What should a CRM course teach about customer data?

What the unit asks a learner to know

The register's knowledge evidence for FNSCUS504 asks a learner to set out the features of the systems an organisation uses for collecting and analysing data, and to describe the principles of customer relationship marketing.

The unit's assessment reaches the same ground: its conditions require access to the systems the organisation uses to provide services to customers, alongside financial services product information, common office equipment and consumables, and the organisation's policy and practices.

So the unit reaches customer data twice: as systems for collecting and analysing data that a learner has to be able to outline, and as the organisation's systems for serving customers that assessment must give access to. The law that governs the data itself is the other half of the subject, and it is where this page goes next.

What a course should cover

The OAIC's guidance on the Australian Privacy Principles sets out duties a course on customer data should be able to cover. Three are below, with one piece of security advice from the Australian Signals Directorate.

The quality of the record: an APP entity must take reasonable steps to ensure that the personal information it uses and discloses is, having regard to the purpose of the use or disclosure, accurate, up-to-date, complete and relevant.

Direct marketing: an organisation must not use or disclose personal information for the purpose of direct marketing unless an exception applies, such as where the individual has consented.

Security: an APP entity must take reasonable steps to protect the personal information it holds from misuse, interference and loss, as well as unauthorised access, modification or disclosure.

Access to the record within the team: the principle of least privilege, under which staff have the minimum permissions they need to perform their work, and which the Australian Signals Directorate's advice calls usually the safest approach for most small businesses.

Those are the shapes. The depth on each sits with the regulator: the OAIC's Australian Privacy Principles guidelines are linked at the foot of this page, and its chapter on the quality of personal information is the one that backs the first duty above.

Why this page is short

This page is short on purpose. The duties above bind the organisations the Privacy Act covers: most small businesses, those with an annual turnover of $3 million or less, are not covered, though some are. The regulator's own pages are where the detail belongs: the OAIC sets out each privacy principle in full, and this page links them rather than paraphrasing them at length.

Two near neighbours take the rest: Is my course nationally recognised? How to check reads a course offer, and What should a statement of attainment say? reads the document at the end.