Tasmania’s Personal Information Protection Act 2004 (PIPA) + Personal Information Protection Principles (PIPPs)
Operationalize PIPA + PIPPs compliance with the most comprehensive PrivacyOps platform
Privacy Center
Fully Functional In Minutes
Elegant Consumer Frontend, Fully Automated Backend, Privacy Regulation Intelligent Everywhere.
Email already in use
Looks like this email is already registered with an existing account.
Unexpected error occurred
Looks like there was an error completing your request, Please contact us here for further support.
Please do not close this window while we process your request
The Personal Information Protection Act 2004 (PIPA) is a privacy law that applies to Tasmanian public and private sector organizations. It establishes guidelines for these organizations' use of personal data and provides individuals with certain rights.
Under PIPA, organizations must obtain an individual's consent before collecting their personal information and must only use that information for the purposes for which it was initially collected. Organizations must also take reasonable steps to ensure that individuals’ personal information is accurate, up-to-date, and secure.
The Personal Information Protection Principles (PIPPs) are principles outlined in the Tasmanian Personal Information Protection Act 2004 (PIPA). The PIPPs were created to safeguard individuals’ privacy and regulate how personal information is collected, used, stored, and disclosed by organizations in Tasmania. The 10 PIPPs are as follows:
- Openness: Organizations must establish transparent and clear policies for handling personal data.
- Collection: Personal information must only be collected for lawful purposes and must be collected in a fair and non-intrusive manner.
- Use and disclosure: Personal information must only be used or disclosed for the purpose for which it was collected or for a related purpose that the individual would reasonably expect and obtain data subject’s consent for it.
- Data quality: Personal information must be accurate, complete and up-to-date.
- Data security: Organizations must take reasonable steps to protect personal information from misuse, loss, unauthorized access, modification, or disclosure.
- Access and correction: Individuals have the right to access and correct their personal information held by an organization.
- Unique identifiers: Organizations must not adopt a person's government-related identifier as their own identifier, except in certain circumstances.
- Anonymity: Individuals have the right to deal with an organization anonymously, where it is lawful and practical.
- Transborder data flows: Organizations must ensure that personal information is adequately protected when it is transferred overseas.
- Sensitive information: should not collect sensitive information about an individual unless the individual has given consent, the collection is required or permitted by law, or it is necessary to prevent a serious threat to an individual's life or health and they are unable to give consent.
The Solution
Securiti enables organizations to comply with Tasmania’s Personal Information Protection Act 2004 (PIPA) + Personal Information Protection Principles (PIPPs), through AI-driven PI data discovery, DSR automation, documented accountability, enhanced visibility into data processing activities, and AI-driven process automation.
Securiti supports enterprises' journey toward compliance with Tasmania’s Personal Information Protection Act 2004 (PIPA) + Personal Information Protection Principles (PIPPs) through automation, enhanced data visibility, and identity linking.
Request a demo today to learn how Securiti can aid you and your organization's compliance efforts.
Assess Personal Information Protection Act 2004 Readiness
Schedule 1
With the help of Securiti’s multi-regulation, collaborative, readiness, and privacy impact assessment system, you can measure your organization's posture against Personal Information Protection Act 2004, identify the gaps and address the risks.
Secure Fulfillment of Data Access Requests & Automate Processing of Rectification and Anonymization Requests
PIPA Part 3A+ PIPP 3 + PIPP 6 + PIPP 8
Automates fulfillment of data subject requests for access to personal data and amends and corrects any incorrect, incomplete, out-of-date, or misleading, and anonymizes personal data stored once requested by the data subject. Securiti’s Data Subject Access Requests automation also enables organizations to create customized data subject rights request forms embedded in websites, verify identities, and aggregate requests into a fulfillment automation workbench.
Map Data Flows (Cross-Border Data Transfers)
PIPP 9
Track data flows regarding the transfer of personal information about an individual to another person or other body who is outside Tasmania.
Monitor and Track Consent
PIPP 2(1)(b) + 2(1)(c)(ii) + 2(4)(a) + 2(4)(c)(i) + PIPP 9(b) + PIPP 10(1)(a)
Automates secure capture of consent for use and disclosure of personal information by personal information custodians. Securiti's Consent Management Platform enables organizations to obtain end-users' consent for data access, retrieval, and advertising purposes.
Privacy Policy and Notice Management
PIPP 5
Ensures that policies and notices are regularly updated and renewed in compliance with legal requirements by utilizing a single privacy dashboard for automatic updates.
Assess Data Protection Measures and Enable Appropriate Security Controls
PIPP 4
Helps determine the security level and accordingly implement relevant technical and operational measures to protect personal information from misuse, loss, unauthorized access, modification, or disclosure.
Quick Facts about Tasmania's Personal Information Protection Act 2004 (PIPA) and Personal Information Protection Principles (PIPPs)
PIPA is a privacy law that applies to Tasmanian public and private sector organizations (referred to as personal information custodians).
A personal information custodian may use or disclose an individual's basic personal information for a secondary purpose without consent if they are a public authority, it's reasonably necessary for efficient storage/use, and only used/disclosed to another public sector body.
A personal information custodian can collect sensitive health information about an individual if it's necessary for providing a health service, or for public health/safety research, statistics, or health service management/monitoring, and the custodian cannot obtain the individual's consent.
A personal information custodian must take reasonable steps to permanently de-identify health information before disclosing it, if collected about an individual.
An individual can complain to the ombudsman about a personal information custodian's alleged contravention of a personal information protection principle, but only after first raising the matter with the custodian and being dissatisfied with their response.
Complaints must be made within 6 months from the time the individual became aware of the issue. The complaints regarding requests for amendments of personal information should be made within 20 days.
The PIPPs aim to balance the legitimate needs of organizations to collect and use personal information with the privacy rights of individuals.
The PIPPs also provide guidance to organizations on how to comply with PIPA's privacy requirements.
At Securiti, our mission is to enable enterprises to safely harness the incredible power of data and the cloud by controlling the complex security, privacy and compliance risks.
Copyright © 2023 Securiti · Sitemap · XML Sitemap
Newsletter
Resources
Get in touch
[email protected]
300 Santana Row Suite 450. San Jose,
CA 95128
