Limit the collection of personal information to that which is required under the relevant Order or Direction. For a quick reference guide to the key legislative instruments related to public health and medical matters that have been implemented in response to the COVID-19 pandemic in each Australian jurisdiction, including references to the relevant legislation, regulations, Orders and Directions, see Checklist, COVID-19: Key legislative instruments related to public health and medical matters in Australian states and territories.

Notify individuals before collecting personal information, to satisfy requirements under Australian Privacy Principle (APP) 5. See also Practice note, Australian Privacy Principles: APP 5: Notification of the collection of personal information. The OAIC guides that businesses can help to achieve this by displaying a prominent notice on their premises and website, and reinforcing the information when speaking with customers or clients.

Store the information securely once it has been collected, while also taking care to observe obligations under the notifiable data breaches scheme. For more information on the Notifiable Data Breaches Scheme, see Practice note, Notifiable Data Breaches scheme.

Disclose the information to relevant health authorities involved in contact tracing activities upon the request of those authorities.

Destroy the information if it is no longer reasonably necessary for the purposes of contact tracing. A Direction or Order may specify a period for which the information must be retained. If no period is specified, the OAIC guides that information should be destroyed after a reasonable period, which would generally be within 28 days.

Where businesses are not required to ask for customer names and contact details for contact tracing purposes under a Direction or Order, those businesses may still collect contact information where doing so would be a normal part of the businesses' functions and activities (for example, booking appointments).

Businesses continue to have obligations under the Australian Privacy Principles to handle personal information appropriately. See Practice note, Australian Privacy Principles.