The Privacy and Responsible Information Sharing Act 2024 (WA) does not set a timeframe for IPP entities to respond to privacy complaints. However, when the OIC receives a privacy complaint, the Information Commissioner may decline to deal with a complaint if the IPP entity has not had sufficient time to deal with the complaint or is dealing adequately with the complaint.
The OIC considers that generally 30 calendar days is a sufficient amount of time for an IPP entity to acknowledge, assess and respond to a privacy complaint in writing. However, this timeframe may not be appropriate in all circumstances.
For example, a privacy complaint involving an imminent risk to an individual may require an urgent response. In contrast, a complex privacy complaint, such as one that involves multiple issues or events that occurred over an extended period, may take longer to investigate.
It is important IPP entities manage privacy complaints transparently and responsively. An IPP entity should acknowledge a privacy complaint as soon as practicable. Where an IPP entity is unable to respond to a complaint within 30 days, they should let the complainant know when they might expect a response.
When assessing whether an IPP entity has had sufficient time to deal with the privacy complaint or is dealing adequately with the complaint, the OIC will consider whether the IPP entity is making genuine effort toward resolution.
Print this page
