Privacy and Responsible Information Sharing: Frequently asked questions

No. An individual can make a request under the Freedom of Information Act 1992.

The PRIS Act is used for sharing data between WA government agencies, and with specified organisations that deliver public services or conduct research with a community benefit. Refer to the RIS Toolkit for more information. 

No. Any existing arrangement for information sharing under other legislation will continue to operate as established and will not be affected by the responsible information sharing provisions of the PRIS Act.

Public entities may choose to review their current arrangements to ensure they include adequate protections for personal information.

No. There is no requirement for public entities to update or change existing arrangements to align with the information sharing provisions of the PRIS Act.

The PRIS Act authorises agencies to share data despite any secrecy provisions in other legislation, provided they have met the requirements of the responsible information sharing framework.

This does not apply to any secrecy provisions that are expressly preserved, such as those prescribed in regulations. 

Where data is shared in accordance with the PRIS Act, it is not a breach of any legal obligations, duty of confidentiality, professional ethics or standards.

No. Before establishing an information sharing agreement under the PRIS Act, the parties must complete three assessments. This enables the parties to agree how to appropriately handle and protect the data, throughout the project. Once an agreement is established, it must be registered with the Chief Data Officer for it to come into effect. Refer to the RIS Toolkit for more information. 

No. There are three assessments required when data is shared under the PRIS Act. Agencies are not obligated to conduct assessments when sharing data under other arrangements.

No. An information sharing agreement is used to share data between WA government agencies, or with specified external entities that deliver public services or conduct research with a community benefit. Routine internal data sharing should occur as part of normal business operations, according to agency policies and access protocols.

Yes. Each public entity must designate an Information Sharing Officer under the PRIS Act. Refer to the Chief Data Officer Guideline: The role of information sharing officers for more information. 

From 1 July 2026, you can send or receive an information sharing request, register an information sharing agreement and begin sharing data under the PRIS Act. Planning for a data sharing project or commencing the required assessments, can begin before this time.

Key steps include:

• Mandatory: Designate an Information Sharing Officer 
• Mandatory: Establish a process to receive and respond to requests in 45 days
• Communicate responsibilities to relevant staff
• Maintain an Information Asset Register (IAR) 
• Identify opportunities to share or request data across the WA public sector, for better policy making, service delivery and research with community benefit.
• Join the Responsible Information Sharing Community of Practice.

Refer to the RIS Toolkit for more information.

For specific advice or complex queries, please email data.sharing@dpc.wa.gov.au.

For the public

The Office of the Information Commissioner has published transitional guidance for members of the public: Understanding my privacy rights – when do they commence? 

For public entities and external entities now

As a matter of best practice, a recipient of shared data should notify the provider of a suspected or actual breach, as soon as practicable.

Public entities and external entities are not yet required to report a breach to the Chief Data Officer.

For public entities and external entities from 1 January 2027

The recipient of any data shared under the PRIS Act must notify the data provider as soon as practicable if a breach is suspected.

If a breach is confirmed, the recipient must notify the provider and the Chief Data Officer as soon as practicable. This requirement is in addition to any requirement to notify the Information Commissioner of a breach involving personal information.

Refer to the RIS Toolkit for more information.

The Office of the Information Commissioner provides guidance for privacy management and handling personal information according to the information privacy principles (IPPs) set out in the PRIS Act. 

Guidelines, templates and other resources to support data sharing are published on these webpages by the Office of Digital Government. Refer to the RIS Toolkit for more information.

For specific advice or complex queries, please email data.sharing@dpc.wa.gov.au.