Data subject rights policy
How requests to see, correct, export, or delete personal data are handled under the Australian Privacy Principles and GDPR-equivalent rights — including the sensitive edge cases a wellbeing platform must get right.
What this policy commits us to
- Requests route through the institution as data controller; First Six acts on the institution's instruction.
- Acknowledge within 5 business days, complete within 30 days, extendable once with notice.
- Access and portability are fulfilled with a machine-readable export, today assembled by hand; self-serve export tooling and a request register are named deliverables, and the response times above are targets rather than codified commitments.
- One documented carve-out: append-only audit-log snapshots persist, disclosed rather than hidden.
- A deceased student's records are never silently auto-purged, because the institution may need them for duty-of-care or coronial processes. They are held pending the institution's instruction; the legal-hold mechanism and an agreed handling procedure are both still to be built.
Controls mapped to this policy
Mapping controls to the policy is how we check adherence. A green dot marks a control that is operating and traceable to evidence; an amber dot marks one that is documented and scheduled but has not run yet.
Standards mappings
Through its controls, this policy maps to the following standards and frameworks. Each entry states our real relationship with the standard.
ISO/IEC 27001:2022InfoSec complianceSelf-assessed
A full 93-control Annex A Statement of Applicability is maintained and honestly dispositioned, and the ISMS went live on 26 July 2026 with its first completed management review. Not certified: no external audit has occurred, the clause 9.2 internal audit is openly unmet, and the certification trigger (a named tender, funding, or first hire) was formally decided at the first management review.
- A.8.10Information deletion
Australian Privacy Act 1988 (APPs, incl. the NDB scheme)PrivacyApplicable law
The primary legal regime. APP 8 drives the residency objective and every disclosed cross-border flow, APP 11 drives retention and erasure, and the Notifiable Data Breaches scheme's assessment clock is built into the incident runbook with OAIC contacts documented. The privacy policy, terms, and DPA template are counsel-reviewed and approved.
- APP 11.2Destruction and de-identification
GDPR (EU General Data Protection Regulation)PrivacyApplicable law
Applies via international students. The 72-hour breach path is in the incident runbook, Article 28 processor terms sit in the counsel-approved DPA, Article 17 erasure maps to the student's own hard-delete cascade (with the audit-trail carve-out disclosed rather than hidden), and Article 22-equivalent disclosure covers automated crisis detection.
- Art. 17Right to erasure
Request access and we can share the full policy set, assessment reports, and completed questionnaires under NDA — or answer your security questionnaire directly.