How DekkoSecure Supports the Australian Privacy Principles

DekkoSecure supports organisations in meeting their obligations under the Australian Privacy Principles (APPs) contained in the Privacy Act 1988.

The platform's zero-knowledge encryption, Australian sovereign hosting, access controls, and audit logging provide the technical safeguards required to protect personal information when it is stored, shared, or accessed through a cloud platform. This helps enable Privacy Act 1988 compliant file sharing and Australian sovereign file sharing for APP entities. It also supports Australian Privacy Principles file sharing and APP entity secure collaboration across agencies and partners.

Contact DekkoSecure

Privacy Act 1988

What are the Australian Privacy Principles?

The Australian Privacy Principles (APPs) are 13 principles contained in the Privacy Act 1988 that govern how Australian Government agencies and private sector organisations collect, use, store, disclose, and manage personal information. These principles also guide sensitive file sharing obligations across Australian Government agencies and regulated industries that must demonstrate APP compliance.

DekkoSecure's architecture directly addresses five of the thirteen APPs: APP 1, APP 6, APP 8, APP 11, and APP 13. The remaining APPs cover organisational obligations such as collection practices, direct marketing, and use of government identifiers, which are managed through the policies and procedures of the organisation using DekkoSecure rather than through the platform itself.

Compliance Approach

How DekkoSecure supports compliance with the Australian Privacy Principles

The Privacy Act 1988 does not certify or endorse specific software platforms. Compliance is demonstrated through the technical and organisational measures an organisation has in place to protect personal information and uphold the rights of individuals. DekkoSecure provides the technical safeguard layer that APP entities need when sharing personal information across agencies, with external partners, or between jurisdictions. This is particularly relevant to secure file sharing for Australian Government agencies and regulated industries that must demonstrate APP compliance.

DekkoSecure's zero-knowledge encryption model is directly relevant to APP 11 security of personal information, which requires organisations to take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. Because all content is encrypted on the user's device before it reaches the platform, and DekkoSecure holds no decryption keys, the platform provides a level of protection that goes beyond what most cloud file sharing solutions offer. In practice, this is zero-knowledge encryption for Privacy Act compliance, strengthening confidentiality and reducing risk.

The Five Principles

How does DekkoSecure address key Australian Privacy Principles?

The following explains how DekkoSecure supports each of the five APPs its architecture directly addresses.

APP 1

Open and transparent management

DekkoSecure's platform architecture is documented on its Security and Compliance pages, providing transparency about how personal information is protected. Organisations using DekkoSecure can reference the platform's encryption model, access controls, and data residency posture in their own privacy policies and APP 1.4 disclosures.

APP 6

Use or disclosure

DekkoSecure's Hub-based permissions ensure that personal information shared through the platform is only accessible to users who have been explicitly granted access. The zero-knowledge encryption model prevents DekkoSecure from accessing, using, or disclosing customer content for any purpose, supporting the APP 6 requirement that personal information is only used or disclosed for the purpose for which it was collected.

APP 8

Cross-border disclosure

DekkoSecure's Australian environment hosts all data exclusively within Australian territory, eliminating the need for cross-border disclosure of personal information in most use cases and mitigating cross-border disclosure risks. For organisations that operate across jurisdictions, DekkoSecure's separate sovereign environments in the United States, Canada, and Switzerland ensure that data remains within the designated jurisdiction and does not cross borders.

APP 11

Security of personal information

All content is end-to-end encrypted using AES-256 for symmetric file and message keys and ECC-384 for user key pairs. Encryption and decryption occur on the user's device. DekkoSecure operates a zero-knowledge model, meaning that even as the service provider DekkoSecure cannot access or decrypt any customer data. The platform also enforces multi-factor authentication, SSO integration, configurable session controls, and a Zero Trust access model.

APP 13

Correction of personal information

DekkoSecure holds minimal personal data about users, limited to email addresses and names. Users can update their own names, but email addresses cannot be changed as they are tied to the user's encryption keys.

Notifiable Data Breaches

DekkoSecure and the Notifiable Data Breaches Scheme

The NDB scheme requires APP entities to notify the OAIC and affected individuals when a data breach involving personal information is likely to result in serious harm. The assessment of whether serious harm is likely depends on several factors, including whether the information is encrypted and the encryption is unlikely to have been compromised. Notifiable Data Breaches scheme encryption guidance recognises that strong encryption can materially reduce the likelihood of serious harm.

DekkoSecure's zero-knowledge encryption provides a strong mitigating factor in this assessment. Because all content is encrypted before it reaches the platform and DekkoSecure does not hold decryption keys, a platform-level security incident would not expose personal information in a readable form.

This does not remove an organisation's obligation to assess and report breaches, but it significantly reduces the likelihood that a breach involving DekkoSecure-hosted data would meet the threshold for serious harm.

Who Benefits

APP-aligned file sharing for government and industry

DekkoSecure is designed to support APP entities that need to share personal information securely while helping meet obligations under the Privacy Act 1988. Across these use cases, the platform enables secure file sharing and controlled collaboration with granular access controls, auditability, and zero-knowledge end-to-end encrypted workflows designed for sensitive information environments.

Australian Government agencies sharing personal information across departments or with external parties under the Australian Privacy Principles, including organisations operating within PSPF-aligned security environments.

Private sector organisations covered by the Privacy Act, including businesses with annual turnover above $3 million and regulated entities that handle customer, employee, or client personal information.

Healthcare providers sharing patient records and medical information with external specialists or partner organisations.

Law enforcement agencies managing personal information within digital evidence workflows.

Legal and professional services firms exchanging client documents containing personal information.