Privacy and Responsible Information Sharing Act 2024
Privacy and Responsible Information Sharing (Information Sharing) Regulations 2025
Western Australia
Privacy and Responsible Information Sharing (Information Sharing) Regulations 2025
Contents
Part 1 — Preliminary
1.Citation1
2.Commencement1
Part 2 — Privacy and Responsible Information Sharing Advisory Committee
Division 1 — Preliminary
3.Terms used2
Division 2 — Membership
Subdivision 1 — Chairperson and deputy chairperson
4.Chairperson2
5.Deputy chairperson3
Subdivision 2 — Ordinary members
6.When person ceases to be ordinary member3
7.Resignation from office3
8.Removal from office4
9.Remuneration and allowances4
10.Leave of absence4
Division 3 — Meetings and proceedings
11.Holding meetings5
12.Quorum5
13.Presiding member5
14.Attendance by other persons5
15.Remote attendance5
16.Voting6
17.Minutes6
18.Resolution without meeting6
Division 4 — Material personal interests of Committee members
19.Chief Data Officer7
20.Disclosure of material personal interest7
21.Determination of material personal interest7
22.Committee member with material personal interest disqualified from participating8
23.Regulation 22 may be declared inapplicable9
24.Quorum where member cannot participate9
Part 3 — Key concepts
25.Exempt information (Act s. 158)10
26.Handling of information for purpose of prescribed community policing functions (Act s. 159)10
Part 4 — Information sharing agreements
27.Additional matters to be included in information sharing agreements (Act s. 170)12
28.Privacy impact assessments not required to be made publicly available (Act s. 176)12
29.Content of notification of Chief Data Officer13
30.Content of register of information sharing agreements (Act s. 183)14
Part 5 — Authorisations to share information and related matters
31.Secrecy provisions not overridden (Act s. 187)15
32.Safeguards (Act s. 190)15
Part 6 — Miscellaneous
33.Making documents publicly available (Act s. 209)16
34.Giving documents by electronic means16
Part 7 — Transitional provisions
35.Information sharing agreements entered into before relevant Act provisions commence19
36.Information not required to be included in annual report before relevant Act provisions commence19
Notes
Compilation table21
Defined terms
Privacy and Responsible Information Sharing Act 2024
Privacy and Responsible Information Sharing (Information Sharing) Regulations 2025
These regulations come into operation on 1 July 2025.
Part 2 — Privacy and Responsible Information Sharing Advisory Committee
In this Part —
chairperson means the person appointed under regulation 4(1) as chairperson of the Committee;
Committee means the Privacy and Responsible Information Sharing Advisory Committee established under section 204(1) of the Act;
Committee member means a person referred to in section 204(2)(a), (b) or (c) of the Act;
deputy chairperson means the person, if any, appointed under regulation 5(1) as deputy chairperson of the Committee;
meeting means a meeting of the Committee;
ordinary member means a person appointed under section 204(2)(c) of the Act.
Subdivision 1 — Chairperson and deputy chairperson
(1)The Information Sharing Minister must appoint an ordinary member as chairperson of the Committee.
(2)A person who has been appointed as chairperson is eligible for reappointment.
(1)The Information Sharing Minister may appoint an ordinary member (other than the chairperson) as deputy chairperson of the Committee.
(2)A person who has been appointed as deputy chairperson is eligible for reappointment.
(3)If a deputy chairperson has been appointed and the chairperson is unable to act because of sickness, absence or another cause, the deputy chairperson must act in the chairperson’s place.
(4)An act or omission of the deputy chairperson acting in the chairperson’s place cannot be questioned on the ground that the occasion to act in the chairperson’s place had not arisen or had ceased.
Subdivision 2 — Ordinary members
6.When person ceases to be ordinary member
A person ceases to be an ordinary member if the person —
(a)dies; or
(b)resigns under regulation 7; or
(c)is, according to the Interpretation Act 1984 section 13D, a bankrupt or a person whose affairs are under insolvency laws; or
(d)is convicted of an offence punishable by imprisonment for more than 12 months; or
(e)is removed from office by the Information Sharing Minister under regulation 8.
(1)An ordinary member may resign from office by giving written notice to the Information Sharing Minister.
