From July 1, 2026, Western Australia’s privacy landscape will shift significantly, with the Privacy and Responsible Information Sharing Act 2024 (WA) (PRIS Act) coming into force.
For businesses working with government, the changes mean tighter obligations and greater transparency around how personal information is collected and shared.
A modern framework for privacy and data sharing
The PRIS Act establishes a comprehensive framework governing how personal information is collected, used, disclosed and managed, while also enabling more effective information sharing across Government.
At the centre of the Act are 11 Information Privacy Principles (IPPs), which apply across the entire information lifecycle, from collection through to use, disclosure, storage and disposal.
Oversight of the regime will sit with:
- The Office of the Information Commissioner WA, including the Information Commissioner and supporting commissioners, and
- The Chief Data Officer
Together, these bodies will guide implementation, manage complaints and monitor compliance.
Related reading
Privacy and data protection policy templates
Who needs to pay attention?
The Act applies primarily to WA public sector entities, including local governments and universities.
However, its reach extends further.
Private sector organisations that provide services to government, including subcontractors, may also be captured where contracts require compliance with the IPPs.
For affected businesses, this is not just a compliance exercise. It may require:
- Reviewing contracts with government
- Assessing how personal information is handled across operations
- Ensuring downstream suppliers meet the same standards
- Notably, the PRIS Act does not include an employee records exemption, meaning employment-related data may also fall within scope
What information is covered?
The definition of personal information is broad and includes identifiers such as names, dates of birth and financial details.
It also captures sensitive information, such as health data, political views, union membership and criminal history.
Importantly, the Act extends to the personal information of deceased individuals, marking a departure from Commonwealth privacy settings.
Transparency and accountability take centre stage
A core obligation under the PRIS Act is greater transparency around how information is handled.
Organisations subject to the Act must maintain a clear, accessible privacy policy outlining:
- What information is collected
- How it is used and disclosed
- Why it is collected
These policies must be written in plain language, kept up to date and readily accessible, reflecting a broader shift toward user‑centred privacy practices.
At the same time, collection notices will become a critical compliance tool, requiring entities to clearly inform individuals how their data will be used at the point of collection.
Balancing privacy with responsible data sharing
While the Act strengthens privacy protections, it also introduces a formal framework for responsible information sharing.
Under the new rules, information can be shared in defined circumstances, including for:
- Government policy and program delivery
- Research with a clear public benefit
- Emergency management
A key part of responsible information sharing under the PRIS Act is that an IPP entity must identify whether any information to be disclosed is ‘sensitive Aboriginal family history information’ or ‘sensitive Aboriginal traditional information’ prior to entering an information sharing agreement. If this information is identified, those Indigenous stakeholders must provide their consent for the sharing of that information.
Penalties and enforcement
The PRIS Act introduces meaningful enforcement mechanisms, including:
Complaints to the Information Commissioner
- Potential compensation of up to $75,000 for individuals
- Fines of up to $60,000 for failure to comply with regulatory notices
For businesses, this reinforces the need to treat privacy as a governance issue, not just a legal obligation.
What this means for business
While the Act is primarily focused on government, its impact will be felt across the private sector, particularly for businesses working with public agencies.
Key priorities include:
- Ensuring privacy policies are current and accessible
- Using clear collection notices at every point of data capture
- Limiting use and disclosure of information to legitimate purposes
- Strengthening data security practices
- Reviewing contractor and supplier arrangements
Business Law WA can prepare privacy policies, collection notices or otherwise advise you on how to meet your obligations under the PRIS IPPs. There are also privacy and collection notice templates available for purchase at Legal Guides and Toolkits. Please contact [email protected] or call 08 9365 7560 to discuss further.
This article is authorised by Business Law WA, an incorporated legal practice and wholly owned subsidiary of CCIWA. The content of this article is general in nature and is not legal or professional advice and should not be relied upon as such.
