Capturing permission before passing contact details

Before passing a person's contact details to a partner, explain the proposed introduction and record what the person requested or agreed to. Then assess the basis for that particular use or disclosure.

Consent can support a secondary disclosure where the Australian Privacy Principles apply, but it is not the only possible basis.

Explain what would move

Name the receiving business, why it would receive the details, what information it needs and the contact it proposes to make. A broad statement that details may be shared with partners is a poor record of a specific introduction.

Keep the transfer small. The recipient may need a name, contact route and question to answer. It may not need a full campaign history or private meeting notes.

Where the Australian Privacy Principles apply, APP 3 addresses what an entity may collect, APP 5 requires reasonable steps concerning notification of collection matters, and APP 6 governs many later uses and disclosures.

A collection notice is not automatically consent to a different purpose. The receiving business should also consider its own collection and notification duties.

Record the person’s choice

For a form, put the introduction choice beside the relevant request. In a conversation, explain the same details before asking.

Keep a record staff can interpret later: the named recipient, described purpose, proposed information, response, date and capture method. If relying on consent under APP 6, record that consent as the basis for the secondary disclosure.

For example, a person might ask Partner A to introduce them to Partner B about a named issue. A records that request and sends only the details needed for B to respond after assessing the transfer. The request does not cover every later use.

A registration, download or business-card exchange is not automatically an instruction to give both partners the person’s details.

Keep later marketing separate

Answering a question and adding someone to a promotional list are different purposes. Describe any proposed marketing by the receiving business separately. If it proposes commercial electronic messages, check the relevant spam requirements.

Assess the basis for passing contact details separately from any marketing preference. Other direct marketing channels may engage different rules.

Hold unclear transfers

Give staff a way to query a missing or inconsistent record. If the person’s intention is uncertain, clarify it through an appropriate existing contact route or ask the other partner for expertise using a suitably non-identifying summary. Do not send the full record merely to test the partner’s interest.

Before release, compare the recipient and fields with the assessed purpose and record the transfer. Limit access to those handling the request. Where APP 11 applies, reasonable security and retention steps also matter.

Reassess a materially different proposed use rather than extending the old record by assumption.

Privacy compliance benchmarks for partner data sharing