WA Information Commissioner Seeks Feedback on Draft Privacy Impact Assessment Guidelines

With the substantive provisions of the PRIS Act commencing on 1 July 2026, the proposed guidance, Do I Need to Do a PIA?, and accompanying Privacy Threshold Assessment template aim to support organisations in identifying, assessing and managing privacy risks associated with handling personal information.

Under the legislation, Information Privacy Principle (IPP) entities must conduct a PIA before undertaking high privacy impact activities, making significant changes to how personal information is handled in those activities, or entering certain information sharing agreements involving significant privacy risks, data integration or external entities.

The guidelines also encourage organisations to consider conducting PIAs voluntarily, even where they are not legally required, to strengthen privacy practices and identify potential risks in existing systems and processes.

For records and information management (R&IM) professionals, the consultation highlights the growing importance of privacy risk assessments, responsible information sharing and embedding privacy considerations into information governance frameworks.

Consultation closes at 4.00pm AWST on 20 October 2026, with submissions welcomed from public sector organisations, industry stakeholders and the community.

Read more:

OIC WA: Consultation on Draft Privacy Impact Assessment Guidelines

Draft PIA Guidelines | Privacy Threshold Assessment Template

Source: Office of the Information Commissioner Western Australia, updated 29 September 2026.