(2)Subject to subregulation (3), the resignation takes effect when the Information Sharing Minister receives the notice.
(3)If the notice specifies that the resignation takes effect on a day that is after the day on which the Information Sharing Minister receives the notice, the resignation takes effect on the specified day.
The Information Sharing Minister may, after consulting with the Privacy Minister, remove an ordinary member from office on any of the following grounds —
(a)neglect of duty;
(b)misconduct or incompetence;
(c)mental or physical incapacity, other than temporary illness, impairing the member’s performance of their duties;
(d)absence, without leave, from 3 consecutive meetings of which the member had notice.
An ordinary member is entitled to be paid any remuneration and allowances determined in relation to that member by the Information Sharing Minister on the recommendation of the Public Sector Commissioner.
(1)The Committee may, on the terms and conditions determined by the Committee, grant an ordinary member leave to be absent from office.
(2)The Information Sharing Minister may, on the terms and conditions determined by the Information Sharing Minister, grant an ordinary member leave to be absent from office.
Division 3 — Meetings and proceedings
(1)The first meeting must be held at a time and place determined by the chairperson.
(2)Subsequent meetings must be held at times and places determined by the Committee.
(3)A special meeting of the Committee may at any time be convened by the chairperson.
(1)If there are 4 or 5 Committee members, the quorum is 3.
(2)If there are 6 or 7 Committee members, the quorum is 4.
(1)The chairperson, if present, must preside at a meeting.
(2)If neither the chairperson nor the deputy chairperson acting in the chairperson’s place is present at a meeting, the Committee members present must elect 1 of their number to preside at the meeting.
14.Attendance by other persons
If the Committee agrees, a person other than a Committee member may be present at a meeting.
(1)Subject to subregulation (2), the presence of a person at a meeting need not be by attendance in person but may be by that person and each other person at the meeting being simultaneously in contact by telephone, audiovisual communication or other means of instantaneous communication.
(2)The Committee may require a person to be present at a meeting in person.
(1)Each Committee member present at a meeting has a deliberative vote unless regulation 22(1)(b) prevents the member from voting.
(2)All questions at a meeting are to be decided by a majority of the votes of the Committee members present.
(3)If the votes are cast in relation to a question and there is an equality of votes, the question is determined in the negative.
The Committee must ensure accurate minutes are kept of the proceedings at a meeting.
(1)A resolution in writing signed or otherwise assented to in writing by a quorum of the Committee, as provided under regulation 12 or 24(1) (whichever applies), has the same effect as if it had been passed at a meeting.
(2)The resolution must be recorded in the minutes of the next meeting.
(3)A resolution cannot be signed or assented to under this regulation at a time when the chairperson is unable to act and there is no deputy chairperson acting in the chairperson’s place under regulation 5(3).
Division 4 — Material personal interests of Committee members
The Chief Data Officer does not have a material personal interest in a matter being considered or about to be considered by the Committee merely because the matter relates to giving advice to the Chief Data Officer in the performance of the Committee’s functions under section 205 of the Act.
20.Disclosure of material personal interest
(1)A Committee member who has a material personal interest in a matter being considered or about to be considered by the Committee must, as soon as possible after the relevant facts have come to the member’s knowledge, disclose the nature of the interest to the Committee.
Penalty for this subregulation: a fine of $1 000.
(2)If the Committee member discloses the interest at a meeting, the Committee must ensure that the disclosure is recorded in the minutes of the meeting.
(3)If the Committee member discloses the interest at a time other than at a meeting, the Committee must ensure that the disclosure is recorded in the minutes of the next meeting.
21.Determination of material personal interest
(1)If a Committee member with a material personal interest in a matter to be considered by the Committee has not disclosed the interest before the Committee considers the matter, the chairperson may, before the matter is considered, call on the member to disclose the interest.
(2)If the Committee member does not disclose the interest when called on to do so, the chairperson may determine that the member has the interest.
(3)If the determination is made at a meeting, the Committee must ensure that the determination is recorded in the minutes of the meeting.
(4)If the determination is made at a time other than at a meeting, the Committee must ensure that the determination is recorded in the minutes of the next meeting.
