UPP 4. Openness

4.1 An agency or organisation must create a Privacy Policy that sets out clearly its expressed policies on the management of personal information, including how it collects, holds, uses and discloses personal information. This document should also outline the:

(a) sort of personal information the agency or organisation holds;

(b) purposes for which personal information is held;

(c) avenues of complaint available to individuals in the event that they have a privacy complaint;

(d) steps individuals may take to gain access to personal information about them held by the agency or organisation; and

(e) whether personal information is likely to be transferred outside Australia and the countries to which such information is likely to be transferred.

4.2 An agency or organisation should take reasonable steps to make its Privacy Policy available without charge to an individual:

(a) electronically; and

(b) on request, in hard copy, or in an alternative form accessible to individuals with special needs.