Before 1 January 2027, WA public sector bodies should have a tested breach response plan that sets out how a suspected breach is escalated, assessed and, where required, notified to the Information Commissioner and affected individuals. They should also name decision makers, review supplier contracts, and run an executive exercise. [1]
Most PRIS Act provisions, including the Information Privacy Principles, commenced on 1 July 2026, and the mandatory serious data breach notification scheme follows on 1 January 2027 [1]. This article explains what changes and what bodies typically put in place before that date. It is general information, not legal advice.
What starts on 1 January 2027
The Office of the Information Commissioner (WA) states that the mandatory serious data breach notification scheme starts on 1 January 2027. It requires bodies to assess breaches and to notify the Information Commissioner and affected individuals where required [1].
The Privacy and Responsible Information Sharing Act 2024 (WA) (PRIS Act) is commencing in stages. Administrative setup began on 1 July 2025. The core privacy obligations commenced on 1 July 2026, including the 11 Information Privacy Principles (IPPs), privacy codes, privacy impact assessments, complaint mechanisms and information-sharing rules. The mandatory notifiable information breach scheme is the final stage, on 1 January 2027 [1].
The scheme covers WA public sector agencies, local governments, universities, government trading enterprises, statutory authorities and contracted service providers. Contractors are expected to notify the contracting public entity immediately if they become aware of a breach, so supplier arrangements matter as much as internal processes.
The trigger is unauthorised access to, disclosure of, or loss of personal information that is likely to result in serious harm. Where that threshold is met, the entity must assess promptly and notify the Commissioner and affected individuals as soon as practicable. A notice to individuals should describe the incident, the types of information involved, the steps taken to mitigate harm, recommended protective actions for individuals and contact details. Confirm the exact wording and thresholds against the Act and the Office of the Information Commissioner's guidance, and take legal advice for your situation.
The Information Privacy Principles are already in force [1]. That matters for breach readiness. A breach is often the moment a gap in how personal information is collected, stored or shared becomes visible, so the principles and the notification scheme work together. Rules on use and disclosure apply to all records a body holds, while collection notices and some other principles apply to information collected on or after 1 July 2026.
What good looks like on day one of the scheme
The outcome most executives want is simple: if a breach happens in January, the right people know within hours, the assessment is documented, and the notification decision is defensible and made on time. That protects public trust, which is the asset a public body cannot easily rebuild.
The practical shift is from handling an incident as an IT or communications problem to treating it as a decision with a legal clock attached. Someone must decide whether a breach is likely to cause serious harm, who is told, and when. Those decisions need an owner before the day they are needed.
In practice, a body that is ready can answer these questions without hesitation:
- Who can declare a suspected breach, and how does a staff member report one?
- Who assesses whether it is likely to result in serious harm, and against what criteria?
- Who decides on notification, and who is their deputy?
- Who drafts and approves the notice to the Information Commissioner and to individuals?
- Where is the decision recorded?
If any of these produce different answers from different people, that is the gap to close before 1 January.
Step 1: Check what you already have
Start with a review of existing incident, cyber and privacy plans. Many public bodies have a technical incident response plan but no plan for the privacy side: assessing harm to individuals, deciding on notification and communicating with affected people.
Ask some plain questions. Does the plan define what counts as a suspected breach? Does it say who escalates to the executive? Does it assume a single team, when a real breach pulls in IT, legal, communications, records and the privacy officer at once? Is the person named as the contact still in the role?
It also helps to check any cyber insurance requirements, since insurers often expect early notice and may restrict who can be engaged to respond.
Step 2: Set up assessment and decision making
The new scheme requires breaches to be assessed [1]. That means the body needs a repeatable way to work out what happened, what information was involved, who is affected and whether serious harm is likely. A one-page assessment template and a decision log go a long way.
Roles matter more than documents. Name a response team, give each person a deputy, and keep a contact tree that works out of hours. Agree in advance who has authority to make the notification call so that it does not wait on a meeting.
Prepare notice templates ahead of time, one for the Information Commissioner and one for affected individuals, built around the content the Act expects: what happened, what information was involved, what has been done, what individuals can do to protect themselves, and who to contact. Drafting under pressure is slow and error prone.
Queensland offers a useful comparison. Under its reforms, councils now assess suspected data breaches, notify the OIC and affected individuals of eligible breaches, and keep a breach register and a data breach policy [4]. That is a Queensland scheme, not a WA one, but WA bodies may find the same kinds of artefacts useful. Keeping a register and a decision log of every assessment, including those that end in a decision not to notify, is sensible either way.
Step 3: Look at your suppliers and shared data
Public bodies rely heavily on contractors, cloud providers and shared service arrangements. Under the PRIS Act, contractors are expected to notify the contracting public entity immediately. A breach at a supplier can still be a breach your body has to deal with, and you cannot assess what you do not know about.
Review the notification clauses in key supplier contracts. Does the supplier have to tell you promptly? Within what time? Will they give you the details you need to assess the breach? If not, note it for the next renewal or raise it now.