(5)If the matter is to be considered at a meeting at which a person is presiding under regulation 13(2), the person presiding may perform the functions of the chairperson under subregulations (1) and (2).
22.Committee member with material personal interest disqualified from participating
(1)A Committee member with a material personal interest in a matter being considered or about to be considered by the Committee —
(a)must not be present while the matter is being considered at a meeting; and
(b)must not vote on the matter; and
(c)must not sign or assent to, or be involved in the consideration of, a proposed resolution in respect of the matter under regulation 18.
(2)A reference in subregulation (1)(a) or (b) to the matter includes a reference to a proposed resolution referred to in regulation 23(b) in respect of the matter, whether relating to that Committee member or another Committee member.
(3)A reference in subregulation (1)(c) to a proposed resolution in respect of the matter includes a reference to a proposed resolution referred to in regulation 23(b) in respect of the matter, whether relating to that Committee member or another Committee member.
23.Regulation 22 may be declared inapplicable
Regulation 22 does not apply if —
(a)the Committee member has disclosed the interest under regulation 20(1) or there has been a determination under regulation 21(2) in relation to the interest; and
(b)the Committee has at any time passed a resolution that —
(i)specifies the member, the interest and the matter; and
(ii)states that the Committee members voting for the resolution are satisfied that the interest is so trivial or insignificant as to be unlikely to influence the member’s conduct.
24.Quorum where member cannot participate
(1)If a Committee member is disqualified under regulation 22(1), a quorum is present during the consideration of the matter if at least 3 Committee members who are entitled to vote on any motion that may be moved at the meeting in relation to the matter are present.
(2)Subregulation (1) applies despite regulation 12.
[Heading inserted: SL 2026/132 r. 4.]
25.Exempt information (Act s. 158)
(1)For the purposes of section 158(1)(r) of the Act, information of the following classes is exempt information —
(a)information that is subject to an order under the Corruption, Crime and Misconduct Act 2003 section 114;
(b)information of a kind referred to in the Corruption, Crime and Misconduct Act 2003 section 115;
(c)information of a kind referred to in the Criminal Investigation (Covert Powers) Act 2012 section 75;
(d)information the disclosure of which could reasonably be expected to reveal, or enable to be ascertained, investigative measures or procedures under the Procurement Act 2020 Part 7.
(2)For the purposes of section 158(2)(h) of the Act, the following special information sharing entities are prescribed —
(a)the Electoral Distribution Commissioners referred to in the Electoral Act 1907 section 16B;
(b)the State Solicitor, but only in relation to documents originating with or received by the State Solicitor in connection with functions under the High Risk Serious Offenders Act 2020.
[Regulation 25 inserted: SL 2026/132 r. 4.]
26.Handling of information for purpose of prescribed community policing functions (Act s. 159)
For the purposes of section 159(3)(a) of the Act, information may be handled under an information sharing agreement for a purpose that relates to a community policing function of the Police Force of Western Australia that is undertaken in connection with family violence.
[Regulation 26 inserted: SL 2026/132 r. 4.]
Part 4 — Information sharing agreements
[Heading inserted: SL 2026/132 r. 4.]
27.Additional matters to be included in information sharing agreements (Act s. 170)
(1)For the purposes of section 170(j) of the Act, and without limiting section 170(h) or 171(3)(c) of the Act, an information sharing agreement must —
(a)provide for the destruction, retention or transfer of the disclosed information, and any derived information, by the recipient; and
(b)without limiting paragraph (a), include a requirement for the recipient to provide written notice to the provider if the disclosed information is destroyed.
(2)A requirement included in an information sharing agreement under subregulation (1) must not be inconsistent with —
(a)any applicable duties the recipient has under the State Records Act 2000; or
(b)any applicable duties in relation to the destruction, retention or transfer of information that the recipient has under another written law or a law of the Commonwealth, another State or a Territory.
[Regulation 27 inserted: SL 2026/132 r. 4.]
