Privacy policy

‌Introduction

The Aged Care Quality and Safety Commission (referred to as ‘the Commission’, ‘we’, ‘us’ or ‘our’) is committed to upholding the privacy of older people, their representatives, registered providers and aged care workers, members of the public and our employees.

Our Privacy Policy explains how the Commission collects, uses, holds, and discloses personal information (including sensitive information), and complies with the:

We review this policy annually, and when there is a significant change in privacy practices or our functions.

‌About this policy

This Privacy Policy is applied by Commission staff, contractors and consultant who assist the Commission in its performance of functions and activities under the Aged Care Act. Our Privacy Policy operates across all functions and areas of the Commission, which consists of the:

  • Aged Care Quality and Safety Commissioner (Commissioner)
  • Complaints Commissioner
  • Aged Care Advisory Council, and
  • staff of the Commission.

‌Who should read the Privacy Policy

Our Privacy Policy is relevant to individuals who interact with, or intend on interacting with Commission, such as:

  • older people who access funded aged care services, their family members, representatives or guardians
  • aged care workers, responsible persons, registered providers
  • job applicants, employees,
  • contractors, consultants, suppliers of good, and
  • members of the public.

‌What is not included in the Privacy Policy

This Privacy Policy is not intended to cover functions or activities administered by the Department of Health, Disability and Ageing, or where specific activities have their own standalone Privacy policy, including:

‌Collection of Personal Information

‌Kinds of personal information we collect

The Commission only collects personal information about you when it’s reasonably necessary for or directly related to its functions or activities. The kinds of personal information we collect depends on the reason we are collecting it.

In this policy, personal information and sensitive information has the meaning given to these terms in the Privacy Act .

Personal information

Some examples of personal information we may collect includes:

  • your contact details (such as your name, mobile phone number, address and email address)
  • biographical data (i.e. your date of birth and gender)
  • name and contact details of family members, nominees or carers, supporters, or other authorised representatives
  • your education and employment status and history
  • information about your personal circumstances (i.e. marital status)
  • government identifiers (such as Centrelink and Medicare Reference Numbers, Tax File Number)
  • information about funded aged care services you provide, access, seek to access, or that are delivered to you
  • information contained in feedback, complaints or applications
  • photographs, video recordings and audio recordings, and
  • information about how you use our online services such as online forms you fill in, pages you visit, and other online interactions.

Sensitive information

Examples of sensitive information we may collect includes information about your:

  • language preferences
  • country of birth, passport or visa details
  • ethic origin, cultural and linguistic background
  • sexual orientation
  • health and disability information
  • police clearances for workers, worker screening clearances, criminal history
  • religious, philosophical beliefs or political opinions, and
  • photographs and video recordings, by their nature, may also contain sensitive information.

‌Collection notices and consent

When collecting personal information, the Commission takes reasonable steps to tell you why we are collecting your personal information, whether collection is required or authorised by law, the consequences if you do not provide the information, and the usual purposes for which we may use or disclose it.

The Commission usually seek your consent before collecting personal information (including sensitive information), where practical or required, unless an exception applies (i.e. we are required or authorised by an Australian law).

‌Why we collect personal information

As the national aged care regulator, the Commission upholds the rights of older people, protects and enhances the safety and quality of life of older people. To assist the Commission in performing its functions and activities we aim to only collect personal information that directly relates to the work we do.

The Commission collects personal information to:

  • manage and respond to complaints and feedback
  • assess and determine applications for registration as a funded aged care provider
  • evaluate service delivery, complete audits and registration renewals
  • monitor and investigate non-compliance with the Aged Care Act, and Aged Care Rules
  • respond to reportable incidents notifications under the Serious Incident Response scheme
  • initiate an investigation, take compliance and enforcement action
  • promote the provision of quality care and services, share information, seek sector insights and delivery of education related to the functions and activities of the Commission
  • progress employment and personnel functions
  • undertake contract management, participate in funding agreements or grants, and
  • exercise any other functions or powers that may be provided for by the Aged Care Act or any other law of the Commonwealth.

