will depend on the nature of the agency concerned (including the type of information it deals with, the ways in which it uses personal information and the potential consequences if something goes wrong) and the staff member’s role in the agency.

For example, management and senior staff who are responsible for setting policies which relate to personal information should have a comprehensive understanding of their agency’s obligations under the Privacy Act. In contrast, frontline staff may only need to know the basics that are relevant to their role and the type of information they deal with.

Organisations are obligated to take reasonable steps to keep personal information safe, and agencies must provide privacy training to any staff who handle personal information. This is an essential step for agencies to take because staff will not otherwise know what they can and can’t do with personal information.

If you’re developing training material, a helpful starting point may be our free online training modules.(external link)

Updated October 2025