The WA Privacy Reset 1 min read

In WA, some projects now need a privacy assessment before they start.

In WA, switching on a new system that touches personal information may now require a formal assessment first. Not after go-live.

WA’s new Act makes Privacy Impact Assessments mandatory in defined circumstances. Where a function or activity involves handling personal information that is likely to have a significant impact on the privacy of individuals, a PIA must be completed before the entity first performs that function. The Information Commissioner can also direct that one be done.

This changes the sequence. A PIA is no longer a nice-to-have attached at the end of a project. For higher-impact activities, it is a precondition to starting. New technology deployments are the obvious trigger: a new case management system, an analytics platform, an AI tool that processes personal information. The report must, at a minimum, assess how likely the activity is to affect privacy and how significant that effect would be.

Guidance on what counts as a significant impact is still developing, so the safe posture is to identify candidate projects early and document the assessment. If you are procuring or building something that touches personal information in WA, ask the PIA question at the design stage. A vendor that can hand you clear answers on data location, access and retention makes the assessment far faster.
This article is part of a short-read series collaboration by Nguma Pty Ltd and Onpoint 365 on Australian Government hiring.
About Nguma

AI interview management and transcription built for Australian Government compliance.

Nguma automates APS interview scribing, Selection Reports, and meeting transcription. Everything processed onshore in Australia. No AI decision-making. Full audit trail for Merit Protection review. 51% Indigenous-owned.

Learn about Nguma →