I am Secure provides a range of free resources to any organisation or entity that stores information about a person, especially if that information can be used to identify that person.
The Privacy Act 1988 was introduced to promote and protect the privacy of individuals and to regulate how Australian Government agencies and organisations with an annual turnover of more than $3 million, and some other organisations, handle personal information.
In the EU, it has become mandatory for any entity storing Personal Identification information to adhere to a strict set of audit criteria. That condition has not yet come into place in Australia, however, this requirement is expected to be implemented in Australia within the next 18-24 months. Even though the increased privacy measures are not yet mandated in Australia, it is a good practice to ensure optimal security of personal information you hold.
The general population is increasing its awareness around PII, any organisation that complies to the EU standard will find themselves at a distinct advantage to this ever increasing public awareness of entities storing information that could be used to identify them.
Although the EU standards are not in place in Australia, any entity that loses PII and where this information is then used to commit identify theft, is still liable under Australian Law. A single law suit can cost an entity anywhere from tens of thousands of dollars into the millions, most small businesses would not be able to recover from such an event.
Protect your entity now.