Evidence Tips

How do I protect customer privacy in an RPL evidence portfolio?

· 5 min read

Real workplace examples can be valuable in a recognition of prior learning (RPL) evidence portfolio. A customer email might show how you handled a complaint; a completed form might demonstrate your technical skills. But those same documents can contain names, contact details, account numbers or sensitive information that the assessor does not need to see.

The aim is to provide enough evidence for the registered training organisation (RTO) to assess your skills without unnecessarily disclosing customer information. Start by asking what the assessor actually needs, then choose the least intrusive way to show it.

Check what you can share before collecting evidence

A document being part of your work does not automatically mean you can copy it into a personal portfolio. Check your employer’s confidentiality policies, client agreements and any directions from your workplace before exporting records or taking screenshots. Depending on the organisation and information involved, privacy laws may also apply. The Office of the Australian Information Commissioner (OAIC) provides information about Australian privacy obligations.

Ask the RTO what evidence is required for the relevant units of competency and whether a de-identified example, workplace observation, supervisor report or professional discussion could meet its assessment requirements. The RTO’s assessor—not an RPL support service—decides whether evidence is sufficient, authentic, current and relevant.

Remove details the assessor does not need

Review each file as though you were the customer named in it. Could someone identify or contact you from what remains? Depending on the record, remove or mask:

Keep the parts that show your contribution: for example, your method, decisions, calculations or communication approach. If removing customer details also removes the context needed for assessment, ask the RTO about another evidence format rather than leaving private information exposed.

Make redactions effective

Covering text with a black rectangle in an editable document may not remove the words underneath. Use a suitable redaction tool that permanently removes the information from the copy you submit, then reopen the exported file and check it. Inspect comments, tracked changes, hidden sheets, document properties, image metadata, filenames, links and QR codes. For screenshots, check browser tabs, notifications and surrounding records too.

Work on an authorised copy, not the workplace’s original record. Do not alter an original in a way that breaches your employer’s recordkeeping requirements. If you are unsure how to prepare a safe copy, request help through an approved workplace process.

Use alternatives when a record is too sensitive

You may not need the customer record itself. Depending on the RTO’s requirements, alternatives could include a blank form annotated to explain your process, a fictionalised example clearly labelled as such, a supervisor’s account of work they directly observed, or an assessor-led discussion. Never present a recreated example as an original customer record. If permission or consent is needed, obtain it through the appropriate workplace process; consent does not replace your obligation to handle the information securely.

For instance, a customer-service applicant could demonstrate complaint-resolution skills with an approved, de-identified case summary that explains the issue, the steps they took and the outcome, without including the customer’s name or contact details. The assessor can advise whether that example needs supporting evidence.

Share and store the portfolio securely

Use the RTO’s approved submission method and check the recipient before sending anything. Avoid public links, shared personal drives or unapproved messaging apps. Use strong account security, including multifactor authentication where available, and restrict access to people who need the files. The Australian Cyber Security Centre provides practical guidance on protecting accounts and information.

Keep only the copies you are authorised to keep. Ask the RTO how it accepts, stores and retains assessment evidence, and follow your employer’s rules for removing working copies from your own devices. If you discover that you have shared identifiable information in error, contact the RTO and your workplace’s privacy or security contact promptly; do not assume deleting your sent copy removes the recipient’s copy.

Before you submit

Protecting privacy is part of preparing credible workplace evidence. If a document feels difficult to share safely, pause and ask about an alternative before uploading it. RPL support can help you organise potential evidence, while the RTO remains responsible for assessment decisions and issuing any qualification or statement of attainment.


RPL evidence portfolio customer privacy

Share this article:

Facebook LinkedIn X

Check Your RPL Eligibility

Find out if your work experience qualifies for RPL. Free check, no obligation.

Start RPL Check
← Back to all articles