About

How we use and manage data

At the heart of the CDC’s role is sophisticated analysis of data. Experts will analyse information from across jurisdictions and sectors to detect early signals and patterns, and prepare for emerging health risks. Stringent laws protect the privacy of information about Australians and their health.

Why we need data

High quality, trusted information – not just numbers, but all kinds of evidence – helps us protect people from health threats, local and international, small and large.

At the heart of this is expert analysis by epidemiologists, data scientists and public health professionals to:

  • detect early signals
  • identify patterns
  • forecast emerging risks. 

Data helps us: 

  • better understand diseases and the impact of control measures
  • better prepare for national health emergencies
  • respond more quickly and effectively to disease outbreaks
  • track health outcomes and trends over time.  

Our data use principles

How we use, share and disclose data is tightly controlled in the Australian Centre for Disease Control Act 2025 and consistent with the Privacy Act 1988, to ensure the privacy of individuals is protected.

Across the complete data lifecycle, we: 

  • communicate clearly – we are transparent about how we use and manage data
  • engage meaningfully – we involve communities and organisations
  • manage risk – we make every effort to ensure people’s data is secure.

Collect

We draw on a wide range of sources of information, such as: 

  • the Australian Government
  • state and territory governments
  • non-government organisations.

We:

  • access only the data we need to fulfil our legislated functions
  • are transparent about the data we use and where it comes from
  • restrict in-house access so that only staff who need the data can view it, and only if they maintain appropriate training and security clearance levels
  • are open about any limitations in the data.

Data directions

We obtain most of our data through routine sharing arrangements and voluntary cooperation with partners. 

But our Director-General can issue a formal direction to a person or organisation to provide information for public health purposes.

Data directions are used only in exceptional circumstances, and only when:

  • the information cannot be sourced otherwise and is needed to inform the Director-General’s advice on a public health threat
  • the Advisory Council has been consulted.

The legislation limits the circumstances in which direction can be issued and to whom.

We publish these formal directions in a Data Direction Register to be transparent about when this power is used and why. 

Prepare

To protect people’s privacy, organisations that are accredited to work with sensitive data will prepare the data for us, including removing personal information. 

This might include the:

We: 

  • follow privacy laws and other laws that regulate the use of personal data, to ensure it is kept secure and confidential
  • use existing, agreed and recognised data definitions to avoid bias
  • work to fairly represent all groups, including culturally and linguistically diverse communities
  • separate access to identifying information from access to the integrated data (functional separation) to protect privacy
  • consider the strategic, privacy, security, ethical and operational risks of data sharing or release, in line with the Five Safes Framework.

Store

We keep information secure and work to prevent data breaches to protect the privacy of individuals, in line with the Privacy Act 1988 and Australian Privacy Principles.

We: 

Share

We have strict controls over data sharing and comply with data sharing legislation. We share public health data with approved public health entities to support public health activities.

We:

  • are transparent about the data we share and who we share it with
  • comply with multiple standards and frameworks to keep data safe
  • make sure our staff are qualified to use data
  • take action against unauthorised use of data.

Use

We use the data we access to inform public health advice, ensuring our advice is inclusive of all people in Australia.

We: 

  • link data from multiple sources for a comprehensive view
  • ensure any advice or data we publish complies with legislation and frameworks
  • facilitate data access to Aboriginal and Torres Strait Island communities for public health purposes.
  • publish our advice within 30 days, unless exempt
  • promote health equity by ensuring our advice does not result in stigma or stereotypes.

Archive or destroy

We archive or destroy data appropriately, in line with data custody guidelines, policies and processes, and consistent with the Archives Act 1983.

Last updated: