Say a WA agency's contract asks you to handle personal information "in accordance with the PRIS Act", and nobody in the office is sure what that is. It's Western Australia's new public sector privacy law, the Privacy and Responsible Information Sharing Act 2024, and most of its privacy provisions came into force on 1 July 2026. A second stage, a mandatory scheme for reporting serious information breaches, starts on 1 January 2027.
If your business never touches WA government work, the PRIS Act probably doesn't apply to you, and the federal Privacy Act is still the law to watch. But if you supply a WA department, a local council, a public university or a government trading enterprise, and your staff or systems handle personal information as part of that work, read on. The Act can reach you through your contract.
This is general information, not legal advice. Your contract and your lawyer decide what applies to you.
What has started, and when
The PRIS Act received Royal Assent on 6 December 2024. It is switching on in stages:
- 1 July 2025: the Office of the Information Commissioner was set up, with an Information Commissioner, a Privacy Deputy Commissioner and an Information Access Deputy Commissioner. The Commissioner is independent and reports to Parliament. A Chief Data Officer, within the Department of the Premier and Cabinet, oversees government information sharing.
- 1 July 2026: most of the privacy provisions, including the Information Privacy Principles, privacy complaints, privacy codes and the rules for contracted service providers.
- 1 January 2027: the notifiable information breach scheme.
So as of October 2026, the principles are live and the breach scheme is a little over two months away.
Who it applies to
The Act calls the organisations it covers "IPP entities". They include WA government departments, Ministers, statutory authorities, local governments, public universities, government trading enterprises and the WA Police Force.
The part that matters for a private business is that IPP entities also include contracted service providers. A contracted service provider is anyone who provides services to or on behalf of a public entity under a "State services contract", and that includes their subcontractors. The OIC's own list of examples reads like a list of IT services: websites and portals, networks and data centre equipment, managed infrastructure, cloud services and software as a service, plus recruitment, auditing, translation and building security.
How the Act reaches you through the contract
There are two ways it can work, and your contract decides which one you are in.
- The contract includes a "PRIS compliance clause". You must then comply with the PRIS Act yourself when handling personal information under that contract, and the Information Commissioner can take enforcement action against you directly.
- The contract has no such clause. The agency stays accountable under the Act for how you handle the information, and enforcement is against them. The Commissioner can still look at what you did as part of an investigation, and the agency will expect your contract terms on privacy and security to be met.
The Department of Treasury and Finance's standard General Conditions of Contract offer both in clause 25. Even the version without the PRIS clause requires the supplier to help the agency comply and to follow the federal Australian Privacy Principles, whether or not the federal Privacy Act otherwise covers it.
The PRIS Act only applies to information you handle under the State contract. Your other clients' data stays under whatever law already applies to it. The OIC's guidance gives the example of a provider running a security operations centre for both a WA department and a supermarket chain: PRIS applies to the department's logs, not the supermarket's.
The Information Privacy Principles in brief
There are 11 of them. Paraphrasing the OIC's summary:
- Collection: only collect what you need, fairly, and tell people why.
- Use and disclosure: use information for the reason it was collected, with limited exceptions.
- Information quality: keep it accurate and up to date.
- Information security: take reasonable steps to protect it from misuse, loss and unauthorised access, and destroy or de-identify it when it's no longer needed.
- Openness: have a clear, current privacy policy.
- Access and correction: people can ask to see or correct their information. This principle applies to contracted service providers, who must decide within 45 days.
- Unique identifiers: limits on assigning and reusing them.
- Anonymity: let people stay anonymous where that's practical.
- Disclosures outside Australia: don't send personal information overseas unless the recipient is held to similar standards.
- Automated decision-making: assess the risks, tell people, and offer a human review.
- De-identified information: protect it, and don't re-identify it except in limited cases.
If you already run to the federal Australian Privacy Principles, much of this will feel familiar. The OIC points out where WA goes further: collection, use and disclosure must be fair and reasonable even with consent, and there are specific rules for automated decisions, de-identified data and privacy impact assessments.
