Bundle Waste
Free audit
Get a free audit
Home / Regulations / Information Destruction Standard (AS/NZS 4774)

Confidential document destruction and privacy duties

Check APP 11 duties before destroying personal information: retention exceptions, secure handling, appropriate methods and evidence of destruction.

Illustration accompanying Information Destruction Standard (AS/NZS 4774)
Illustrative image

Sources checked 18 September 2026. Scope: Victoria, with Australian schemes identified where relevant.

For entities covered by the Australian Privacy Principles, information destruction is a privacy and security decision. Check what must be retained before ordering destruction. Source: Office of the Australian Information Commissioner — Chapter 11: APP 11 Security of personal information.

What applies

OAIC explains that APP entities must take reasonable steps to destroy or de-identify personal information the entity holds when it is no longer needed for a permitted purpose. Exceptions include Commonwealth records and legally required retention. The method depends on the information and medium; ordinary recycling is generally insufficient where hard-copy information remains retrievable. Source: Office of the Australian Information Commissioner — Chapter 11: APP 11 Security of personal information.

Practical checks for your business

These suggested planning steps help organise site information; they are not an exhaustive legal compliance checklist.

  1. Confirm the record owner, retention schedule, legal holds and disposal authorisation.
  2. Specify secure storage, custody, destruction method and verification, including digital copies and backups.
  3. Keep an authorised destruction record and supporting contractor documentation. Do not treat a certificate alone as proof that every privacy duty is met.

Confirm the requirement for your site

For a disputed requirement or enforcement issue, ask the relevant authority or qualified adviser to identify the current provision and how it applies. Do not rely on an old penalty amount or general website summary.

Keep a usable decision record

Keep assessments, acceptance conditions, responsible contacts and supporting records together. Note what needs confirmation before changing the service or starting work.

Common question

Does every business need a specific shredding grade?

This guide does not impose a universal grade or certification. Choose controls for the information and check requirements applying to your organisation.

Discuss your collection requirements

Contact Bundle Waste with the waste type, site and collection requirements. Keep specialist legal, environmental or safety assessment separate from the collection request.

Sources

Primary guidance checked 18 September 2026. Review due 18 October 2026, or sooner if requirements change.