Commissioner may direct an agency to give a privacy impact assessment
(1) If: (a) an agency proposes to engage in an activity or function involving the handling of personal information about individuals; and (b) the Commissioner considers that the activity or function might have a significant impact on the privacy of individuals; the Commissioner may, in writing, direct the agency to give the Commissioner, within a specified period, a privacy impact assessment about the activity or function. (2) A direction under subsection (1) is not a legislative instrument. Privacy impact assessment (3) A privacy impact assessment is a written assessment of an activity or function that: (a) identifies the impact that the activity or function might have on the privacy of individuals; and (b) sets out recommendations for managing, minimising or eliminating that impact. (4) Subsection (3) does not limit the matters that the privacy impact assessment may deal with. (5) A privacy impact assessment is not a legislative instrument. Failure to comply with a direction (6) If an agency does not comply with a direction under subsection (1), the Commissioner must advise both of the following of the failure: (a) the Minister; (b) if another Minister is responsible for the agency—that other Minister. Review (7) Before the fifth anniversary of the commencement of this section, the Minister must cause a review to be undertaken of whether this section should apply in relation to organisations.
Sourced from the Federal Register of Legislation at 17 May 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au. Verify the current text against the official source before relying on it.
BriefBridge searches Australian caselaw by meaning — every answer cited to the paragraph.
Try BriefBridge free