The legal framework around privacy in Australia is complex and differs between states. Many Acts regulate the collection, use, disclosure and handling of private data. Principles to follow around sensitive data include the management of personal information in an open and transparent way, only collecting necessary information, and adequate de-identification of data when possible. There are also many ethical considerations around the management and sharing of sensitive data. Informed consent by research participants is essential for the collection, use and sharing of sensitive data. Storage, access, de-identification and plans for sharing are very important considerations.