Privacy Policy

DEFINITIONS

Personal Information: Information or opinions about an individual, whether true or not, that can reasonably identify the individual.

Sensitive Information: Personal information that includes details about a person’s race, ethnicity, health, political opinions, religious beliefs, or sexual orientation.

Data Breach: Any unauthorised access, disclosure, or loss of personal or sensitive information.

Data Security: Measures taken to protect information from unauthorised access, use, or disclosure.

PURPOSE

The purpose of this policy is to:

• Ensure compliance with the Privacy Act 1988 (Cth) and other relevant legislation.
• Protect personal and sensitive information from misuse, interference, loss, or unauthorised access.
• Provide guidance on the collection, storage, use, and sharing of information.
• Outline procedures for managing and responding to data breaches.

SCOPE

This policy applies to all So Brave staff, Board members, sub-committee members, volunteers, contractors, and any third parties engaged by the organisation.

POLICY

1. Collection of Information

So Brave will only collect personal information that is necessary for its operations. Information will be collected lawfully, transparently, and with consent where required.

2. Use and Disclosure of Information

Personal information will only be used for the purpose for which it was collected or as required by law.

Information may be shared with third parties only when consent has been obtained or where disclosure is legally required.

3. Storage and Security of Information

All personal and sensitive information will be securely stored to prevent unauthorised access.

Both physical and digital data security measures will be implemented, including password protection, encryption, and secure filing systems.

4. Access and Correction

Individuals have the right to access their personal information held by So Brave and request corrections if the information is inaccurate or incomplete.

5. Data Retention and Disposal

Information will be retained only for as long as necessary to fulfil its purpose or meet legal requirements.

Secure disposal methods will be used to destroy or de-identify information no longer needed.

6. Data Breach Management

So Brave will respond promptly to any suspected or actual data breaches in accordance with the Notifiable Data Breaches (NDB) Scheme.

Affected individuals and the Office of the Australian Information Commissioner (OAIC) will be notified where required.

7. Training and Awareness

Staff, volunteers, and contractors will be trained on privacy and data security principles.

Regular reviews of data security practices will be conducted.

RESPONSIBILITIES

Board of Directors

• Oversee privacy and data security policies and practices.
• Approve responses to major data breaches and any required reporting.

Managing Director (MD)

• Implement and enforce this policy within day-to-day operations.
• Respond to privacy concerns or breaches and notify the Board where necessary.

Staff and Volunteers

• Comply with this policy in handling personal and sensitive information.
• Report any potential or actual data breaches to the MD immediately.

PROCEDURES

1. Collecting Personal Information

• Explain the purpose of data collection and obtain consent where required.
• Only collect information directly relevant to So Brave’s operations or legal obligations.

2. Storing Information Securely

• Use encrypted and password-protected systems for digital data.
• Secure physical files in locked cabinets or rooms.
• Limit access to sensitive information to authorised personnel only.

3. Responding to Data Breaches

• Identify the Breach: Determine the nature and scope of the breach.
• Contain the Breach: Secure affected systems to prevent further unauthorised access.
• Notify Affected Parties: Inform individuals and the OAIC if the breach is likely to result in serious harm.
• Evaluate and Improve: Review security measures to prevent future breaches.

4. Disposing of Information

• De-identify or securely destroy information no longer required.
• Use shredders or secure data deletion tools for physical and digital information, respectively.

COMPLIANCE

Non-compliance with this policy may result in disciplinary action, including termination of employment or engagement. So Brave will conduct regular audits to ensure adherence to privacy and data security standards.

INTERNAL RELATED DOCUMENTS

Data Breach Response Plan

Confidentiality Agreement

Handling of Sensitive Information Policy & Procedure

EXTERNAL REFERENCES

Privacy Act 1988 (Cth)

Australian Privacy Principles (APPs)

Notifiable Data Breaches (NDB) Scheme

Office of the Australian Information Commissioner (OAIC) Guidelines

AUTHORISATION

This version was adopted as final by the So Brave Board as recorded in the So Brave Board Meeting Minutes – 14 October 2025.