This legal update considers guidance published by the Office of the Australian Information Commissioner (OAIC) to help organisations regulated by the Privacy Act 1988 (Cth) to understand their privacy obligations to employees when collecting, using, storing, and disclosing employee health information related to COVID-19 vaccinations. It also discusses the potential application of the employee records exemption to employee information related to COVID-19 vaccination status.