28.Privacy impact assessments not required to be made publicly available (Act s. 176)
For the purposes of section 176(6)(b) of the Act, a privacy impact assessment report is not required to be made publicly available if —
(a)the Chief Data Officer considers that making the report publicly available would be likely to reveal, or enable to be ascertained —
(i)confidential or commercially sensitive information; or
(ii)information that is exempt matter for the purposes of the Freedom of Information Act 1992 under Schedule 1 clause 1 of that Act; or
(iii)information about weaknesses in security measures protecting personal information that could be used for the purposes of circumventing those measures;
and
(b)a redacted or summary form of the report, approved by the Chief Data Officer, is made publicly available.
[Regulation 28 inserted: SL 2026/132 r. 4.]
29.Content of notification of Chief Data Officer
A written notice under section 182(1) or (2) of the Act of an information sharing agreement or a variation agreement must include —
(a)whether a privacy impact assessment report has been prepared under section 176 of the Act; and
(b)if a privacy impact assessment report has been prepared under section 176 of the Act, the following information about the report —
(i)whether the report is publicly available;
(ii)if it is publicly available — where it is made available;
(iii)if it is not publicly available — the grounds on which it is not required to be made publicly available under section 176(6) of the Act.
[Regulation 29 inserted: SL 2026/132 r. 4.]
30.Content of register of information sharing agreements (Act s. 183)
(1)For the purposes of section 183(2)(f) of the Act, the register must include, in relation to each information sharing agreement that is in force, whether a privacy impact assessment report has been prepared under section 176 of the Act and, if so, whether the report is publicly available.
(2)For the purposes of section 183(3)(b) of the Act, the register is not required to include the information referred to in section 183(2)(c) and (d) of the Act in relation to an information sharing agreement if the Chief Data Officer considers that making that information publicly available would be likely to reveal, or enable to be ascertained —
(a)confidential or commercially sensitive information; or
(b)information that is exempt matter for the purposes of the Freedom of Information Act 1992 under Schedule 1 clause 1 of that Act.
[Regulation 30 inserted: SL 2026/132 r. 4.]
Part 5 — Authorisations to share information and related matters
[Heading inserted: SL 2026/132 r. 4.]
31.Secrecy provisions not overridden (Act s. 187)
For the purposes of section 187(3)(b) of the Act, section 187(1) of the Act does not apply to the following secrecy provisions —
(a)the Contaminated Sites Act 2003 section 96(3);
(b)the Environmental Protection Act 1986 section 120;
(c)the Waste Avoidance and Resource Recovery Act 2007 section 91.
[Regulation 31 inserted: SL 2026/132 r. 4.]
(1)If information is disclosed by a provider to a recipient under an information sharing agreement, the recipient must ensure that the information is designated as having been disclosed under the information sharing agreement.
(2)Subregulation (3) applies if, in accordance with section 172 of the Act, an information sharing agreement provides for a recipient to be permitted to further disclose information it collects under the agreement to another person (the third party) who is not a party to the agreement.
(3)The recipient must, before further disclosing the information, enter into a contract, agreement or other arrangement with the third party under which the third party agrees to collect, hold, manage and use the information in compliance with the applicable provisions of the information sharing agreement.
[Regulation 32 inserted: SL 2026/132 r. 4.]
[Heading inserted: SL 2026/132 r. 4.]
33.Making documents publicly available (Act s. 209)
If a provision of Part 3 of the Act requires or permits the Chief Data Officer to make a document publicly available, the Chief Data Officer must comply with that requirement or exercise that power by —
(a)publishing the document on a website maintained by, or on behalf of, the information sharing Department; and
(b)making a hard copy of the document available for inspection on request during business hours at the principal office of the information sharing Department.
Example for this regulation:
Chief Data Officer guidelines must be made publicly available under section 201(4) of the Act.
[Regulation 33 inserted: SL 2026/132 r. 4.]
34.Giving documents by electronic means
(1)A notice or other document that is required or permitted to be given to the Chief Data Officer under Part 3 of the Act may be given by —
(a)sending it in an electronic form to an email address of the Chief Data Officer specified on a website maintained by, or on behalf of, the information sharing Department for that purpose; or
(b)lodging it in an electronic form using an online system maintained by, or on behalf of, the information sharing Department for that purpose.
