Report into preliminary inquiries of Qantas - OAIC

The Australian privacy regulator just finished investigating how Qantas contact centre agents use their CRM — and the findings are worth paying attention to even if you've never booked a Qantas flight.

The core issue: agents were accessing customer data through a CRM platform as part of their daily work, and the question was whether that access was appropriate, controlled, and traceable. The regulator wanted to know exactly who could see what, and why.

Here's what this means if you're running ops at a mid-market company: your CRM isn't just a sales tool anymore. It's a data governance document. If your current setup can't tell you which team members accessed which customer records, when, and for what reason — you have exposure. Not theoretical exposure. The kind that shows up in regulatory inquiries and board conversations.

Most off-the-shelf CRMs give you user logins and call it access control. That's not the same as auditability. And most consultants who set those systems up weren't thinking about this problem — they were thinking about pipeline stages.

You don't have to become a compliance expert. But you do need a CRM that was built with this stuff in mind from the start, not bolted on after a regulator comes knocking.

#CRM #DataPrivacy #SalesOps #CustomerData #PrivacyCompliance

Original Source

... customer relationship management platform used by Qantas contact centre agents (CRM Platform). ... CRM Platform as part of performing their daily role.