We also collect, use and disclose personal information that comes from legislated reporting requirements and other activities that are incidental or conducive to our functions.

‌How we collect personal information

The Commission collects personal information (including sensitive information) in a lawful and fair way, through a range of channels, including by:

  • electronic and paper forms
  • telephone and online meetings
  • social media channels
  • surveys
  • data sharing arrangements
  • site visits, and
  • My Aged Care Service Provider Portal.

The Commission usually collects person information about you when you interact with the Commission. Sometimes, we may collect personal information from a third party (such as, other Commonwealth and State/Territory Government agencies, aged care providers and members of the public or publicly available sources) to perform our functions under the Aged Care Act.

We only collect personal information from a third party if we are permitted to do so, for example:

  • where you would reasonably expect us to or you have provided consent
  • if we are conducting an investigation
  • direct collection is unreasonable or impracticable, or
  • we are required or authorised under an Australian law or a court/tribunal order.

‌Indirect collection

In some cases, the Commission might indirectly collect personal information, where necessary for our functions and activities, for example from:

  • a registered supporter, legal representative, family member or guardian
  • a registered provider, associated provider, Digital Platform Operator (DPO), aged care worker or responsible person
  • a third party, such as another government agency, where authorised by law or with your consent (if possible), or
  • an organisation contracted by the Commission to provide services on our behalf, or to assist the Commission with its human resources, communications, Information Technology (IT) or other corporate activities.

‌Online and digital interactions

‌Commission’s website

The Commission’s website is hosted in Australia and there are a number of ways we collect information through our website, including via online tools. More information about interacting with our website can be found at Website privacy.

The Commission uses Google Analytics to assist us to measure how website visitors interact with content we share. More information about Google cookies and analytic tools can be accessed via the following links:

‌Webforms/Smart forms

The Commission uses online forms to enable you to submit feedback about your experiences, sign up to receive our newsletter, make a complaint or give feedback, apply for registration, make an enquiry or apply for a job.

The Commission collects personal information that you provide when completing an online form. We provide you with access to a notice of collection for specific activities so you know why we are collecting the information, how we may use it, store and disclose information.

‌Surveys

The Commission uses Mailchimp and Qualtrics XM to conduct surveys which might include the collection of personal information you provide in survey responses, such as your name, email, job role, place of work and other information that may be relevant in the context of particular surveys.

For details about how Mailchimp and Qualtrics XM manage privacy, you can view their Privacy policies at Mailchimp Data Security and Privacy.

‌Event registrations

The Commission may use third party service providers (including third party platforms) to manage event ticketing, registration and promotion of Commission events.

If you visit and register for our events through a third-party service, your information will be sent to servers used by those relevant third parties, which hold information outside Australia.

When registering to attend an event delivered by the Commission, we encourage you to review any third party’s Terms of Service, and Privacy policy.

‌Social Media

The Commission use social media platforms such as YouTube to host videos which are embedded on the Commission’s website. When you access or play an embedded video shared by the Commission, the video and associated assets will load from the domain www.youtube.com, and other domains associated with the YouTube player. This information is not made available to the Commission and is instead handled in accordance with the YouTube privacy policy.

The Commission may use other social networks like Facebook, X (formerly Twitter), Instagram and LinkedIn to communicate with the public about its functions and activities. If you communicate with the Commission using these social networking services, the Commission will collect the personal information you provide in your communication.

‌Regulatory and compliance records

The Commission collects personal information when exercising its statutory powers as a rights-based regulator of Commonwealth-funded aged care services. We may collect records to assess the compliance of registered aged care providers, responsible persons, aged care workers and DPOs, with obligations and statutory duties (where applicable) under the Aged Care Act. This includes but is not limited to:

  • policies, procedures and governing body minutes
  • workforce governance records, worker screening information, images
  • registration audits - care files, service agreements
  • transcripts and surveillance footage.

