WA’s New Privacy Regime: What It Means If You Contract to Government

Western Australia’s Privacy and Responsible Information Sharing Act 2024 (WA) largely commenced on 1 July 2026, introducing 11 Information Privacy Principles for the state’s public sector, and for the contracted service providers whose contracts pick the Act up. Mandatory breach notification follows from 1 January 2027. If your business delivers services to WA government agencies, both your contracts and your privacy framework need review now.

State-based privacy reform tends to get less attention than federal changes, but for anyone contracting to government, it can matter just as much because the obligations often flow through to service providers by contract, not just by statute.

What Changed on 1 July 2026

WA’s PRIS Act introduces the state’s first comprehensive privacy framework for its public sector, built around 11 Information Privacy Principles governing how personal information is collected, used, stored, and disclosed. It also creates a framework for responsible information sharing between agencies. Commencement makes WA the seventh Australian state or territory to legislate its own public sector privacy regime, following New South Wales, Victoria, Queensland, Tasmania, the ACT and the Northern Territory, and leaves South Australia as the only jurisdiction still relying on an administrative instruction rather than a statute.

Does the Act reach information you already hold? Yes.  One point that is easy to miss: the principles do not all apply to the same body of data. The collection rules apply only to personal information collected on or after commencement, but the use and disclosure rules apply to personal information held whenever it was collected. Information already sitting in your systems is therefore in scope from day one. Readers familiar with the Commonwealth Australian Privacy Principles should also resist mapping the two schemes across too quickly: the WA principles track the Victorian model more closely than the APPs.

The mandatory serious data breach notification scheme has a staged start and takes effect from 1 January 2027, a shorter runway than it may first appear, particularly for organisations that need to update incident response processes to match a new statutory scheme.

The mechanics differ from the federal scheme in a way that matters operationally. A contracted service provider that reasonably suspects a notifiable breach involving information held under its State services contract notifies the contracting agency (not the Information Commissioner directly) as soon as practicable, and provides its assessment to that agency. If your existing incident response plan routes straight to the OAIC, it will not work here. Nor should contractors bank on a soft landing. Given how much lead time the sector has had since the Act passed in 2024, commentary on the regime has questioned whether the Commissioner will extend the informal grace period regulators sometimes allow when a new scheme starts. Enforcement is available from commencement.

Why Contractors Get Caught, and How

The PRIS Act does not apply to private businesses at large. Much like the other regimes, a contractor is drawn in as an “IPP entity” where it is a party to a State services contract (or a subcontractor under one), and that contract obliges it to comply with the Act. In practice this means the operative question is not whether the legislation applies to you, but what your contract says. Agencies pass the obligations down the supply chain, and the clause doing that work is where your exposure is set. A firm delivering services to a WA agency should expect its existing contracts to be reviewed (or renewed) with new privacy clauses reflecting the PRIS Act, and should not wait for the agency to raise it first.

Beyond direct government-to-business (G2B) contracts, the business-to-business (B2B) agreements we have reviewed since comparable regimes commenced show the same pattern: the obligation almost never arrives through the front door. It arrives as a flow-down clause in a head contract that a mining services or engineering subcontractor signs without registering what it has picked up, or in a managed services agreement that carries the IPPs into every agency system the provider touches. The party two levels down the chain is often the one actually holding the personal information, and the one least likely to have read the schedule that binds it.

Key terms, defined

Flow-down clause: a term in a head contract that passes the head contractor’s obligations down to subcontractors, so they must meet them too.

State services contract: a contract under which services are provided to a WA public sector agency. Being a party, or a subcontractor, to one is what can bring the Act into play.

IPP entity: a contractor or subcontractor that a State services contract obliges to comply with the Information Privacy Principles. 

Action Items Before January 2027

Work through this checklist before mandatory notification starts on 1 January 2027: 

• Review current and pending contracts with public sector agencies for privacy and information-sharing clauses.
• Map your data handling practices against the 11 Information Privacy Principles.
• Build or update a breach response plan that will satisfy the incoming mandatory notification requirements.
• Check your own subcontracts. Subcontractors under a State services contract can be caught too, so obligations you accept need to flow down.
• If your WA contract predates 1 July 2026, check the transitional provisions before assuming you are outside the regime: the Act deals expressly with State services contracts entered into before commencement day.
• Confirm your incident response plan escalates to the contracting agency, not straight to the OAIC.
• Flag the January 2027 deadline internally now, rather than treating 1 July 2026 as the only compliance date.

If you would rather not run this in-house, a fractional General Counsel can review the contracts, map your practices against the principles, and build a compliant breach response plan.

Frequently Asked Questions

Does the WA PRIS Act apply to private businesses?

No. It applies to WA public sector agencies and to contractors or subcontractors that a State services contract obliges to comply. Whether you are caught depends on what your contract says, not on the size or sector of your business.

Does the Act cover personal information collected before 1 July 2026?

Partly. The collection principles apply only to information collected on or after 1 July 2026, but the use and disclosure principles apply to personal information you already hold, whenever it was collected. Existing records are in scope from commencement.

Who does a contractor notify about a suspected data breach?

A contracted service provider that reasonably suspects a notifiable breach involving information held under its State services contract notifies the contracting agency as soon as practicable and provides its assessment. It does not report directly to the OAIC.

When does mandatory breach notification start in WA?

The serious data breach notification scheme has a staged start and takes effect from 1 January 2027. Enforcement of the wider Act is available from commencement on 1 July 2026.

How do privacy obligations reach subcontractors?

Through flow-down clauses. A head contract with a WA agency passes the Information Privacy Principles down the supply chain, so a subcontractor can be bound even though it never contracts with the agency directly.

Related reading: The OAIC’s First Compliance Sweep: What It’s Actually Checking · What “Reasonable Steps” Actually Means: The Qantas Lesson for Every Board

Disclaimer

This article is general information only and is not legal advice. It summarises publicly available information about Western Australian privacy legislation, drawn from the Privacy and Responsible Information Sharing Act 2024 (WA) and guidance published by the WA Office of the Information Commissioner, and does not constitute a complete statement of the Act’s requirements. Obtain advice specific to your contractual and operational circumstances before acting.

Sources: Government of Western Australia, Privacy and Responsible Information Sharing, https://www.wa.gov.au/government/privacy-and-responsible-information-sharing; WA Office of the Information Commissioner, Privacy in Western Australia, https://www.wa.gov.au/organisation/office-of-the-information-commissioner/privacy-western-australia.