Many Australian businesses are already required to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) and maintain a privacy policy explaining how they collect, use and protect personal information. But recent changes in Western Australia, and further reforms coming later this year, mean now is the time to review whether your privacy documents and data practices are up to date.
The core privacy provisions of WA’s Privacy and Responsible Information Sharing Act 2024 (PRIS Act) came into effect on July 1, 2026, introducing new requirements for government agencies and some private businesses that provide services to government.
Further changes are also on the horizon. From December 10, 2026, new federal privacy requirements relating to automated decision-making will require organisations to be more transparent about how personal information is used in technology and AI-driven systems that help make decisions about individuals.
For businesses, the message is simple: if you haven’t reviewed your privacy policy, collection notices or data handling practices recently, now is the time.
The changes will affect different businesses in different ways.
Businesses covered by the Privacy Act must maintain a clear and up-to-date privacy policy explaining how they collect, use, store and disclose personal information. This includes businesses with annual turnover above $3 million, as well as certain other businesses regardless of turnover.
Businesses that provide services to Government should also pay close attention to the PRIS Act.
This may include contractors and subcontractors delivering government services. Depending on the arrangement, these businesses may need to meet additional privacy obligations beyond those that apply under the federal Privacy Act.
The PRIS Act introduces a new State-based privacy framework governing how personal information is collected, used, disclosed, stored and managed.
For businesses working with Government, this may affect:
Privacy compliance is no longer simply about having a policy on your website. Businesses need to ensure their day-to-day practices align with what their privacy documents say.
A privacy policy should clearly explain:
Collection notices are equally important. These notices explain how personal information will be used when it is collected and help businesses meet transparency requirements.
If your privacy policy says one thing but your business does another, that can create significant compliance risks.
Many businesses are increasingly relying on AI and automated tools to help make decisions about customers, employees and service delivery.
From December 10, 2026, new privacy requirements relating to automated decision-making will come into effect.
These changes could apply to tools used for customer onboarding, recruitment screening, fraud detection, risk scoring, credit assessments and service prioritisation.
Businesses should start asking:
Automated decision-making is no longer just an IT issue. It is increasingly becoming a privacy and governance issue.
With privacy obligations continuing to evolve, businesses should:
Business Law WA has prepared practical privacy templates to help businesses review and update their privacy documentation, including Privacy Act and PRIS Act privacy policies and collection notices.
The templates are written in plain English, customisable and designed to help businesses meet their privacy obligations with confidence.
Not sure if your current privacy policy is fit for purpose?
Business Law WA is offering a free Red Flag Review of existing privacy policies to help identify potential gaps and compliance risks.
To arrange a review, contact BusinessLawWA@cciwa.com or call 08 9365 7560.
Written By Cass Wright – Legal Director, Business Law WA
CCIWA, Business Law WA and REEFWA has taken all reasonable care in preparing this document. The contents of this document do not constitute legal advice and should not be relied upon as such. Specific advice for your situation should be sought from CCIWA, Business Law WA or a professional adviser before any action is taken. Neither REEFWA, CCIWA nor Business Law WA accept responsibility for any claim that arises from any person acting or refraining from acting on the information contained in this document.
“REEFWA are an exceptional corporate body that provides real time advice, advocacy and detailed information on all industrial relations matters pertaining to our industry. They operate with professionalism and personal service. Beneficially for you, they have a broad range of highly experienced personnel that work in the industry and offer years of knowledge.”
Friday 13 November 2026 | 9:00am – 5:30pm AWST |Aloft Perth, 27 Rowe Avenue, The Springs. RIVERVALE WA 6103
Various Dates Available, Use the link below to find out more
Various Dates and Topics, Click the link below to learn what is coming up.
