Western Australia Act

Privacy and Responsible Information Sharing Act 2024 (WA)

The Privacy and Responsible Information Sharing Act 2024 creates Western Australia's public-sector privacy and information-sharing framework.

In forceWestern AustraliaPlain-English guide4 practical checks

Plain-English explainers, not legal advice. Check the linked official source before you rely on a specific section, and get advice for your situation.

Get legal help

Start here

Quick read

The Privacy and Responsible Information Sharing Act 2024 creates Western Australia's public-sector privacy and responsible information-sharing framework.
For small businesses, the practical impact is strongest when the business works with WA public entities, receives public-sector information, supports data sharing or signs a State...

Likely relevant if

Western Australian businesses contracted by WA government agencies or public entities
Technology, consulting, health, education and community-service providers handling government information
Businesses building data-sharing, analytics, hosting or case-management systems for WA public-sector customers

Check first

Check whether the business is a contracted service provider or recipient under an information sharing arrangement involving a WA public entity.
Identify what personal information, government information or shared information the business will handle.
Build privacy, security, breach notification, authorised-use and audit controls into the services contract and operating procedures.

The small-business angle

This is not a general privacy law for every private business in Western Australia. It is mainly a public-sector privacy and responsible information-sharing framework. The reason it belongs in a small-business library is that many small providers sell into government, support public programs, process applications, host systems or analyse information for WA public entities.

When that happens, the legal obligation often arrives through the contract. The customer may require strict controls for personal information, government information, information-sharing agreements, breach reporting and data security.

Key takeaways

Check the public-sector contract before assuming this is only the agency's issue.
Budget for privacy and security controls when pricing government work.
Treat information-sharing and analytics projects as higher-risk than ordinary admin support.

Before you sign a WA public-sector contract

Sense check

Confirm what information you will collect, receive, host, use or disclose.
Check whether any information-sharing agreement or public-sector guideline applies.
Agree incident reporting steps, including who decides whether a breach is notifiable.
Confirm whether data can be stored outside WA or Australia.
Make subcontractor obligations clear before they touch the data.

Plain-English glossary

IPP entity: An entity covered by the WA information privacy principles. The definition is central to deciding whether the privacy obligations apply.
Contracted service provider: A provider that performs services for a WA public entity under a State services contract and may be brought into privacy and information-handling controls.
Information sharing agreement: A formal arrangement used for responsible information sharing under the WA regime, with controls around purpose, recipients, safeguards and outputs.

Common questions

Does this Act apply to ordinary private-sector customer data?

Usually the first privacy question for private-sector customer data is still the Commonwealth Privacy Act. This WA Act is mainly about public entities, Ministers, Parliamentary Secretaries and contracted service providers to public entities.

Why should a small business care?

Because government customers can pass privacy, responsible information-sharing, security, breach and audit obligations into contracts. A small provider can inherit serious operational duties even if it is not a public entity itself.

Are all parts of the Act fully commenced?

No. The official current compilation shows staged commencement, with some privacy and responsible-sharing provisions still to be proclaimed. Check the current WA legislation page before relying on commencement timing.

How Sprintlaw can help

Update history

Commenced7 June 2026

WA privacy commencement tracked

Western Australia published a commencement proclamation for the Privacy and Responsible Information Sharing Act 2024 on 25 June 2025.

Start here

Quick read

The Privacy and Responsible Information Sharing Act 2024 creates Western Australia's public-sector privacy and responsible information-sharing framework.
For small businesses, the practical impact is strongest when the business works with WA public entities, receives public-sector information, supports data sharing or signs a State...

Likely relevant if

Western Australian businesses contracted by WA government agencies or public entities
Technology, consulting, health, education and community-service providers handling government information
Businesses building data-sharing, analytics, hosting or case-management systems for WA public-sector customers

Check first

Check whether the business is a contracted service provider or recipient under an information sharing arrangement involving a WA public entity.
Identify what personal information, government information or shared information the business will handle.
Build privacy, security, breach notification, authorised-use and audit controls into the services contract and operating procedures.

The small-business angle

Key takeaways

Check the public-sector contract before assuming this is only the agency's issue.
Budget for privacy and security controls when pricing government work.
Treat information-sharing and analytics projects as higher-risk than ordinary admin support.

Before you sign a WA public-sector contract

Sense check

Confirm what information you will collect, receive, host, use or disclose.
Check whether any information-sharing agreement or public-sector guideline applies.
Agree incident reporting steps, including who decides whether a breach is notifiable.
Confirm whether data can be stored outside WA or Australia.
Make subcontractor obligations clear before they touch the data.

Plain-English glossary

IPP entity: An entity covered by the WA information privacy principles. The definition is central to deciding whether the privacy obligations apply.
Contracted service provider: A provider that performs services for a WA public entity under a State services contract and may be brought into privacy and information-handling controls.
Information sharing agreement: A formal arrangement used for responsible information sharing under the WA regime, with controls around purpose, recipients, safeguards and outputs.

Common questions

Does this Act apply to ordinary private-sector customer data?

Why should a small business care?

Are all parts of the Act fully commenced?

Privacy and Responsible Information Sharing Act 2024 (WA)

Start here

The small-business angle

Before you sign a WA public-sector contract

Plain-English glossary

Common questions

Related topics

How Sprintlaw can help

Update history

Privacy and Responsible Information Sharing Act 2024 (WA)

Start here

The small-business angle

Before you sign a WA public-sector contract

Plain-English glossary

Common questions

Related topics

How Sprintlaw can help

Update history