Accounts & access
- Offer or require MFA on customer sign-in, especially for accounts holding personal or payment data.
- Apply least privilege — give each user and service account only the access it needs.
- Never hard-code credentials or API keys in your code or repository; use a secrets manager.
Data handling
- Collect the minimum personal information you actually need (data minimisation — APP 3).
- Hash passwords with a strong, salted algorithm — never store them in plain text.
- Encrypt sensitive data in transit (HTTPS/TLS) and at rest.
- Delete or de-identify personal information you no longer need (APP 11).
Environments & operations
- Separate development, testing and production environments; never use real customer data in dev/test.
- Keep dependencies and frameworks patched; monitor for known vulnerabilities.
- Keep audit logs of access and changes — and protect the logs themselves.
- Back up data and configuration, store a copy offline, and test restores regularly.
Before you launch
Before you go live: MFA on, secrets out of code, real data out of test, backups tested, and a plan for what to do if there's a breach (see Privacy Obligations).
Related on this site
Official sources
- ACSC — Securing Customer Personal Data
How to protect the customer data your service holds.
- ACSC — Essential Eight
- ACSC — Small Business Hub
- OAIC — Australian Privacy Principles
- OAIC — Notifiable Data Breaches