The breach scheme from 1 January 2027
From that date, an IPP entity must notify the Information Commissioner and affected individuals, as soon as practicable, when personal information is accessed or disclosed without authorisation, or lost in a way that makes that likely, and serious harm is likely to result. Public entities must also publish an information breach policy. The scheme applies to all information held, including information collected years earlier.
If your contract carries a PRIS compliance clause, the breach provisions apply to you too. Either way, expect the contract to require you to tell the agency quickly about any suspected breach. The OIC's advice is that both parties agree up front how they will work together on a suspected breach and who notifies whom.
How this differs from the federal rules
Most private businesses deal with the federal Privacy Act 1988 and its Notifiable Data Breaches scheme, which covers businesses with annual turnover over $3 million plus some smaller ones, such as health providers. Under that scheme you have 30 days to assess a suspected breach, then notify the OAIC and the people affected as soon as practicable. Our article on notifiable data breaches covers it in detail.
The two schemes don't stack neatly. The OIC notes that the federal Privacy Act expressly gives way to state law where information is handled to perform a State services contract (section 7B(5)). So a Perth business can be under the PRIS Act for its WA government work and the federal Act for everything else, with two different regulators. And the OIC's definition of a contracted service provider says nothing about turnover, so the federal $3 million line is no guide to whether PRIS reaches you. The contract is.
What to do now
- Find your State contracts. List every current WA government contract and check clause by clause whether it includes a PRIS compliance clause, and what it says about privacy, security and incident notice.
- Map the personal information. For each contract, write down what personal information you receive or can see, including in logs and backups, where it is stored and who can reach it. Less access is less risk.
- Check where data goes. Note any cloud service or subcontractor that stores or processes it, especially outside Australia (IPP 9), and flow the contract's privacy terms down to your subcontractors.
- Tighten security around it. IPP 4 asks for reasonable steps. Multi-factor sign-in, restricted admin access, patching and monitored logs are a sensible floor, and agencies may ask for evidence of certifications or recent testing.
- Write the breach plan before January. Who decides it's a breach, who tells the agency, how fast, and who keeps the evidence. Agree it with each agency and test it once.
- Plan the end of the contract. Know how you will return or destroy the information when the work finishes.
If you think it already happened
Contain it first and keep the logs. Tell the agency as your contract requires. Report the cyber incident to ASD's ACSC at cyber.gov.au (opens in a new tab) ("Cybercrime" for most businesses, "Cyber security incident" for organisations with 250 or more staff, government and critical infrastructure) or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). Then work out, with the agency and your lawyer, which breach scheme applies.
Where Geidi fits
Geidi is a Perth-based IT provider in Bentley, operating since 2000 and working with organisations of 5 to 1,000 staff. Our cyber security services include a 24/7 security operations centre and security practices aligned to Essential Eight, ISO/IEC 27001 and SMB1001. If you'd like help getting the security and breach response side ready for your WA government work, contact us.
Sources
- Western Australian Legislation: Privacy and Responsible Information Sharing Act 2024 (opens in a new tab)
- Government of Western Australia: Privacy and Responsible Information Sharing (opens in a new tab)
- Government of Western Australia: Stronger privacy and data sharing laws to protect individuals (media statement, 22 July 2025) (opens in a new tab)
- Office of the Information Commissioner WA: Privacy in Western Australia (opens in a new tab)
- Office of the Information Commissioner WA: How PRIS applies to Contracted Service Providers (opens in a new tab)
- Office of the Information Commissioner WA: Information Privacy Principles Summary (opens in a new tab)
- Office of the Information Commissioner WA: Understanding my privacy rights: when do they commence? (opens in a new tab)
- OAIC: Small business (opens in a new tab)
- OAIC: Part 4, Notifiable Data Breach (NDB) Scheme (opens in a new tab)