‌Unsolicited personal information

Sometimes an individual may provide us with additional personal information that isn’t related to our functions. When this occurs, we may de-identify or archive the personal information, if it is reasonable to do so and aligned with our practices under the Archives Act and the National Archives of Australia Records Disposal Authority.

‌Use of Personal Information

‌Primary uses

The Commission generally uses personal information for the purpose it was collected (primary purpose), to perform its functions or activities, or for a related secondary purpose, where permitted by the law. Primary uses of personal information may include input from approved artificial intelligence (AI) tools or LLMs. We usually explain at the time of collection how personal information may be used to support our statutory functions and activities, set out under ‘Why we collect personal information'.

‌Secondary uses

The Commission may use personal information for purposes other than the primary purpose of collection, including but not limited to, if the use is required or authorised by law, or you have provided consent, or you would reasonably expect the information to be used in that way.

Secondary purposes are usually explained at the time of collection. Personal information may be used for the following secondary purposes:

  • to improve service quality, intelligence, trend analysis and reporting
  • provide you with updates, alerts and news
  • monitoring and investigating security risks
  • to assist with the health and safety of employees or contractors, and
  • internal information sharing on a need-to-know basis or to other government bodies or health authorities where legally required or authorised to support their functions.

‌Approved AI technology and automation

The Commission follows safe, ethical and responsible use of AI technology while upholding transparency and human oversight. We may use AI technology and analytics tools, combined with our workforce to enhance service delivery, experiences or improve operational efficiency. While these technologies support or enhance our services, we do not use approved technologies, substantially and directly related to the making of a decision, that may affect the rights or interests of an individual.

Approved AI technology includes Microsoft 365 Copilot, consistent with the whole of Australian Government and approved data analytics tools to support analysis and the identification of emerging risks related to our functions and activities. We apply appropriate controls and processes for use of AI technology and data analytic tools that align with:

‌Data matching

Data matching programs aim to enhance risk analysis and prioritisation through comparison of data sets. The Commission may use personal information or deidentified information it collects to carry out data matching and analysis related to functions and activities, particularly focusing on upholding the rights of older people accessing aged care services. We comply with obligations under the Privacy Act and relevant guidelines, consistent with data ethic principles when comparing data in a data matching program.

‌Communications and subscriptions

When you subscribe to the Commission’s newsletter, other communication or training services, we may contact you to seek your involvement in consultation opportunities, to share alerts or other information about changes to our services, policies or regulatory activities. You can opt out of these communications and our mailing lists by using the opt out mechanism included in the communications (usually by clicking the 'unsubscribe' button in the email), or by contacting us using any contact method below.

‌Remaining Anonymous or Using a Pseudonym

In some circumstances, an individual may interact with the Commission anonymously or by using a made-up name (pseudonym). Our complaints and feedback functions support individuals to be anonymous, confidential or known to others depending on their preference. The Commission will take reasonable steps to handle personal information in a way that protects the identity of the individual when requested. However, there may be limits to the extent which the anonymous complaint can be investigated and addressed by the Commission.

For other types of engagements, you may be supported by using a pseudonym. For example, you might decide to use a pseudonym when submitting a request to access information held by the Commission under the Freedom of Information Act 1982 (Cth).

If we are legally required or authorised to deal with an identified individual by law, or where it is impracticable for the Commission to engage with you anonymously or pseudonymously, this option will be unavailable. Where this applies, we will advise you of our requirement to collect your personal information prior to or at the time of collection. For example, the Commission must collect personal information from individuals applying for registration as an aged care provider.

For more information about how the Commission manages complaints, see our Complaints Handling Policy.

‌Whistleblower disclosures

A whistleblower disclosure is information shared by a discloser to certain recipient, including a Commissioner, or a staff member of the Commission, either orally or in writing (anonymously or not), where the discloser has reasonable grounds to suspect the information indicates an entity may have contravened the Aged Care Act.

