Product Overview

Summary: This GDPR Compliance for Customer Data SOP provides a clear, step-by-step framework for how Australian organisations should collect, store, use and share customer data in line with EU GDPR expectations and local privacy laws. It helps your team handle personal information consistently, reduce legal and reputational risk, and demonstrate robust data governance to international clients and partners.

Many Australian businesses now serve customers, subscribers or website visitors located in the European Union, bringing the EU General Data Protection Regulation (GDPR) into scope alongside the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Without a clear and practical procedure, staff can easily mishandle consent, data access requests or data sharing with third parties, exposing the organisation to contractual penalties, regulatory action overseas and serious reputational damage. This SOP translates complex GDPR requirements into practical, task-based instructions tailored for Australian operations.

The GDPR Compliance for Customer Data Standard Operating Procedure sets out exactly how your organisation will identify GDPR-covered data, capture and record consent, manage privacy notices, process data subject rights (such as access, rectification and erasure) and respond to potential data breaches. It clarifies responsibilities across marketing, IT, customer service and management, and aligns GDPR expectations with existing Australian privacy and information security practices. By implementing this SOP, you create a defensible, auditable and repeatable approach to customer data handling that supports international growth while maintaining trust with your customers and partners.

This document is designed for real-world use: it focuses on who does what, when and how, with clear workflows for handling customer data throughout its lifecycle—from initial collection and profiling through to secure deletion or anonymisation. It is especially valuable for Australian organisations that rely on cloud platforms, marketing automation tools, or offshore service providers, ensuring that data transfers, vendor arrangements and system configurations support GDPR-aligned privacy-by-design and privacy-by-default principles.

Key Benefits

• Ensure consistent, GDPR-aligned handling of customer data across marketing, IT, customer service and management teams.
• Reduce legal, contractual and reputational risk when dealing with EU-based customers, subscribers or website visitors.
• Demonstrate robust data governance and privacy practices to enterprise clients, regulators and business partners.
• Streamline the management of data subject rights requests, including access, correction, deletion and restriction of processing.
• Align EU GDPR expectations with Australian Privacy Act 1988 and APP obligations for a coherent, organisation-wide privacy framework.

Who is this for?

• Privacy Officers
• Data Protection Officers (DPOs)
• Chief Information Security Officers (CISOs)
• IT Managers
• Marketing Managers
• Customer Service Managers
• Compliance and Risk Managers
• Legal Counsel (In-house)
• Product Managers
• HR Managers handling EU employee data
• Business Owners dealing with EU-based customers
• Information Governance Managers

Included Sections

• 1.0 Purpose and Scope
• 2.0 Definitions and Key Terms (GDPR vs Australian Privacy Act)
• 3.0 Roles and Responsibilities (Management, DPO/Privacy Officer, IT, Marketing, Customer Service)
• 4.0 Determining GDPR Applicability to the Organisation
• 5.0 Lawful Bases for Processing and Consent Management
• 6.0 Privacy Notices and Transparency Requirements
• 7.0 Customer Data Collection Procedures (Online and Offline)
• 8.0 Data Minimisation, Retention and Disposal Rules
• 9.0 Managing Data Subject Rights (Access, Rectification, Erasure, Restriction, Portability, Objection)
• 10.0 Data Sharing with Third Parties and Data Processing Agreements
• 11.0 International Data Transfers and Use of Cloud or Overseas Service Providers
• 12.0 Data Security Controls and Access Management (in alignment with ISO 27001)
• 13.0 Privacy by Design and Default in New Systems and Projects
• 14.0 Data Breach Identification, Escalation and Notification (GDPR and NDB Scheme)
• 15.0 Record Keeping, Audit Trails and Evidence of Compliance
• 16.0 Training, Awareness and Ongoing Monitoring
• 17.0 Document Control, Review and Continuous Improvement

Legislation & References

• Privacy Act 1988 (Cth)
• Australian Privacy Principles (APPs)
• EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) – applied to Australian entities with EU data subjects
• Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth)
• AS/NZS ISO/IEC 27001: Information security, cybersecurity and privacy protection – Information security management systems
• AS ISO/IEC 27701: Security techniques – Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management
• OAIC Guidelines on Australian Privacy Principles