(2)A notice or other document that is required or permitted to be given to a person by the Chief Data Officer under Part 3 of the Act may be given by —
(a)if the person has provided an email address for giving documents — sending it in an electronic form to the email address provided by the person; or
(b)making it available to the person in an electronic form using an online system maintained by, or on behalf of, the information sharing Department for that purpose and notifying the person by email sent to an email address provided by the person that it is available.
(3)An information sharing request may be given to the holding entity by sending it in an electronic form to an email address of the holding entity specified on a website maintained by, or on behalf of, the holding entity for that purpose.
(4)A written notice responding to an information sharing request under section 161 of the Act may, if the requesting entity has provided an email address for giving documents, be given to the requesting entity by sending it in an electronic form to the email address provided by the requesting entity.
(5)The notice or other document is taken to be given —
(a)if given under subregulation (1)(a) — at the time it reaches the email address of the Chief Data Officer; or
(b)if given under subregulation (2)(a) — at the time it reaches the email address provided by the person; or
(c)if given under subregulation (1)(b) or (2)(b) — at the time it is lodged or made available in the online system; or
(d)if given under subregulation (3) — at the time it reaches the email address of the holding entity; or
(e)if given under subregulation (4) — at the time it reaches the email address provided by the requesting entity.
(6)This regulation does not limit the application of the Interpretation Act 1984 sections 75 and 76 to the notice or other document.
[Regulation 34 inserted: SL 2026/132 r. 4.]
Part 7 — Transitional provisions
[Heading inserted: SL 2026/132 r. 4.]
35.Information sharing agreements entered into before relevant Act provisions commence
If section 170 of the Act requires a matter relating to a provision of the Act to be included in an information sharing agreement, but the provision has not come into operation when the agreement comes into force —
(a)the matter must still be included in the agreement; but
(b)the agreement has no effect in relation to the matter for the period —
(i)beginning on the day the agreement comes into force under section 178(1) of the Act; and
(ii)ending on the day immediately before the provision comes into operation.
Example for this regulation:
Under section 170(e) of the Act, an information sharing agreement must require each recipient under the agreement to comply with sections 192, 193 and 194(4) of the Act in relation to a shared information breach or suspected shared information breach involving information disclosed under the agreement. An agreement entered into before those sections of the Act come into operation must still include that matter, but will have no effect in relation to that matter until sections 192, 193 and 194(4) of the Act come into operation.
[Regulation 35 inserted: SL 2026/132 r. 4.]
36.Information not required to be included in annual report before relevant Act provisions commence
(1)In this regulation —
annual report means an annual report required under the Financial Management Act 2006 Part 5 in respect of the information sharing Department.
(2)Section 211 of the Act does not require an annual report for a financial year to include any information about a matter relating to a provision of the Act if the provision has not come into operation before the end of that financial year.
Example for this regulation:
The annual report for a financial year is not required to include information about the number of shared information breaches notified to the Chief Data Officer in the financial year if section 193 of the Act has not come into operation before the end of the financial year.
[Regulation 36 inserted: SL 2026/132 r. 4.]
This is a compilation of the Privacy and Responsible Information Sharing (Information Sharing) Regulations 2025 and includes amendments made by other written laws. For provisions that have come into operation see the compilation table.
|
Citation |
Published |
Commencement |
|
Privacy and Responsible Information Sharing (Information Sharing) Regulations 2025 |
SL 2025/118 25 Jun 2025 |
1 Jul 2025 (see r. 2) |
|
Privacy and Responsible Information Sharing (Information Sharing) Amendment Regulations 2026 |
SL 2026/132 24 Jun 2026 |
r. 1 and 2: 24 Jun 2026 (see r. 2(a)); |
[This is a list of terms defined and the provisions where they are defined. The list is not part of the law.]
Defined termProvision(s)
annual report36(1)
chairperson3
Committee3
Committee member3
deputy chairperson3
exempt information25(1)
meeting3
ordinary member3
third party32(2)
© State of Western Australia 2026. This work is licensed under a Creative Commons Attribution 4.0 International Licence (CC BY 4.0). To view relevant information and for a link to a copy of the licence, visit www.legislation.wa.gov.au. Attribute work as: © State of Western Australia 2026. By Authority: ANDREW JONES, Government Printer