Case study · Privacy
Data mapping and a privacy impact analysis for an aged care provider
Highly sensitive resident information and limited visibility of where it went. We mapped each department's data flows and assessed them against the Australian Privacy Principles.
- Industry
- Aged care
- Information held
- Personal, legal and financial
- Delivered
- Data flow maps, PIA, policy updates
- Framework
- Privacy Act and the APPs
The challenge
Sensitive data with limited visibility
The provider manages highly sensitive personal, legal and financial information about its residents. It had limited visibility of how that data moved through its lifecycle, from capture to disposal.
There were gaps in existing information protection measures and against privacy legislation, handling methods and policies differed between departments, and highly sensitive data was exposed to risks such as external access and weak lifecycle management.
Our approach
Four deliverables, one data protection framework
Targeted workshops with each department captured data flows, risks, challenges and opportunities. They fed four deliverables.
How we did it
- 1Workshops with each departmentCapturing data flows, risks, and each department's challenges and opportunities.
- 2Assess the current stateInformation protection measures, compliance gaps, common needs and a high-level look at the technology stack.
- 3Map the dataHow business confidential and personal information moves across the organisation, and how each type is handled.
- 4Analyse the privacy impactRisks identified in the data flows, with mitigations aligned to the Australian Privacy Principles.
- 5Fix the policiesUpdates to existing policies and new policies based on what the workshops found.
The results
What the provider has now
Staff can see how sensitive data is used, handled and moves across the business.
Updated policies and a clear DLP strategy.
Immediate, cost-effective actions for high-risk data exposures.
Better categorisation of sensitive information, supporting compliance.
What we learned
Lessons for other organisations
Working with staff across departments gave a complete picture of data flows and handling needs.
Starting with quick wins reduced risk straight away and laid the foundation for lasting improvement.
Aligning policy updates with business operations helped staff adopt the new data protection measures.
Not sure where your sensitive data goes?
A 45-minute governance health check shows where your real exposure sits and what to fix first.