monday.com & the Australian Privacy Act

The Australian Privacy Act 1988 (Cth) (Privacy Act), incorporating the Australian Privacy Principles (APPs), form the backbone of data protection in Australia. Following the passage of the Privacy and Other Legislation Amendment Act 2024, Australia has entered a new era of privacy enforcement, modernizing protections for the digital age.

What steps has monday.com taken to support compliance with the requirements of the Privacy Act?

At monday.com, we regularly monitor and review our practices to support compliance with the Privacy Act, including:

• Data Residency: We operate a dedicated data region in Australia (Sydney). Our dedicated Sydney data region allows Customers in regulated industries to maintain their Customer Data within national borders, supporting compliance with the APPs and industry-specific regulations.
• Notifiable Data Breaches (NDB): We have procedures in place, including an ‘eligible data breach’ assessment process, to assess and notify (where relevant) of eligible data breaches, in compliance with the NDB scheme. Our agreements with Customers clarify roles and responsibilities around such notification, where necessary.

• International Transfers: We ensure that personal information remains protected when transferred overseas, including by ensuring that receiving entities are bound by contractual undertakings to comply with the APPs and to keep personal information safe.
• Global certifications: We undergo annual external audits for SOC 2 Type II security certification from the American Institute of Certified Public Accountants (AICPA), ISO 27001 ISMS (information security management system) and ISO 27018 (for protecting personal data in the cloud).
• Transparency: We ensure transparency around the collection, use and disclosure of personal data through easily accessible notices, including via our Privacy Policy and Job Candidate Privacy Notice.
• Legal and contractual controls: We have robust agreements in place to ensure the protection of Customer personal information. We have similar agreements in place with our third-party vendors that process personal information on our behalf.
• Privacy support: We have internal as well as external dedicated privacy teams for monitoring and ensuring that personal information processed by monday.com is protected. 

If you have any questions concerning monday.com’s privacy program, please feel free to contact our Data Protection Officer and privacy team at [email protected].