Strictly, no - any security awareness training program needs at least an email address to deliver a course and track who completed it. What a good program can do is collect far less than most people expect: no passwords from phishing simulations, no personal detail beyond a work email, and results that stay inside the employment relationship.
TL;DR
- Some personal data is unavoidable: an email address is how training reaches staff.
- Credential harvesting is not needed: a simulation can record who clicked and who reported without collecting a single password.
- Australian private-sector employers get an employee-records exemption under section 7B(3) of the Privacy Act 1988 for records directly related to the employment relationship.
- Public-sector employers get no such exemption - the Australian Privacy Principles apply to staff records.
- Data minimisation is a design choice: look for platforms that collect a work email and behavioural results, and nothing else.
Can security awareness training run without collecting personal data?
No platform can deliver a course to nobody. Training has to reach an inbox, so an email address is the minimum. Everything beyond that minimum is optional, and the difference between a well-designed program and a poorly designed one is how much is collected beyond it:
| Data | Needed for training? | Notes |
|---|---|---|
| Work email address | Yes | Delivers courses and identifies learners. |
| Name | Usually | Useful for reporting; many platforms accept a display name instead. |
| Passwords or credentials | No | A phishing simulation only needs to record who clicked and who reported - never what was typed. |
| Phone number | No | Unless you run SMS-based simulations deliberately. |
| Home address, date of birth, ID numbers | No | Never needed for awareness training. |
| Behavioural results (clicks, quiz scores, completion) | Yes | This is the program's output - and the least sensitive data in the system. |
What the law says about staff training data
The Privacy Act 1988 treats staff records differently from customer records. Under section 7B(3), the handling of an employee record by a private-sector employer is exempt from the Privacy Act when it is directly related to the current or former employment relationship (OAIC, Employment). Training completion records, quiz results and simulation outcomes for your own staff generally sit inside that relationship.
Two limits matter:
- The exemption is conditional. It applies to handling directly related to the employment relationship. The Privacy Act applies to an employee record if the information is used for a purpose not directly related to employment - so data repurposed for marketing, sold, or shared outside the HR context can lose the exemption.
- Public sector employers get no exemption. For Australian Government agencies and Norfolk Island administration, the Australian Privacy Principles apply to staff records in full (OAIC, same page). A government agency running awareness training carries the same obligations for staff data as for any other personal information.
The exemption has been under review in Australian privacy reform discussions, so it should be treated as a current state, not a permanent guarantee. Employers who design programs to collect less, rather than relying on an exemption, are exposed to neither risk.
Why data minimisation varies between platforms
Two programs with identical training content can hold very different data:
- Credential harvesting. Some simulation tools capture what a user types on a fake login page. It is unnecessary: knowing who clicked and who reported is everything a program needs. Cyber Aware runs phishing simulations with no credential harvesting - the reporting page shows clicks and reports only.
- Behavioural scores versus profiling. A per-learner risk score built from overdue courses, failed quizzes and phishing clicks is employment-related by design. Scores that mix in data sourced from outside work - personal social media, device data from unmanaged machines - drift beyond it.
- Breach monitoring. Checking work emails against the Have I Been Pwned breach database uses an address the employer already holds, and alerts staff when their address appears in a breach. It adds no new personal data.
- Directory sync. Syncing enrolment from Microsoft 365 or Google Workspace pulls name and email - nothing more is required to run a full program.
Questions to ask a vendor before signing
- Does any simulation capture typed credentials, or only click and report events?
- Where is training data stored, and in which country?
- What exactly does the directory sync copy across?
- Who can see per-learner results, and do learners see their own score only?
- What happens to the data when a staff member leaves - is the record removed with the sync, or retained?
A vendor that answers these in plain terms is one you can put in front of a client's privacy officer. Cyber Aware's awareness training is built around the minimal set: an email, behavioural results, and branded reporting that stays inside the client relationship.
FAQ
Does the employee-records exemption cover phishing simulation results? Results for your own staff, used for HR and risk purposes, are directly related to the employment relationship and generally sit inside the section 7B(3) exemption. Repurposing that data beyond employment loses the exemption - treat it as a boundary, not a licence.
What about job applicants? The exemption covers current and former employees, not applicants. Privacy obligations can apply to information held about unsuccessful applicants.
Can a public-sector agency rely on the exemption? No. For Australian Government employees, the Australian Privacy Principles apply to staff records, including training data.
Do we need consent to run phishing simulations? Simulations with no credential harvesting that auto-enrol clickers into a course are an internal control, not research - but telling staff the program exists and how results are used removes most of the friction. Check your own workplace policy requirements.
Is a per-learner risk score personal data? Yes - it describes an identified individual. It is also exactly the kind of record the employee-records exemption was written for: handling directly related to the employment relationship.
What is the least data a program can run on? A work email address plus behavioural results (completion, quiz scores, click events). Anything else should justify itself.
One last thing
The strongest privacy position is not the exemption - it is a program that would not upset anyone if it were read aloud at a staff meeting. Collect the email, track the clicks, enrol the clickers in a course, delete the record when the person leaves. Every vendor claim should fit inside that sentence.