Published on Thursday, 29 October 2026 at 2:24:34 PM
Western Australia’s new privacy framework brings clearer expectations for how personal information is managed. For local governments and the contractors who support them, understanding these requirements is an important step towards protecting data and maintaining public trust.
Local governments manage significant amounts of personal information, from rates and property records to community service enquiries and employee details. Protecting this information requires more than a privacy policy. It relies on the right processes, secure systems and clear controls over who can access and share data.
The Privacy and Responsible Information Sharing Act 2024 (PRIS Act) introduces a new framework for privacy and information sharing across WA’s public sector. Its 11 Information Privacy Principles (IPPs) set expectations for how personal information is collected, used, stored, shared and protected.
The privacy provisions commenced on 1 July 2026. The Act applies to local governments and certain contracted service providers, depending on the nature of their arrangements and the services they deliver.
Understanding the 11 Information Privacy Principles
The 11 principles cover the full lifecycle of personal information from the moment it is collected to how it is eventually disposed of. Rather than treating privacy as a single security measure, they establish a broader expectation that information must be managed responsibly at every stage.
Here is what each principle addresses:
- Collection: Only collect personal information when doing so is fair, lawful and necessary. For information collected from 1 July 2026, organisations must also meet the applicable collection notice requirements.
- Use and disclosure: Use information for the purpose it was collected for, unless an authorised secondary purpose or another permitted basis applies.
- Information quality: Take reasonable steps to ensure personal information is accurate, complete and up to date.
- Security and destruction: Protect information against misuse, loss and unauthorised access, and destroy or de-identify it when it is no longer needed, subject to applicable recordkeeping requirements.
- Openness and transparency: Maintain and publish clear information about how personal information is managed.
- Access and correction: Provide applicable pathways for people to access and correct their personal information. Where the 45-day statutory timeframe applies, requests must be decided within that period.
- Unique identifiers: Restrict the adoption or assignment of government-related identifiers, subject to the rules and exceptions in the Act.
- Anonymity: Offer anonymous or pseudonymous ways of interacting where this is lawful and practicable.
- Disclosures outside Australia: Apply safeguards when personal information is disclosed to recipients outside Australia.
- Automated decision-making: Where the principle applies, assess the risks of automated processes making or materially influencing significant decisions about people, explain the use of those processes and provide a way to request human intervention.
- De-identified information: Take reasonable steps to protect de-identified information against misuse, unauthorised access and attempts to work out who the information relates to.
Some requirements apply specifically to information collected from 1 July 2026, while others apply more broadly. The Act also contains exceptions, so organisations should refer to the official guidance to understand how each principle applies to their circumstances.
What does this mean for local governments and contractors?
Local governments need to understand what personal information they hold, where it is stored, who can access it and how it is shared with other organisations.
These responsibilities can also extend into the supply chain. Certain contractors and subcontractors delivering government services may have direct obligations under the PRIS Act, alongside their contractual responsibilities. Organisations should review their specific arrangements rather than assume the same requirements apply to every supplier.
Practical priorities include:
- Reviewing data and access controls: Confirming that staff have access only to the information and systems required for their roles.
- Strengthening information security: Reviewing authentication, permissions, endpoint protection, backups and monitoring arrangements.
- Understanding third-party risks: Checking how software vendors, managed service providers and other contractors access and handle council information.
- Reviewing information retention: Ensuring records are retained and securely disposed of in line with privacy and recordkeeping obligations.
- Preparing for privacy requests and incidents: Establishing clear responsibilities and response processes so requests and potential breaches are handled appropriately.
- Assessing new technology: Considering privacy implications before introducing new cloud platforms, AI tools or automated workflows.
The objective is to make privacy part of everyday operations, rather than something addressed only when a problem occurs.
How Integrated ICT can help
At Integrated ICT, we understand that managing information securely is an ongoing responsibility, not a one-off project.
The PRIS Principles provide an opportunity for organisations to review how their technology supports their wider information management and security practices. For local governments and businesses, that review can help identify gaps, prioritise improvements and build a more resilient IT environment.
Depending on an organisation’s needs, Integrated ICT can support this work through services such as:
- Cybersecurity: Implementing and reviewing data control tools that help guide pris act alignment, automatic sensitivity labelling and encryption of sensitive data
- Managed IT support: Maintaining systems, managing access and permissions, and helping address technical issues before they become larger problems.
- Microsoft 365 and cloud solutions: Supporting secure configuration, identity management, collaboration and information-sharing practices.
- Infrastructure and systems management: Helping you understand where your data is currently sitting, where it should be sitting and steps to take on achieving aligned outcomes.
- Technology planning and consultancy: Working with organisations to understand their current environment, identify potential risks and plan practical improvements.
Making privacy part of business as usual
The PRIS Act is an important step in the evolution of privacy and responsible information sharing in Western Australia. Its principles reflect a broader expectation that governing bodies and organisations should understand the information they hold, protect it appropriately and be transparent about how it is used.
That means knowing where data lives, controlling who can access it, reviewing the tools used to process it and making sure security measures keep pace with changing risks. With the right combination of processes, people and technology, organisations can build stronger information management practices that support both compliance and community confidence.
Need help reviewing your IT environment? Integrated ICT can help you understand your technology needs and identify practical ways to strengthen your systems, security and information management. Get in touch with our team to discuss your IT environment and the next steps for your organisation.
Back to All News