Privacy Policy

KPMG respects your privacy and your right to know how we handle your personal information. KPMG complies with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and where applicable or contractually required - the privacy laws of the various Australian states and territories. This Privacy Policy explains how we handle your personal information.

In this Privacy Policy, ‘KPMG’, ‘we’, ‘us’ and ‘our’ refer to the KPMG Partnership and includes any entity carrying on business in Australia that is part of the KPMG group of entities.

We may need to update this Privacy Policy from time to time to reflect our current privacy practices or changes in the law, regulations and/or professional standards. When we make any changes to this Privacy Policy, we will post the updated policy on our website. 

To the extent of any inconsistency between this Privacy Policy and the terms of a service-specific Privacy Statement or Privacy Consent provided to you (including but not limited to those applying to whistle blower services provided or surveys conducted by KPMG), the terms and stated limitations of those Privacy Statements or Privacy Consents override this Privacy Policy, in respect of how we handle your information collected in connection with those specific-services or surveys.

1. Personal information we collect

We collect different types of personal information depending on the nature of our engagement with you. We may collect your personal information from several different sources including:

• directly from you or your authorised representatives
• when you use our products or services including our online services
• from outside sources and third parties –
  • where you have provided consent
  • where a third party has notified you that they provide your personal information to us,
  • where you would reasonably expect the collection of your personal information and/or
  • where the collection of your personal information is permitted by law.

Examples of personal information we may collect include:

• General identification information such as name, job title, occupation or employer, date of birth, and where necessary - proof of identity documentation.
• Contact details such as address, email address, phone and mobile phone number and Internet Protocol (IP) address.
• Usernames and passwords.
• Educational qualifications, employment history, salary, and background and referee reports.
• Payment details including PAYG Payment Summaries, payslips, and other income earning information, for example payment summaries from your employer and super fund, statements from banks and financial institutions showing interest received, employment termination payment summaries, receipts for gifts, donations and work-related expenses.
• Government-issued identifiers such as tax file numbers and passport or driving license numbers.
• Financial information such as credit card and bank account details, shareholdings and details of investments (e.g. if you have shares, units, managed funds or other investments, details of dividend payments and distributions from managed funds, any investment gains or losses from the disposal of shares, units and rental properties, including associated income and expenditure).
• Details of superannuation and insurance arrangements.
• Visa or work permit status and related information.
• Information about immigration status.
• Information about your directly work-related conduct if you are a KPMG employee or contractor.

It may be necessary in some circumstances for us to collect some forms of sensitive information about you in order to provide specific services to you. Sensitive information includes information about a person’s race, gender diversity, sexual orientation, disability, ethnic origin, political opinions, health, religious or philosophical beliefs and criminal history. We will only collect and use sensitive information with your consent, in accordance with applicable laws or in a de-identified aggregated manner.

You might need to provide personal information about other individuals to us (e.g. about your spouse, dependants or other family members or employees). If so, we rely on you to have informed those individuals that you are giving their personal information to us, to have advised them about this Privacy Policy and how they can obtain a copy of it and that you have the necessary authority to provide that personal information to us.

It is important to be aware that if you access another party’s website or application using one of our products or services or via our website, that other party will deal with your personal information in accordance with its own Privacy Policy. You will need to review those websites to view a copy of the relevant Privacy Policy.

It is generally not practical to remain anonymous or to use a pseudonym when dealing with us as usually we need to use your personal information to provide specific services to you, or which relate to or involve you.

2. Collecting personal information

2.1 Method of collecting personal information

We will collect your personal information from you using direct means where practicable, for example, when we deal with you in person or over the phone, when you send us correspondence (including via email), when you complete a questionnaire, form or survey or when you subscribe to our publications.

We may also collect your personal information indirectly, from public sources - both manually and using KPMG approved AI tools, from third parties and from other outside sources, in circumstances where:

• you would reasonably expect us to collect this information, 
• you have consented to the collection, or
• you have been notified by a third party that your information will be on-disclosed to and collected by us. 

For example, we may collect your personal information from:

• your employer or previous employer, 
• your referees, 
• your personal representatives, 
• another KPMG member firm, 
• a financial advisor, and/or 
• where you have authorised disclosure to us, from banks, 
• public registers,
• social media and networking sites if your posts, activities and/or profile information are public,
• where you have applied for a job or are a current employee - from other persons, such as law enforcement agencies, the Department of Home Affairs, education or other institutions or professional organisations, and with your consent – from background checking service providers. 

We may also collect personal information about you from your use of our websites and social media and information you provide to us through contact mailboxes.

2.2 Collecting personal information in surveys

Where we collect personal information about you as part of a survey, we generally do so for the purposes of preparing a report to our client.

You may choose to remain anonymous when completing surveys. If you do provide your name, we will generally only provide your responses to our client for this engagement at an aggregate level. This means that we will use the combined answers of many people and will present only aggregated information about various demographic groups and individual responses will not be reported. In certain circumstances, some clients may wish to receive the raw data showing individual responses to their survey. In that case, we will only provide your individual response to our client if you have provided explicit permission to do so before commencing the survey.

