Privacy impact assessments
Privacy impact assessments for Australian organisations
A privacy impact assessment (PIA) shows how a project will handle personal information, where the privacy risks are and what you will do about them. We run practical, defensible PIAs for government agencies, health and aged care providers, not-for-profits and businesses.
Why organisations call us
New system
Before a platform, AI tool or data sharing goes live
Required
For high privacy risk projects in Australian Government agencies
Evidence
For regulators, auditors, boards and clients
What a PIA is, and when you need one
A PIA is a systematic assessment of a project that identifies its impact on the privacy of individuals and sets out recommendations for managing, minimising or eliminating that impact. Done early, it shapes the design. Done late, it becomes a list of expensive fixes.
Australian Government agencies
The Australian Government Agencies Privacy Code requires agencies to conduct a PIA for every high privacy risk project: a new or changed way of handling personal information that is likely to have a significant impact on privacy. The OAIC also strongly encourages agencies to carry out PIAs as a matter of course.
Businesses, not-for-profits and other organisations
The Privacy Act does not mandate PIAs for most organisations, but APP 1 requires reasonable steps to comply with the APPs, and a PIA is one of the clearest ways to show you took them. Government clients, funders and enterprise customers increasingly ask for one before they sign.
Signs a project needs a PIA
- collecting new kinds of personal or sensitive information
- a new system, vendor or cloud platform handling customer, client or staff data
- AI, automated decisions, profiling or data matching
- sharing data with partners, government or overseas providers
- surveillance, tracking or biometric technology
- combining datasets or reusing data for a new purpose
How we run a PIA
Threshold assessment
A short check to confirm whether a full PIA is warranted and how deep it needs to go. Agencies can use it as the record for lower-risk projects.
Scope and plan
We agree the project boundary, stakeholders, timing and which privacy principles apply: the APPs, a state scheme such as the Queensland Privacy Principles, or GDPR where relevant.
Map the information flows
Workshops with the people who run the process to trace personal information from collection to disposal, including vendors and systems.
Analyse against each principle
An APP-by-APP analysis covering collection, notice, use and disclosure, cross-border transfers, security, retention, access and correction.
Recommend and agree treatments
Prioritised, practical recommendations with owners, so risk is reduced rather than just recorded.
Report and follow up
A clear report and executive summary, a risk register you can track, and a check-in to confirm actions were taken.
What you get
- threshold assessment and PIA plan
- data flow maps for the project
- APP-by-APP (or state principle) analysis
- risk register with treatments and owners
- recommendations written for the people who will act on them
- executive summary ready for your board, funder or client
- PIA register entry for agencies
Recent work: aged care
We helped a leading aged care provider map how resident information moved across departments and completed a privacy impact analysis against the Australian Privacy Principles. Workshops with each department surfaced gaps in information protection and inconsistent handling, and the provider received data flow diagrams, APP recommendations, policy updates and a set of quick wins to reduce high-risk exposures.
Frequently asked questions
Who can do a privacy impact assessment in Australia?
Anyone with the right knowledge can prepare a PIA, and many organisations do them in-house. An external assessor adds independence and experience across many projects, which regulators, boards and clients often value. Our assessments are led by senior consultants, not handed to juniors.
Is a PIA mandatory for private companies?
Generally no, but it is strong evidence of the reasonable steps APP 1 requires, and contracts with government and large organisations often require one. For Australian Government agencies, PIAs are mandatory for high privacy risk projects.
What is the difference between a PIA and a DPIA?
A data protection impact assessment (DPIA) is the GDPR equivalent and is mandatory in the EU and UK for high-risk processing. If you operate in both regimes we can run one assessment that covers both.
How long does a PIA take?
It depends on the size of the project and how much is already documented. We agree scope and timing after the threshold assessment so you know the commitment before the full PIA starts.
Do you assess AI and automated decision-making?
Yes. We include the new APP 1.7 to 1.9 tests for automated decisions and the AI risks that sit alongside privacy, such as accuracy, bias and transparency. See our automated decision-making guide.
Can you help after the PIA?
Yes. We can implement the recommendations, update policies and notices, or provide ongoing support as a fractional privacy officer.
Source: OAIC, When do agencies need to conduct a privacy impact assessment? This page is general information, not legal advice.
Start with a 45-minute governance health check
A conversation, not a proposal. We will tell you where your real exposure sits and what to fix first, whether or not you engage us.