Top five things local governments need to know about the pris act

With major privacy reforms commencing on 1 July 2026, Western Australian local governments will very soon be subject to privacy obligations under the Privacy and Responsible Information Sharing Act 2024 (PRIS Act).  We have prepared this fact sheet to assist local governments as they prepare for compliance. Contact our privacy team for assistance. 

The Information Privacy Principles (IPPs) are the base of the framework

From 1 July 2026, local governments will be required to comply with the 11 Information Privacy Principles (IPPs) in Schedule 1 of the PRIS Act.  This will require councils to demonstrate compliance across the entire information lifecycle, including (among other things):

Failure to comply with the IPPs can constitute an interference with privacy, potentially resulting in complaints, investigations and compliance notices.  While many local government practices are grounded in Freedom of Information and State Records frameworks, IPP compliance will require a systematic review of how information is actually handled in practice.

Personal information is intentionally broad and technologically neutral 

The PRIS Act adopts an expansive definition of personal information, extending well beyond traditional identifiers to include online and unique identifiers, location data, behavioural and inferred information, and sensitive information such as health, biometric, genetic and criminal record data. Information does not need to be true or recorded in a formal document to be captured, and the definition also extends to information about deceased individuals.

Records such as maps, CCTV footage, complaints files, ranger data, HR records, community consultation datasets, registrations and databases may all contain personal information - even where such records may not have historically been treated as privacy‑sensitive.

Individual rights are central

The PRIS Act places individual rights at the centre of compliance, giving people practical control over how their personal information is handled.  This includes (among other things) the right to access and correct personal information, to complain to the Information Commissioner about interferences with privacy and seek compensation of up to $75,000.

In practice, regulators are increasingly focused on how these rights operate, not just whether policies exist.  Local governments will need to be able to demonstrate that their procedures genuinely enable individuals to exercise their rights, not merely that the processes are documented.

Contracted Service Providers can create liability for outsourcing local governments

The PRIS Act allows privacy obligations to be passed on to contracted service providers (CSPs) only where a relevant State services contract includes a compliant PRIS‑style clause under section 129.  Where such a clause exists, CSPs are taken to be subject to the Information Privacy Principles and any applicable approved privacy codes of practice in their own right and may be directly exposed to enforcement action.

However, most existing State services contracts were not designed with PRIS in mind.  Without a compliant clause, liability remains with the outsourcing local government, meaning councils may be responsible for non‑compliant acts or practices of their CSPs.  Unless contracts are carefully reviewed and updated, councils may assume risk has been outsourced when it has not.  And a poorly drafted clause can be as risky as no clause at all.

PRIS will sit alongside existing information regimes applying to local governments

A critical point for local governments is that the PRIS Act does not replace existing public‑sector information frameworks.  Instead, it will operate alongside key regimes including the Freedom of Information Act 1992 and State Records Act 2000.  

The PRIS Act adopts a “no wrong door” approach, ensuring that requests for access or correction of personal information are handled appropriately regardless of whether they are framed as FOI or privacy requests. Local governments will need to ensure they have privacy, FOI and records practices that operate seamlessly, and focus on outcomes instead of which regime applies. 

What should local governments be doing now to be ready by 1 July?

To ensure compliance with the impending obligations, local governments should be considering:

• undertaking an IPP gap analysis to identify and prioritise privacy compliance risks before 1 July 2026;
• updating privacy policies, notices and internal procedures to reflect PRIS requirements and regulator expectations;
• aligning privacy governance with existing FOI and State Records practices, consistent with the “no wrong door” approach;
• reviewing and updating State services contracts to ensure PRIS‑compliant clauses properly allocate privacy obligations and liability;
• ensuring systems and staff can effectively manage access, correction and privacy complaint processes.

Contact our privacy team for more information on how the PRIS Act may impact your local government.

This article was written by , Anna Kosterich Restricted Practitioner Corporate Commercial.