We may disclose your personal information to our external service providers for purposes of managing the database on which survey responses are stored and to assist with resolving system errors. Otherwise, we will only disclose your personal information to third parties if required by law, or if you consent.

2.3 Collecting information of KPMG staff

If you are a KPMG employee or contractor, you are bound by various internal policies about acceptable conduct and probity: To ensure compliance with those policies, applicable laws and client requirements, we may collect and retain your personal information, including but not limited to information about:

• your use of and access to KPMG owned or managed devices and networks, and premises, 
• your financial information (for the purposes of complying with taxation, superannuation and employment laws and providing assurance regarding the same),
• your personal probity and independence information,
• your compliance with annual professional accreditation and learning requirements,
• your identity and background-check re-verification information, subject to you providing your consent to that collection, and
• your emergency contacts and treating medical practitioners where you have disclosed these details as relevant to your role at KPMG and/or the management of your health and welfare at KPMG. 

3. Holding and protecting personal information

We store information in different ways, including on paper and electronically. In some cases, we engage third parties to host electronic data (including data in relation to the services we provide) on our behalf. Protecting your personal information matters to us, and we take all reasonable steps to secure it and protect it from misuse, corruption, loss, unauthorised access and unauthorised disclosure. The measures we take to protect your information while we hold it or can access it include:

• Security measures to control access to our systems and physical premises
• Ensuring third parties engaged by us comply with our privacy standards, obligations, processes and requirements
• Privacy and confidentiality requirements, obligations and training applying on a mandatory basis to our staff and contractors
• Restricting access to personal information
• Document storage and security policies
• Technological controls such as firewalls, the use of encryption, passwords and digital certificates
• Data retention, de-identification, pseudonymisation, and destruction processes
• Processes and policies governing the identification, mitigation, management and where appropriate the notification of privacy events and breaches.

We endeavour to ensure that personal information is kept as current as possible, and that all reasonable steps are taken to ensure that irrelevant or excessive data is deleted or de-identified as soon as reasonably practicable. However, some personal information may be retained for varying time periods in order to comply with legal, compliance and regulatory obligations, and for other legitimate business reasons.

4. Purpose for collecting, holding, using and disclosing personal information

We will only collect, use, hold and disclose your personal information if we have a permitted or lawful reason to do so, or you have otherwise consented.

The reasons we may collect, hold, use and disclose your personal information include:

• To provide our services to you or to our client in accordance with the terms of any engagement letter, service agreement or employment agreement including any related reasons such as payroll, tax, superannuation and accounting services.
• To provide, improve and properly manage our products and services and those of other KPMG member firms including:
  • developing new products,
  • responding to requests or queries,
  • verifying your identity,
  • to conduct surveys, and
  • seeking your feedback.
• To maintain contact with our clients and other contacts (including alumni), and keep them informed of our services, industry developments, seminars and other events.
• For administrative purposes, including:
  • processing payment transactions,
  • charging and billing,
  • detecting or preventing fraud, and
  • identifying breaches of our terms and conditions of engagement.
• For purposes relating to the employment of our personnel (including Partners), or our Clients’ personnel, contractors and sub-contractors including:
  • recruitment purposes such as pre-employment screening, contacting referees, processing applications, administering psychometric testing, assessment for suitability for future positions, background checks and ongoing analytic purposes such as ensuring we are reaching a diverse range of candidates,
  • ongoing probity checks for existing personnel, including monitoring of the use of KPMG systems, and the use and location of KPMG managed devices, applications and networks,
  • personnel retention purposes such as workplace diversity, wellbeing and cultural safety checks and initiatives,
  • providing internal services or benefits to our Partners and staff, and
  • matters relating to the KPMG Partnership.
• For governance and compliance purposes including:
  • managing any quality, conduct or risk management issues including conflict of interest or independence (including auditor independence) obligations or situations,
  • meeting regulatory obligations, and
  • where we are required to or authorised by legislation or industry code, direction or standard to do so.
• For business purposes such as part of an actual (or proposed) acquisition, disposition, merger or de-merger of a business (including KPMG’s business) or entering into an alliance, joint venture or referral arrangement.
• For development and analytics purposes to develop our expertise and know how, including:
  • for benchmarking purposes,
  • development, analytics and business intelligence functions including website trend and performance analysis.
  • quality assurance and thought leadership, and
  • other purposes related to our business.

We may also use non-personal, de-identified and aggregated information for several purposes including for data analytics, research, submissions, thought leadership and promotional purposes. Any output is anonymised or aggregated so that no personal information or information relating specifically to you is reasonably identifiable.

KPMG may also use your personal information for the purpose of marketing its services to you. This may include products, services and offers provided by our alliance partners. If you do not want to receive marketing material from us, you can contact us as detailed below:

• for electronic communications, you can click on the unsubscribe function in communications,
• for hard copy communications, you can email  unsubscribe@kpmg.com.au, or
• through our contact details in 'How to contact us'.

