The Office of the Information Commissioner WA (OIC WA) is seeking feedback on its draft privacy guidelines: ‘Do I need to do a PIA?’ and ‘Privacy Threshold Assessment’ template.
The purpose of these guidelines is to assist IPP entities assess whether they are required to conduct a Privacy Impact Assessment (PIA) under the Privacy and Responsible Information Sharing Act 2024 (WA) (PRIS Act). Where an IPP entity is not required to conduct a PIA, these guidelines are designed to assist IPP entities consider whether there is another reason for conducting a PIA.
The OIC WA welcomes comments from interested stakeholders, including IPP entities and members of the public.
The deadline for submissions is 4.00pm on 20 October 2026.
Do I need to do a Privacy Impact Assessment (Consultation Draft)
Background
Show moreThe substantive provisions of the PRIS Act commenced on 1 July 2026.
The PRIS Act requires an IPP entity to undertake a PIA:
- before an IPP entity first performs a high privacy impact function or activity (section 79(2)), or
- when an IPP entity makes a significant change to the way in which personal information is handled as part of a high privacy impact function or activity (section 79(2)), or
- before entering into an information sharing agreement if the activity is likely to have a significant impact on privacy, involves data integration or data linkage or any of the proposed recipients is an external entity (section 176(2)).
A PIA is a tool for identifying, assessing and managing privacy risks of a function or activity involving the handling of personal information. Once these privacy risks are identified, an entity can consider opportunities to improve privacy outcomes and make recommendations to manage, mitigate, prevent or eliminate privacy risks.
Even where a PIA is not required under the PRIS Act, a PIA can assist an IPP entity to understand its privacy risk exposure and identify how it is meeting its obligations under the Information Privacy Principles, particularly in relation to legacy activities that commenced before 1 July 2026.
About the draft guidelines
Show moreThe PRIS Act provides that privacy guidelines may set out the matters to be taken into account in determining whether a function or activity is likely to have a significant impact on the privacy of individuals and, therefore, whether a PIA is required (section 81). These guidelines are intended to satisfy that provision.
These guidelines will form part of a suite of PIA resources the OIC WA intends to release, which will include an introduction to PIAs and guidance on how to conduct a PIA.
Consultation questions
Show moreThe following questions may assist you to provide feedback. These questions are not intended to limit the issues stakeholders may raise in their feedback. You may wish to respond to some, all or none of these questions.
- Are the draft guidelines clear, relevant and practical?
- Do the draft guidelines help IPP entities understand what a high privacy impact function or activity is?
- Are there other factors that may indicate a significant impact on the privacy of individuals that should have been included but weren’t?
- Are there any other topics or issues the draft guidelines should cover, or should cover in greater detail?
- Are the examples provided realistic and do they assist in understanding the content of the guidance? Are there any practical examples you could share to help inform the resource?
- Are there any other ways in which the draft resource could be enhanced?
How to make a submission
Show moreSubmissions can be made by emailing info@oic.wa.gov.au and using the subject line “PIA Consultation”.
The closing date for comments is 4pm on 20 October 2026.
The OIC WA may publish submissions received on this website. If you would prefer your submission to remain confidential, please notify us of this with your submission.
Collection notice
Show moreThe OIC may use the contact details of individuals who provide feedback to clarify or discuss their submissions.
To request access to your personal information the OIC holds please email info@oic.wa.gov.au.
Print this page
