APP 11: PRIVACY ACT SECURITY FOR AUSTRALIAN APP DEVELOPERS | VIBEEVAL

The one-sentence obligation

The Privacy Act 1988 (Cth) contains thirteen Australian Privacy Principles. APP 11 is the security one:

APP 11.1 — An APP entity that holds personal information must take reasonable steps to protect the information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

APP 11.2 — Where the information is no longer needed for a permitted purpose, the entity must take reasonable steps to destroy it or ensure it is de-identified, unless retention is required by law.

That is the entire security obligation of Australian privacy law, and everything a security scanner finds in an AI-built app lives inside it. Unauthorised access is a Supabase table readable through the anon key. Unauthorised disclosure is a public storage bucket full of user uploads. Loss is a database with no tested backup.

Who is covered

The Act applies to “APP entities”: Australian government agencies and private organisations with annual turnover above AUD $3 million. Some organisations are covered regardless of turnover, including:

• Private health service providers (any app handling health information for a health service)
• Businesses that sell or purchase personal information
• Credit reporting bodies and some contractors to the Commonwealth

Two practical notes before you file yourself under “exempt”:

1. The exemption is under sustained reform pressure. Removing the small business exemption has been a headline recommendation of the Privacy Act review. Check current OAIC guidance rather than relying on a threshold that may not survive.
2. Contracts import the obligation anyway. Australian enterprise customers put APP-equivalent security clauses in vendor agreements. If you sell B2B in Australia, you will be held to APP 11 whether or not the Act binds you directly.

What “reasonable steps” means for a web app

“Reasonable steps” is deliberately proportionate: the OAIC’s Guide to Securing Personal Information weighs the sensitivity of the data, the consequences of a breach, and the practicability of the safeguard. Cost matters, but the guidance is explicit that saving money does not excuse skipping cheap, effective controls.

That last point is the sharp edge for vibe-coded apps. The controls that fail most often cost almost nothing:

A regulator or plaintiff assessing “reasonable steps” after a breach will ask: was the safeguard cheap, standard, and skipped? For missing RLS on a table of personal information, the answer is yes three times.

APP 11.2: the half everyone forgets

Destruction and de-identification get far less attention than access control, but APP 11.2 is where data-hoarding habits become liability. Common vibe-coded app patterns that violate it:

• Soft-deleting users while retaining their rows and uploads indefinitely
• CSV exports and one-off backup dumps parked in a storage bucket for years
• Logging full request bodies (including personal information) to a third-party log service with unlimited retention
• Keeping “we might train on this later” copies of user content with no policy

The fix is a written retention decision per data category and a scheduled job that enforces it. Less data held is less data breached — the cheapest APP 11.1 control is APP 11.2 compliance.

Penalties and enforcement

The era of trivial penalties ended with the December 2022 amendments, passed in the aftermath of Australia’s major 2022 breaches. For serious or repeated interferences with privacy, companies face civil penalties up to the greater of:

• AUD $50 million,
• three times the benefit obtained from the conduct, or
• 30 percent of adjusted turnover in the relevant period.

Subsequent reform added tiered penalties for lower-level contraventions — meaning the OAIC no longer has to treat every enforcement as a company-ending case to act at all — plus a statutory tort for serious invasions of privacy, which opens the door to individual claims. The enforcement direction is one-way: more teeth, more often, and security failures like unauthorised access sit at the top of the target list.

Where a breach turns into a notification

APP 11 failure and breach notification are joined at the hip: an unauthorised access or disclosure that is likely to cause serious harm triggers the Notifiable Data Breaches scheme — assessment within 30 days, then notification to the OAIC and affected individuals. That process, including the remedial-action exception that rewards fast detection, is covered in Notifiable Data Breaches: A Founder’s Guide.

The practical takeaway: continuous security testing is both the APP 11 “reasonable step” and the early-warning system that keeps an incident inside the remedial-action window.

Evidence beats intention

If you ever have to demonstrate APP 11 compliance — to a customer’s procurement team, an investor, or the OAIC — the questions are concrete: what steps, taken when, with what result. Keep:

1. Security scan history with timestamps (continuous beats annual)
2. Findings and remediation records, with time-to-fix
3. Access control design notes: which tables hold personal information and what gates them
4. A one-page retention policy for APP 11.2
5. A recent audit report — see AI Security Audit for Australian Startups for the startup-budget version

Related resources

• Notifiable Data Breaches: A Founder’s Guide — what happens after unauthorised access occurs
• Essential Eight for Vibe-Coded Apps — the ACSC framework, honestly mapped
• AI Security Audit for Australian Startups — the AU-specific audit playbook
• Penetration Testing Cost in Australia — AUD costs and when a human engagement is required
• Compliance-Ready Penetration Testing — SOC 2, GDPR, ISO 27001 evidence
• Supabase RLS Checker — verify the most common APP 11 failure in seconds

Test your reasonable steps today

Paste your URL and find out in 60 seconds whether your app’s personal information is protected the way APP 11 assumes — before a customer, a regulator, or an attacker checks for you.