Australia’s OAIC Spells Out When a Privacy Impact Assessment Is Needed, Starting With a Threshold Check

Australia’s privacy regulator has published fresh guidance on when government agencies need a privacy impact assessment, and it starts with a smaller step most teams skip: a privacy threshold assessment. The Office of the Australian Information Commissioner (OAIC) set out its expectations in a blog post on privacy impact assessments that also reports on recent inquiries it made with federal agencies, including one about AI deployment in the workplace.

The guidance is aimed at Australian Government agencies, which are legally required to do a written PIA for high privacy risk projects. The OAIC makes clear, though, that it encourages every organization covered by the Privacy Act to consider a PIA when a project may affect privacy. For private companies, that makes the guidance a useful description of what the regulator considers a reasonable process.

The legal requirement for agencies

Under the Privacy (Australian Government Agencies – Governance) APP Code 2017, known as the Australian Government Privacy Code, agencies subject to the Privacy Act 1988 must conduct a written PIA for all high privacy risk projects. The OAIC describes a project as potentially high risk where it involves new or changed ways of handling personal information that are likely to have a significant impact on individuals’ privacy.

For organizations outside government, the link is Australian Privacy Principle 1.2, which requires entities to take reasonable steps to put in place practices, procedures and systems that ensure compliance with the APPs. A PIA, the OAIC says, is one way to show those steps were taken. Our overview of the Australian Privacy Act explains how the APPs apply to businesses.

Start with a threshold assessment

The OAIC recommends a privacy threshold assessment (PTA) as the first step. It is a screening exercise, not a risk analysis.

• It asks whether a project involves new or changed ways of handling personal information.
• It looks for factors suggesting high privacy risk, such as new technology, new systems or services, or significant changes to existing processes.
• It does not measure the actual level of risk. The OAIC describes it as a probe that identifies projects needing further assessment.
• The OAIC publishes a Privacy Threshold Assessment template to guide the process.

If the PTA shows potential for high privacy risk, a full PIA follows.

What a proportionate PIA should cover

The OAIC says not every PIA needs to be long or complex. It should fit the size, complexity and privacy risk of the project and the organization doing it. The guidance lists the core questions a PIA should answer early in a project.

1. Is all the proposed personal information necessary? Data collected “just in case” adds risk without adding value.
2. Who will have access, and for what purposes? Include internal teams and service providers.
3. Will information be shared with other entities or providers? Each disclosure is a point where control can be lost.
4. How will individuals be told about the handling of their information? Notices need to match what actually happens.
5. What safeguards can reduce the likelihood or severity of harm? Think about access controls, retention limits, de-identification and contract terms.

The OAIC adds that a PIA should consider how personal information flows through the project, the possible impacts on people, and options to avoid, minimize or mitigate those impacts. It also suggests consulting stakeholders and checking the project against community expectations, not just the legal minimum. Our piece on the difference between data mapping and a PIA explains why the data flow map usually comes first.

What the OAIC’s inquiries found

The OAIC recently made inquiries with several federal agencies, including a regulator running a research study and a portfolio department deploying AI in the workplace. It wanted to understand how they decided whether a project was high risk and needed a PIA.

The findings were positive. The agencies had considered their obligations under the Government Privacy Code, their duty to comply with the APPs, and the privacy risks of the project along with measures to reduce them. The OAIC found their documentation matched its guidance and tools. Publishing a positive result is still a signal: the regulator is checking whether agencies can show their reasoning, and documentation is what it looked at.

Lessons for private sector teams

• Build a threshold step into project intake. A short screening form at the start of each project catches the ones that need a full assessment. Without it, PIAs tend to happen late or not at all.
• Treat AI deployments as likely high risk. The OAIC chose an AI workplace deployment as one of its inquiry subjects. Our article on AI risk assessments versus PIAs explains how the two overlap.
• Scale the PIA to the project. A two-page assessment for a small change is better than none. A large program needs more.
• Keep the record. A completed assessment shows you asked the questions. It does not prove the controls work. Test them after launch.
• Revisit the PIA when the project changes. New data sources, vendors or uses can change the risk.

Teams that also work under the GDPR can compare approaches with our guide to PIAs versus DPIAs and our explainer on what a DPIA is. For a full method, see our enterprise manual for privacy impact assessments.

Where Captain Compliance fits

Captain Compliance’s assessment and DPIA tools give teams templates to screen projects, record data flows, risks and mitigations, and keep a dated record of decisions. Its data mapping tools help build the information flow picture a PIA depends on. These tools structure the work. They do not decide on their own whether a project is high risk under Australian law, and an assessment on file is not proof that its safeguards are in place.

Frequently asked questions

Are private companies in Australia required to do PIAs?

The Government Privacy Code’s written PIA requirement applies to Australian Government agencies. The OAIC encourages all organizations covered by the Privacy Act to consider PIAs, and APP 1.2 requires reasonable steps to ensure compliance, which a PIA can help show.

What is a privacy threshold assessment?

A short screening exercise that checks whether a project changes how personal information is handled and whether there are signs of high privacy risk. It decides whether a full PIA is needed.

When should a PIA be done?

Early, before key project decisions are made, so the findings can still shape the design.

Does the OAIC provide templates?

Yes. The OAIC publishes a Privacy Threshold Assessment template and a PIA tool.

What did the OAIC find in its recent inquiries?

It found that the agencies it asked had considered their obligations and risks, and that their documentation matched OAIC guidance.

The question at the start

The OAIC’s advice comes down to one question it wants asked at the start of every project: has anyone considered whether a PIA is needed? It sounds simple, and in many organizations nobody asks it until the system is built. A regulator that has started checking agencies’ paperwork is unlikely to stop at agencies forever.