WA notifiable information breach scheme (PRIS Act Part 2 Division 6): starts 1 January 2027

Where it stands. The Privacy and Responsible Information Sharing Act 2024 (PRIS Act, No. 51 of 2024) gives the Western Australian public sector a statutory privacy regime. Most privacy obligations, including the Information Privacy Principles, complaints and privacy impact assessments, commenced on 1 July 2026. The notifiable information breach (NIB) provisions in Part 2 Division 6 commence later, on 1 January 2027. Until then reporting is voluntary, although the Office of the Information Commissioner (OIC) welcomes early reports. Once the scheme starts it covers breaches of any personal information an IPP entity holds, whenever it was collected; the OIC's own example is a council hit by a cyberattack in February 2027 that exposes rates records collected years earlier.

What counts (s 57). A notifiable information breach is unauthorised access to, or unauthorised disclosure of, personal information an IPP entity holds where a reasonable person would conclude it is likely to result in serious harm to someone the information is about. Loss also counts where unauthorised access or disclosure is likely to follow and would be likely to cause serious harm. A third limb lets the Information Commissioner make a determination listing extra circumstances that are always notifiable (s 60); a draft must be published for at least 28 days of consultation first. Section 59 lists what to weigh for serious harm: the nature and sensitivity of the information, whether security measures protected it, who has or could get it, how likely they are to intend harm or get around the protections, and the kind of harm that could follow, plus anything in the privacy guidelines.

The clock (s 61). It starts when the entity reasonably suspects a notifiable breach. The entity must immediately take all reasonable steps to contain it; as soon as reasonably practicable, and in any case within 30 days after the day the suspicion is formed, assess whether a notifiable breach has occurred (or there are reasonable grounds to believe it has) and prepare a written report on that assessment; and take all reasonable steps to mitigate harm. The written report is a statutory output, not optional working notes, so build it into the incident runbook. Only the Information Commissioner can extend the 30 days, by written notice, on application in the approved form or on the Commissioner's own initiative (s 70). A refused extension can go to the State Administrative Tribunal. If the assessment confirms the breach, it becomes an 'assessed notifiable information breach' and the notice duties apply.

Notifying the Commissioner (s 62). Written notice in the approved form, as soon as practicable after the determination. The Act lists what it must contain: the entity's contact details; when the breach happened and for how long access or disclosure ran; what happened and how; which limb of s 57 applies; the kinds of personal information; containment and mitigation steps; what affected people should do; any other entity that jointly holds the information; how many people are or are likely to be affected and how many have been notified; and an estimate of the cost of the breach to the entity. If material new information comes to light, send a further notice in the approved form.

Notifying people (s 63). Take all reasonable steps to give each affected individual written notice as soon as practicable, covering the same core facts as the Commissioner notice plus how to make a privacy complaint. If individual notice is not reasonably practicable, publish a written notice and keep it publicly available for at least 12 months.

Exceptions are narrow and must be declared (ss 64–69). An entity may skip individual notice where another entity jointly holding the information has agreed to notify, where a law enforcement agency reasonably believes notice would harm law enforcement functions, where notice would create a serious threat to anyone's life, health, safety or welfare (or any threat because of family violence), or where notice would materially harm the security of personal information or likely lead to further breaches. A conflicting secrecy provision can excuse either notice to the extent of the conflict. Relying on an exception must be stated in the Commissioner notice with reasons and its expected duration, and the information-security exception must be reviewed at least monthly, with the Commissioner told the outcome of each review. The Commissioner can also grant an exemption from either notice (s 70) and can direct an entity it suspects has had a breach to run the assessment (s 71).

Paperwork before the incident (ss 73–75). A public entity must prepare and publish a policy setting out how it will meet the assessment and notification duties. It must keep a register of notifiable breaches recording which s 57 limb applied, whether the Commissioner and individuals were notified (with names of those notified), containment and mitigation steps, prevention actions and estimated cost; assessments that found no notifiable breach are logged too. The register does not have to be published. Entities that produce an annual report must include each assessed notifiable breach whose assessment concluded in the year, without individuals' names.

Contractors (s 134). Where a State services contract contains the privacy clause the Act contemplates, a contracted service provider must contain and assess a suspected breach itself, tell the agency that outsourced the work as soon as practicable after forming the suspicion, and hand over the assessment outcome and report once done. The agency then does the notifications, naming the provider and its containment steps, and the provider must give whatever help the agency needs. Check that cloud, SaaS and managed-service contracts carry this clause and short reporting windows before 1 January.

What to do now. Publish the breach policy, stand up the register with the s 74 fields, and add an 'estimated cost' line to incident tracking because both the notice and the register ask for it. Run a tabletop that ends with a signed written assessment inside 30 days, and decide who can approve notices. Map which systems hold WA personal information and which providers touch it. Check whether any data set or provider also falls under the Commonwealth NDB scheme and, where it does, plan for both notification paths. Cross-links: ndb-clock, nsw-mndb, qld-mndb, serious-harm-test, data-breach-response-plan, third-party-supply-chain.