The same principle has applied in other regimes. Under CPS 230, legacy contracts had to meet requirements including audit access, business continuity, exit planning and notification by the earlier of their next renewal or 1 July 2026 [3]. That is a financial services rule, not a WA one, but it shows how regulators expect notification terms to flow down into contracts.
Step 4: Know what information you hold
You cannot judge the seriousness of a breach quickly if you do not know what was in the affected system. Bodies without an information inventory often spend the first days of an incident just working out what was exposed.
A basic register of key systems, the personal information each holds and who owns each one makes the first hours far more productive. It does not need to cover everything before January. Start with the systems that hold the most sensitive information about the most people.
This is where common challenges show up. Is there an information inventory? Is there a data governance framework that says who owns what? Is an accidental privacy officer carrying this alongside another job? Naming these early helps decide where to put limited effort.
Step 5: Test the plan with the people who will use it
A plan that has never been tested tends to fail on the first real breach, because the gaps only appear under pressure. A facilitated executive tabletop exercise walks leaders through a realistic scenario with timed developments and forces the real decisions: do we notify, who tells the Commissioner, what do we say to the public, who speaks to the media.
The cost of getting this wrong has been demonstrated elsewhere. In a federal case, the Federal Court ordered $5.8m in penalties against Australian Clinical Labs, including $800k for inadequate breach assessment and $800k for failing to notify promptly [2]. The case was under the federal Privacy Act, not the PRIS Act, but it shows that slow assessment and slow notification are each penalised separately [2].
The lesson for a WA body is to design the assessment and notification steps into the plan and rehearse them, rather than relying on memory on the day.
A suggested timeline to 1 January 2027
Working back from the start date, a sensible sequence is:
- Now: confirm who owns breach response and review existing plans and key supplier clauses.
- November: draft the plan, playbooks, roles, contact tree, decision log and notification templates.
- Early to mid December: run an executive tabletop exercise, record what did not work and fix the plan.
- Before 1 January 2027: brief staff on how to report a suspected breach.
This is tight but achievable if the work starts now. Waiting until December leaves no room to act on what the exercise reveals.
A fixed-scope first step
TFIQ's Data breach response plan & tabletop exercise takes 4 weeks. It starts with a review of current arrangements, including existing incident and breach plans, cyber insurance requirements and notification clauses in key supplier contracts, and interviews with up to 6 leads across IT, legal, communications, privacy and the executive to test how a breach would really be escalated.
You receive a breach response plan, playbooks for ransomware and extortion, lost device, misdirected email and supplier breach, a roles and contact tree with a decision log template, notification templates, a tabletop exercise pack and an after-action report. TFIQ facilitates a half-day executive exercise and updates the plan from what it finds.
The service is built around the OAIC contain, assess, notify and review steps. For a WA body, the plan and templates are adapted to the PRIS Act requirements and checked with the body's own legal advisers, because the service does not include legal advice on notification decisions. It also does not include live incident response, forensic investigation or technical cyber recovery plans.
If you are not sure where to begin, a Data maturity snapshot (1 to 2 weeks) gives a short read on governance, security and records, with the five things to fix first.
Frequently asked questions
When does the WA serious data breach notification scheme start?
The mandatory serious data breach notification scheme starts on 1 January 2027. Most other PRIS Act provisions, including the Information Privacy Principles, commenced on 1 July 2026 [1].
Who must be notified under the scheme?
The OIC states that bodies must assess breaches and notify the Information Commissioner and affected individuals where required [1]. Notice is expected where unauthorised access, disclosure or loss is likely to result in serious harm. Confirm against official guidance and legal advice.
Do we need a breach register?
An Information Breach Register is explicitly required by law under the Privacy and Responsible Information Sharing Act 2024 (WA). However, whether your organisation is legally mandated to maintain one by statute, or by contract, depends on your exact entity type. Queensland councils must keep a breach register and a data breach policy under their scheme [6]. Keeping a breach register and decision log of each assessment is sensible either way.
Is a tabletop exercise necessary?
It is not described as mandatory in the sources here, but it is the usual way to find gaps before a real breach. Federal penalties for slow assessment and slow notification show the risk of untested plans [3].
Does a supplier breach count?
A supplier breach can affect information your body is responsible for. Contractors are expected to notify the contracting public entity immediately. Review notification clauses in key contracts and seek legal advice on your obligations.
Can TFIQ run our response if a breach happens?
Yes. Our service builds and tests the plan, and can include live incident response, forensic investigation and provide legal advice (through our trusted 3rd party legal firm) on notification decisions and actions.
Book the 4-week Data breach response plan & tabletop exercise so your executive has rehearsed the decisions before 1 January 2027.
Related: Compliance and Privacy · Information Asset Register Services · Fractional Privacy Officer Service · Privacy Impact Assessments (PIA) in Australia
Sources
- WA Office of the Information Commissioner – Privacy in Western Australia (WA Office of the Information Commissioner)
- OAIC – Australian Clinical Labs ordered to pay penalties in relation to Medlab Pathology data breach (OAIC)
- McCullough Robertson – CPS 230 compliance countdown (McCullough Robertson)
- OIC Queensland – IPOLA Overview (Office of the Information Commissioner Queensland)