Whistleblower disclosures commonly contain personal information about the discloser, older people accessing funded aged care services, representatives, aged care workers, responsible persons, registered providers, or other individuals.

The Commission does not disclose the identity of a whistleblower discloser, or information that is likely to identify them, unless:

  • the disclosure is permitted or required by law
  • the person consents to the disclosure, or
  • the disclosure is necessary in limited circumstances, such as preventing or responding to a serious threat to a person's health, safety or wellbeing.

For more information about how the Commission manages whistleblower disclosures, please refer to the Managing Whistleblowers Disclosure Policy.

‌Disclosure of Personal Information

The Commission may disclose personal information where the disclosure is required or authorised by law, reasonably necessary for our functions or activities, or made in accordance with a Memorandum of Understanding or other lawful information-sharing arrangement.

We may disclose personal information to (but are not necessarily limited to):

  • our contracted service providers who deliver services to us or on our behalf
  • our professional advisers (for example, lawyers, auditors and consultants)
  • other Commonwealth, state and territory regulators, complaints bodies, law enforcement agencies (such as the Australian Federal Police)
  • other state, territory or Commonwealth government agencies (such as the Australian Taxation Office, the Department of Social Services or Services Australia)
  • requests made under the FOI Act 1982 (Cth) or under the Data Availability and Transparency Act 2022 (Cth)
  • courts and tribunals, and
  • Ministers, parliamentary staff and committees exercising their oversight of the Commission’s functions (such as, the Advisory Council).

Where possible, we de-identify irrelevant personal information, before providing it to a third party outside the Commission. We will not use or disclose your personal information for another purpose, unless we have your consent or the use or disclosure is permitted or authorised by an Australian law, including under the Aged Care Act or Privacy Act.

‌Disclosure of personal information overseas

The Commission may engage contracted service providers who store data outside Australia for the purposes of:

  • performing functions or activities on our behalf, or
  • delivering services to us (for example, third party platform providers).

We may also disclose personal information to overseas contracted service providers, where:

  • you have consented to the disclosure
  • the disclosure is required or authorised by law, or
  • the disclosure is otherwise permitted under the Privacy Act and Aged Care Act.

The Commission requires overseas contracted service providers to use personal information only for the purpose provided and to adhere to our stringent confidentiality and data protection agreements. Any offshore disclosures will be limited to countries that have similar privacy laws to Australia, which may include the United Kingdom, United States of America, European countries and Asia Pacific countries.

‌Publicly available personal information

The Commission may publish personal information on its website, where authorised or required by the Aged Care Act. Any personal information published on our website may be accessed by individuals in Australia and overseas. The Commission cannot control, and is not responsible for, any subsequent use or disclosure of information published on our website by third parties.

‌Storage, Security and Retention of Personal Information

Personal information held by the Commission is stored on electronic and paper files. The Commission takes reasonable steps to protect your personal information against misuse, interference and loss, and from unauthorised access, modification or disclosure. These mitigating actions include:

  • implementing security controls in accordance with the Australian Government's Protective Security Policy Framework (PSPF) and the Information Security Manual (ISM)
  • adhering to other Australian Government frameworks, legislation, policies, guidelines and standards relating to privacy, data security and records management
  • conducting regular system updates and auditing of storage and data security systems
  • taking reasonable steps to de-identify or archive personal information that is no longer needed for the purpose in which it was collected, subject to any legal requirements to retain it (i.e. obligations under the Archives Act, court/tribunal orders), and
  • implementation of privacy awareness training, education sessions, permission and access restrictions to records and password protection for devices.

‌Security of personal information

Our security practices assist us to keep digital and paper based personal information secure. The Commission uses ICT protections on internal network and databases, such as firewalls, intrusion detection and prevention, antivirus software, user authentication and access controls.

The Commission adopts a clear desk and screen policy, secure storage of paper records and 24/7 surveillance of premises with logged access controls, subject and security clearances.