5. Sharing personal information

We may share your personal information with other parties including:

• Your authorised representatives, advisors and referees,
• Personnel within KPMG and our professional advisors,
• Experts or other third parties contracted as part of an engagement,
• Our agents, third party contractors and suppliers that assist us with providing our business processes and products and services,
• Nominated superannuation funds,
• Other KPMG member firms (which includes entities they wholly or dominantly own and control) or KPMG International Limited and its affiliates,
• Third parties as part of an actual or proposed acquisition, disposition, merger or de-merger of a business (including KPMG’s business) or to enter into an alliance, joint venture or referral arrangement,
• Other parties including government or regulatory bodies (for example, the Australian Taxation Office, the Australian Securities Investment Commission and The Department of Home Affairs), professional or industry bodies or agencies and their auditors, as part of an engagement or as required by or in accordance with any industry code or industry standard including foreign authorities or regulators relevant or applicable for the purposes of our provision of services, or
• Other parties when you ask us to do so or when you consent to that disclosure.

Where you are a customer, an employee, a contractor or supplier of services to one of our clients, then we may disclose your personal information as part of providing services to that client.

We do not disclose personal information to third parties for the purpose of allowing them to send marketing material to you. However, we may share non-personal, de-identified or aggregated information with select third parties for research, development, analytics or promotional purposes other than direct marketing.

In some cases, the organisations that we may disclose your personal information to may be located in other countries, in particular, the United States, Europe, Singapore, UK, India, and those countries in which our member firms are located. For a current list of KPMG offices around the world navigate to the menu located in the top right of the screen, and select the Australia (EN) tab.

Where we do this, we require these parties to substantively comply with the privacy standards, privacy obligations and privacy laws applicable to KPMG, to protect your information and to restrict how your information may be used, transmitted and stored.

6. Visiting our website and online

6.1 Automatic collection of personal information

Together with our service providers we use cookies, web beacons and other technologies on some of our websites and through email to automatically collect certain types of information. The collection of this information allows us to customise and personalise your online experience (including tailoring our online presence) and enhancing your future online experience. We may also use this information for development and analytics purposes. You can tailor your experience with these technologies via the privacy and browser settings on your device or by rejecting the associated cookies.

6.2 Analytics Tools

We use analytics tools, such as Google Analytics and Adobe Analytics. To provide website visitors with more choice on how their data is collected by Google Analytics, Google have developed the Google Analytics Opt-out Browser Add-on. More information about how we use Google Analytics can be found at Google Analytics Terms of Service page. Adobe also provides a range of opt-out options for Adobe Analytics.

6.3 Social media widgets and applications

Some of our websites and services may include functionality to enable information sharing via third party social media applications, such as LinkedIn, X, and the services owned by Meta. These social media applications may collect and use information regarding your use of our websites. Any personal information that you provide via such social media applications may be collected and used by members of that social media application separate to us and are subject to the privacy policies of the relevant companies that provide the applications. We do not have control over, or responsibility for, those companies or their use of your information.

Any personal information that you provide on any KPMG social media feature may be shared with other users of that social media feature (unless otherwise stated at the point of collection), over whom we may have limited or no control.

7. The KPMG member firm network

KPMG is a member firm of the KPMG global organisation of independent member firms affiliated with KPMG International Limited, a private English company limited by guarantee. For a list of where our member firms are located, navigate to the menu located in the top right of the screen, and select the Australia (EN) tab.

8. Children

We understand the importance of protecting the privacy of children, especially in an online environment. In particular, our websites, products and services are not intentionally designed for, or directed at, children under the age of 13.

It is our policy to never knowingly collect or maintain information about any person under the age of 13, except as part of a specific engagement to provide services which necessitates such personal information be collected, for example, for the purposes of ensuring compliance with our auditor independence policies, or as otherwise required by law.

9. Access to personal information

It’s important that you make sure the personal information we hold about you is accurate, up to date and complete. If any of your details change or if you believe that any personal information KPMG has collected about you is inaccurate you can contact us (via  ‘How to contact us’) and we will take reasonable steps to correct it in accordance with the requirements of the Privacy Act.

You can request access to your personal information that we hold about you. To make a request see 'How to contact us' for details. We may charge reasonable costs for providing you access to your personal information.

10. Complaints

You can notify us of any complaint you may have about our handling of your personal information via 'How to contact us'. Following your initial contact, you will be asked to set out the details of your complaint in writing in a form provided.

We will endeavour to reply to you within 30 days of receipt of the completed complaint form and, where appropriate, will advise you of the general reasons for the outcome of the complaint.

While we hope that we will be able to resolve any complaints you may have without needing to involve third parties, if you are not satisfied with the outcome of your complaint, you can refer your complaint to the Office of the Australian Information Commissioner.

11. How to contact us

If you have any questions in relation to this Privacy Policy or our management of your personal information, you can contact our National Privacy Liaison by email at austprivacy@kpmg.com.au or at:

National Privacy Officer
KPMG Australia
GPO Box 2291U
MELBOURNE VIC 3001

A printable version of our Privacy Policy (PDF 90KB) is available on our website, reviewed regularly and updated as necessary. This privacy policy was last updated in September 2025.