ERP privacy and data breaches: Privacy Act duties, 2024 amendments and where your data is stored

An ERP holds a great deal of personal information: customer contacts, supplier sole traders, employees' bank details and tax file numbers, sometimes health or credit information. If your business is covered by the Privacy Act 1988, you must handle that information under the Australian Privacy Principles (APPs), take reasonable steps to secure it, and notify the OAIC and affected individuals of eligible data breaches under the Notifiable Data Breaches scheme. The Privacy and Other Legislation Amendment Act 2024 added a statutory tort for serious invasions of privacy (from 10 June 2025), stronger enforcement tools, and privacy-policy transparency duties about automated decisions from 10 December 2026. Australian law does not generally require private businesses to keep data onshore, but APP 8 makes you accountable when information goes overseas. This guide explains what to check in an ERP and its contract.

This guide is part of why ERP projects fail and how to avoid it. It is general information, not legal advice.

Is your business covered?

The APPs generally apply to Australian Government agencies and to private-sector organisations with annual turnover of more than $3 million. Some smaller businesses are covered regardless of turnover, including health service providers, businesses that trade in personal information, and contracted service providers to the Commonwealth. Check the OAIC's guidance for the full list.

There is an employee records exemption: for private-sector employers, handling of employee records directly related to the employment relationship is largely exempt from the APPs. It does not cover job applicants or contractors, and it does not remove other obligations, such as tax file number rules, or the risk of a breach. Treat employee data in the ERP with full security in any case.

Security obligations in practice

APP 11 requires covered entities to take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, and the 2024 amendments clarified that this includes technical and organisational measures. In an ERP, that means:

• role-based access so staff see only what they need (for example, payroll data restricted);
• multi-factor authentication for all users;
• audit logs of who viewed and changed sensitive records;
• encryption in transit and at rest;
• prompt removal of access for departing staff and partners;
• secure integrations and API keys;
• destroying or de-identifying information you no longer need.

Ask the vendor and partner to show these features, and configure them in implementation; see the implementation cost guide.

Notifiable Data Breaches

An eligible data breach occurs when there is unauthorised access to, disclosure of, or loss of personal information that is likely to result in serious harm to an individual, and the harm cannot be prevented by remedial action. If you suspect one, you must carry out a reasonable and expeditious assessment, generally within 30 days, and if it is eligible, notify the OAIC and affected individuals as soon as practicable.

In an ERP context, breaches often come from compromised user credentials, misconfigured sharing, a vendor or partner incident, or an exported spreadsheet sent to the wrong person. Your contract should require the vendor and partner to notify you promptly of incidents affecting your data and to cooperate with your assessment, because the obligation to notify individuals usually sits with you.

Separately, the Cyber Security Act 2024 requires businesses with annual turnover of more than $3 million (and critical infrastructure entities regardless of size) to report a ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours of making it or becoming aware it was made, from 30 May 2025. Check the current requirements on cyber.gov.au.

The 2024 amendments in brief

Automated decision transparency could be relevant if your ERP automatically sets credit limits or places accounts on hold for individual customers or sole traders, or screens staff rosters and pay. Review your privacy policy before 10 December 2026. The OAIC has published guidance; check it for current detail.

Maximum penalties for serious interferences with privacy were already raised from 13 December 2022: for a company, the greatest of $50 million, three times the benefit obtained, or, if that benefit cannot be determined, 30% of adjusted turnover in the relevant period.

Data location and sovereignty

• The Privacy Act does not generally require onshore storage for private businesses.
• APP 8: before disclosing personal information to an overseas recipient, you must generally take reasonable steps to ensure it handles the information consistently with the APPs, and you can remain accountable for its acts. Whether hosting with a cloud provider is a "disclosure" depends on the arrangement; the OAIC's guidance discusses this.
• Contracts and sectors may require Australian hosting: government contracts, some health information, some financial services and customer contracts.
• Support access matters too: offshore support staff may be able to view your data.

Ask every vendor:

1. Where are production data and backups hosted? Is an Australian region available, and at what price?
2. Who are the sub-processors, and where are they?
3. From which countries can support staff access data?
4. How will you be notified of incidents, and how fast?
5. What certifications or independent audits cover the service?

Cloud deployment trade-offs are covered in cloud vs on-premise ERP.

Contract clauses to look for

• Data processing terms stating the vendor uses data only to provide the service.
• Breach notification to you within a stated time.
• Hosting location commitments and notice before changing them.
• Sub-processor list and notice of changes.
• Deletion and return of data at the end; see exit and data export.
• Liability carve-outs for data breaches caused by the vendor; see contract traps.

Frequently asked questions

Do we need Australian data hosting?

Not by general privacy law, but contracts, customers or your sector may require it. APP 8 obligations apply if information is disclosed overseas.

Who notifies a data breach if it happens at the vendor?

The obligation generally rests with the entity holding the information, which is often you. Contracts should make the vendor tell you quickly and help.

Does the small business exemption cover us?

Possibly, if turnover is $3 million or less and no exception applies. Check the OAIC's guidance; even exempt businesses face breach and reputational risk.

What changes on 10 December 2026?

Privacy policies of covered entities must disclose certain uses of personal information in automated decisions that significantly affect individuals.

Sources

• Office of the Australian Information Commissioner — APPs, Notifiable Data Breaches, statutory tort and automated decisions guidance
• Australian Cyber Security Centre — Essential Eight, incident reporting and ransomware payment reporting
• Federal Register of Legislation — Privacy Act 1988 and the 2024 amending Act
• Attorney-General's Department — privacy reform background