Product Overview

Summary: This SOP sets out a clear, practical framework for protecting the personal information of zoo visitors across ticketing, memberships, events, online bookings and on-site interactions. It helps Australian zoos comply with privacy law, safeguard digital systems and build visitor trust through disciplined data handling and security practices.

Australian zoos collect and manage large volumes of visitor data every day – from online ticket sales and memberships to animal encounters, education programs and donations. Without a structured approach, this information can be mishandled, exposed to cyber threats or used in ways that breach the Privacy Act and erode public trust. The Data Privacy and Security for Zoo Visitors Standard Operating Procedure provides a clear, organisation-wide playbook for how personal information is collected, stored, accessed, shared and disposed of in a zoo environment.

This SOP translates privacy and cybersecurity requirements into practical, zoo-specific processes that frontline staff, managers and contractors can actually follow. It addresses the full data lifecycle across digital platforms, CCTV, Wi‑Fi, mobile apps, point-of-sale systems and paper forms, with special focus on children’s data and sensitive information such as payment details and health information for accessibility needs. By implementing this procedure, your zoo can reduce the risk of data breaches, phishing and unauthorised access, demonstrate compliance with Australian privacy law, and give visitors confidence that their family’s data is handled safely and respectfully.

The document is designed for real-world operations, aligning governance requirements with the realities of busy school holidays, special events and high-volume ticketing periods. It clarifies who is responsible for what, how to respond to suspected breaches, and how to work safely with third-party providers such as booking platforms, payment gateways and marketing tools. The result is a consistent, defensible and auditable approach to data privacy and security that protects your visitors, your reputation and your bottom line.

Key Benefits

• Ensure compliance with the Privacy Act 1988 (Cth) and Australian Privacy Principles in the specific context of zoo visitor data.
• Reduce the likelihood and impact of data breaches, cyber incidents and unauthorised access to visitor information.
• Standardise how staff collect, use, store and dispose of visitor data across ticketing, memberships, events and education programs.
• Strengthen visitor trust and brand reputation by demonstrating transparent, responsible handling of families’ personal information.
• Streamline incident response and reporting processes when privacy complaints or suspected data breaches occur.

Who is this for?

• Zoo General Managers
• Visitor Experience Managers
• Membership and Loyalty Program Managers
• IT Managers
• Data Protection Officers
• Marketing and Communications Managers
• Ticketing and Admissions Supervisors
• Events and Education Program Coordinators
• Customer Service Team Leaders
• WHS and Compliance Managers
• Finance and Point-of-Sale Managers
• Third-Party Vendor and Contracts Managers

Included Sections

• 1.0 Purpose and Scope
• 2.0 Definitions and Key Terms (including personal information, sensitive information, data breach)
• 3.0 Applicable Legislation, Standards and Zoo Policies
• 4.0 Roles and Responsibilities (Management, IT, Frontline Staff, Contractors, Third Parties)
• 5.0 Types of Visitor Data Collected (Ticketing, Memberships, Events, Donations, Education Programs, Online Platforms)
• 6.0 Lawful Collection of Visitor Information (Consent, Notice, Children’s Data, Photography and CCTV)
• 7.0 Use, Disclosure and Direct Marketing (Email, SMS, Social Media, Third-Party Platforms)
• 8.0 Data Security Controls (Physical Security, System Access, Passwords, Encryption, Wi‑Fi, POS and Mobile Devices)
• 9.0 Data Handling Procedures for Frontline Staff (Admissions, Retail, Food and Beverage, Encounters and Tours)
• 10.0 Working with Third-Party Providers (Contracts, Due Diligence, Data Sharing and Offshore Storage)
• 11.0 Data Retention, Archiving and Secure Disposal (Digital and Hard Copy Records)
• 12.0 Visitor Rights, Complaints and Requests for Access or Correction
• 13.0 Notifiable Data Breach Identification, Assessment and Reporting Process
• 14.0 Staff Training, Induction and Ongoing Awareness Requirements
• 15.0 Monitoring, Auditing and Continuous Improvement
• 16.0 Document Control, Review and Version History

Legislation & References

• Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs)
• Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth)
• Australian Government – Office of the Australian Information Commissioner (OAIC) guidelines
• AS/NZS ISO/IEC 27001: Information security, cybersecurity and privacy protection – Information security management systems
• AS/NZS ISO/IEC 27002: Information security, cybersecurity and privacy protection – Information security controls
• Spam Act 2003 (Cth)
• Competition and Consumer Act 2010 (Cth) – Australian Consumer Law (misleading or deceptive conduct in relation to privacy representations)
• State and Territory surveillance devices and workplace surveillance legislation (for CCTV and audio recording in public spaces)
• Payment Card Industry Data Security Standard (PCI DSS) – as applicable to card payment processing environments