Guides & Blog · 2025-12-11 · eWEB TEC
IRAP vs the Privacy Act: What Australian Businesses Actually Need
The Privacy Act 1988 is the national law that governs how many Australian organisations collect, use and secure personal information, through the Australian Privacy Principles (APPs) and the Notifiable Data Breaches scheme. IRAP (the Information Security Registered Assessors Program, administered via the ACSC) is a government-focused assessment pathway where an endorsed assessor evaluates ICT or cloud systems against Australian Government security guidance such as the Information Security Manual (ISM) — commonly for government and regulated cloud use, often discussed at PROTECTED and related levels.
They answer different questions. Confusing them leads boards to buy the wrong assurance — or none at all.
Privacy Act in plain English
- About: personal information of individuals (customers, staff, patients, etc.).
- Who it can apply to: many private-sector organisations (with turnover and sector rules), plus agencies and other entities the Act covers — get legal advice for your facts.
- What good looks like: clear collection notices, limited use, security of personal information, overseas disclosure rules, and breach assessment/notification under the NDB scheme when required.
- Hosting angle: residency helps risk management, but APP compliance is about how personal data is handled end-to-end, not only which country the disk sits in.
IRAP in plain English
- About: independent assessment of system security against Australian Government cyber security requirements (ISM-oriented), performed by an IRAP assessor.
- Who cares most: Australian government agencies using cloud, and vendors wanting to supply or host government workloads with documented assurance.
- What it is not: a casual marketing sticker or a substitute for Privacy Act obligations on personal information.
- Shared responsibility: large cloud platforms often publish IRAP assessment materials for their infrastructure layer; your configuration, identity, data classification and apps remain your problem.
Side-by-side: which problem are you solving?
- Customer emails and CRM data for a Northern Beaches SME: start with Privacy Act practices, access control, backups and Australian-hosted options if contracts demand residency — see sovereign cloud.
- Selling or hosting for government at PROTECTED-oriented expectations: expect IRAP-related assessment language, ISM controls and formal assurance — not just an APP policy PDF.
- Both: government work with citizen data needs security assessment and privacy compliance; they stack, they do not cancel each other.
What most SMEs should prioritise
Unless you are bidding for government cloud work that explicitly requires IRAP-assessed services, your practical checklist is usually: map personal information, lock down access (MFA), know where data and backups live, test restores, and have a breach response path. eWEB TEC designs Australian-hosted cloud and managed environments with Privacy Act-oriented practices and IRAP-aligned control thinking — without pretending every SME needs a full government assessment package on day one.
FAQ
Is IRAP a law like the Privacy Act?
No. The Privacy Act is legislation. IRAP is an assessment program used to evaluate systems against government security guidance (such as the ISM), mainly for government-related assurance.
Does Australian data residency equal IRAP?
No. Residency is about where data sits and who can access it. IRAP is about assessed security controls for government-oriented use. You can have one without the other.
Do we need an IRAP assessment to use Microsoft or AWS?
Government agencies often require assessed services for certain classifications. Commercial SMEs more often need correct configuration, privacy compliance and contracts — not a customer-side IRAP assessment of the hyperscaler.
Can eWEB TEC help without claiming fake certification?
Yes. We help with Australian hosting, controls, backups and practical privacy-oriented design, and we will not invent IRAP certificates you do not have.
Need Australian-hosted cloud with clear privacy thinking?