The Privacy Act covers "personal information". If you're using personal information in your business, whether in the cloud or not, you need to comply with the Privacy Act.
Even if their name doesn't appear, it could be personal information. The question is whether there's a reasonable chance that someone could be identified from the information. Also, it does not need to be "secret" or "sensitive" - it just needs to be about them.
Information about your business practices or policies, your trade secrets, and aggregated statistical information that cannot identify individual people will not usually be personal information. It may be confidential or commercially sensitive, so you may still want to protect it. Some aspects of this guide may give you an idea about how to get there. But the Privacy Act isn't relevant.
