Western Australia · PRIS Act
Western Australia’s Privacy and Responsible Information Sharing Act 2024 gives the state public sector, including local governments, a privacy law of its own. Parts of it are already in force. Here is the plain-English version, and where to start.
The Act received assent on 6 December 2024. It has two halves: privacy, built on eleven Information Privacy Principles, and responsible sharing of information between public entities.
It is overseen by WA’s Information Commissioner, with a Privacy Deputy Commissioner.
In the Information Commissioner’s words: WA government agencies, departments, statutory authorities, local governments, Ministers, Parliamentary Secretaries, government trading enterprises, and some contracted service providers to government.
Private organisations with annual turnover over $3 million come under the Commonwealth Privacy Act instead, as do some smaller ones, such as health service providers and businesses that trade in personal information. A private business may also be covered by the PRIS Act when it handles information as a contractor to government. See the Australian Privacy Principles.
Dates as published by the WA Office of the Information Commissioner. Check the current timeline and the official guidance.
Who approves a request, on what basis, and how each one is logged.
Contractors that handle personal information on your behalf are covered too. Contracts need to say how they meet the principles.
A new system that handles personal information in a new way may be a high privacy impact activity that needs an assessment first.
If a system uses personal information to make significant decisions about people, Information Privacy Principle 10 applies to information collected from 1 July 2026. You need to assess the impact, evaluate the process from time to time and reassess it when it changes. People must be told that automated decision-making was used, be told on request how it is used, and have a way to ask for a person to step in.
If a board, auditor or the Commissioner asks what you hold and why, the answer has to be on record, not in someone's head.
Footage of identifiable people is personal information. Where it is stored, who can see it and how long it is kept all need an answer.
Where to begin, in order.
Step 1
List the personal information you collect and the systems and contractors that hold it.
Step 2
Identify the activities likely to have a significant impact on privacy. These are the ones that need a privacy impact assessment.
Step 3
Make sure vendors and contractors handling personal information are bound to the same standards.
Step 4
Before 1 January 2027, decide who assesses a breach, who notifies, and test it once.
Step 5
An evidence register: what's needed, what you hold, and what's missing, so you can show the work.
Each engagement is a defined result at one fixed price, with legal questions flagged for your own counsel.
General information only, not legal advice. Your own lawyer confirms how PRIS applies to your organisation.