If the Commission becomes aware of a data breach or potential breach, we will respond in line with our Data Breach Assessment and Response Plan, which aligns with the Notifiable Data Breaches Scheme.

‌Data breaches

If the Commission suspects or becomes aware of a data breach involving personal information, we will assess the incident and take steps to contain, investigate and remediate it. Where the Privacy Act’s Notifiable Data Breaches scheme requires notification, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

Where notification is practicable to notify each affected individual directly, we may publish a notification on our website and take reasonable steps to publicise the notification in accordance with the requirements of the Notifiable Data Breaches scheme.

‌Access to, and Correction of Personal Information

‌Quality of personal information

We aim to keep the personal information we collect, use or disclose up to date, complete and relevant for the purpose for which it is handled. You can help us maintain the quality of your personal information by telling us if your details change or if you believe the personal information we hold about you is incorrect.

‌Accessing and correcting your personal information

Under the Privacy Act, you have a right to access personal information that we hold about you. You also have a right to request correction of your personal information if it is inaccurate, out of date, incomplete, irrelevant or misleading.

We will provide access to your personal information, and take reasonable steps to correct your personal information, unless there is a law that allows or requires us not to. If we refuse your request, we will notify you in writing and explain the reasons for our decision.

If you are seeking access to a registered provider’s records, we recommend you contact the provider directly in the first instance. If you are seeking care records of someone you do not legally represent or support, be aware that there are restrictions in the Privacy Act about disclosing this information to you.

To request access to or correction of your personal information, contact the Commission's Privacy team or our Contact Centre using the details below.

‌Privacy Complaints and Feedback

‌Contact us

If you have a concern about the way we handle your personal information, or want to make a complaint, you can submit feedback about us by:

If you are dissatisfied with our response, you can complain to the OAIC about your concerns. Further information can be obtained directly from the OAIC website.

To request access to or correction of your personal information, make a privacy complaint, ask a question about this policy, or request a copy of this privacy policy, contact the Commission’s Privacy Team using the contact details published by the Commission.

Updates to this policy

We will, from time to time, review and revise this Privacy Policy. The Commission reserves the right to amend this policy at any time and any amendments will be notified by posting an updated version on our website.

Last updated: August 2026

Download a full version of the policy

A full version of the policy is available to download in PDF format.

Privacy Impact Assessments

Under the Australian Government Agencies Privacy Code (the Code), agencies must undertake a written Privacy Impact Assessment (PIA) for all projects involving new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.

The table below is updated with PIAs completed by the Commission since its commencement on 1 January 2019:

 

Date of completion Title of PIA
February 2026 Reform for Better Aged Care Systems
August 2025 Sector Education Research
July 2025 Digital Audit Tool
December 2024 Data Layer Project
February 2024 New Aged Care Act Bill 2024
November 2022 Aged Care Code of Conduct and Banning Orders
November 2022 Front Door Project - Genesys
June 2022 Consumer and Families Panel
August 2021 Serious Incident Response Scheme
July 2021 Consumer Engagement Survey Pilot
July 2021 Risk Based Targeting and Information Sharing Project – Phase 2
February 2020 Risk Based Targeting and Information Sharing Project
2019 Nil

More information

To find out more about how we manage personal information, to make a privacy complaint or to request access to or correction of your personal information, see our Privacy page, Notice of Collection or contact the Privacy Officer using the details above. For more general information on the Privacy Act and the APPs:

Was this page useful?
Why?
Why not?
Share this page
 

Acknowledgement of Country

In the spirit of reconciliation, the Aged Care Quality and Safety Commission acknowledges the Traditional Custodians of Country throughout Australia and their connections to land, water and community. We pay our respect to their Elders, past, present and emerging and extend that respect to all Aboriginal and Torres Strait Islander peoples. 

Aboriginal and Torres Strait Islander readers are advised that content on this website may contain images of deceased persons.