Reviewing access to sensitive absence information

Start with a field-by-field permission map. Separate absence dates from reasons, medical detail and supporting documents: a calendar may need dates, while health information in a document calls for more restricted access.

Record view, change and export permissions separately for each role. Use these defaults as a starting point, then grant only the access each role needs.

Employee — view their own dates, reasons and supporting documents, but not another person’s record. Limit changes and exports to their own information and only where needed.

Direct manager — view absence dates for scheduling. Do not grant access to reasons or supporting documents, or permission to change or export those sensitive fields, unless a specific need is established.

Payroll — view the absence dates needed for its role. Do not grant access to reasons or supporting documents by default; keep change and export permissions separate and limited to what is needed.

HR administrator — view or change dates, reasons and supporting documents only where required for the role. Restrict exports containing sensitive detail to authorised needs.

Vendor support — grant no standing access to absence details. If support needs access, limit it to the minimum fields and duration required, and record the access.

Health information is included in the Privacy Act 1988 (Cth) definition of sensitive information. The Australian Privacy Principles (APPs) are the Privacy Act’s privacy framework; the OAIC says the 13 APPs cover collection, use and disclosure, governance and accountability, information integrity and correction, and individuals’ access rights.

The OAIC identifies an employee records exemption. Privacy treatment depends on who holds the record and why, so check whether the exemption applies to the particular record rather than assuming all absence information is exempt.

For organisations covered by the Privacy Act, the APPs provide the legal anchor for reviewing how personal information is handled. Treat medical detail as sensitive information, not as an ordinary date field, and do not let broad access exceed the role’s need.

Test an account for every role, including someone who has moved teams and someone whose access has been removed. Check notifications, downloaded reports and integrations as well as the main screen.

Review available access logs for viewing, changes and exports. Name an owner and set a recurring review date; the review should also check whether roles or data flows have changed.

Assess contracted HR service providers as part of the data-flow review, including where records are held or processed. If a manager needs only absence dates for scheduling, do not grant access to a reason field merely because the product groups fields together.

Key Compliance Facts: Sensitive Absence Information in Australia