It depends on the size and privacy risk of the project. Most PIAs we run cost between $4,000 and $30,000 plus GST, depending on scope and complexity. A short privacy threshold assessment, which often comes first, costs less.
There is no regulated price for a privacy impact assessment (PIA). The OAIC describes a PIA as a flexible and scalable tool, and says the approach should be proportionate to the level of risk [1]. That is the main reason quotes vary so much.
What drives the cost
Most of the effort in a PIA goes into understanding the project and how personal information moves through it. The things that change the price are:
The size and complexity of the project, and how many systems, integrations and vendors it touches, including any overseas storage or support.
The kind of information involved. Health information, biometrics, children's information and other sensitive information need more analysis than contact details.
Whether the project uses AI or automated decision-making, which brings in the transparency rules that start on 10 December 2026 [3].
How many people need to be consulted, and how quickly they are available.
How much is already written down. A clear project description, data flow diagram and vendor documentation can cut the work substantially.
The three sizes of PIA
A privacy threshold assessment is a short first check of whether personal information is involved and whether a full PIA is needed. The OAIC's PIA process starts here [2]. It takes much less effort than a full PIA, so it costs less.
A standard PIA covers one project or system end to end: describing the project, mapping information flows, checking it against the Australian Privacy Principles, assessing the risks and making recommendations [2].
A complex or high-risk PIA is for large programs, many systems or vendors, sensitive information at scale, or significant automated decision-making.
Most PIAs we run fall between $4,000 and $30,000 plus GST, depending on where they sit on this scale. We confirm the size and the fee after the threshold assessment, so you know the commitment before the full PIA starts.
When you need one
Australian Government agencies must conduct a PIA for all high privacy risk projects under section 12 of the Australian Government Agencies Privacy Code [1]. There is no fixed threshold: agencies screen for risk factors such as large volumes of data, sensitive information, profiling or automated decision-making [1].
For other organisations a PIA is generally not mandatory, but the OAIC recommends PIAs as part of risk management and planning [2], and government and large-organisation contracts often ask for one.
How to keep the cost down
Start with the threshold assessment rather than a full PIA. It often shows the project is lower risk than expected, or narrows the scope to the parts that matter.
Run the PIA early, while design decisions are still open. Changing a design is cheaper than changing a system that has gone live.
Have the basics ready: a short project description, the systems involved, the vendors and where they store data, and a single contact who can find answers.
Reuse what you have. An information asset register or a record of processing activities makes the information mapping much faster.
In-house or external?
Anyone with the right knowledge can prepare a PIA, and many organisations do them in-house. An external assessor adds independence and experience across many projects, which regulators, boards and clients often value. If you run PIAs in-house, an external review of the finished report is a lower-cost way to get that second opinion.
Frequently asked questions
Is a PIA mandatory for private companies?
Generally no. The OAIC recommends PIAs as part of risk management and planning [2], and contracts with government and large organisations often require one.
Can we do the threshold assessment ourselves?
Yes. It is step one of the OAIC's 10 steps and is designed to be run by the project team [2]. Keep a record of the result either way.
How long does a PIA take?
Elapsed time depends mostly on how quickly people and documents are available. We agree the timing after the threshold assessment so there are no surprises.
Is a GDPR DPIA a separate cost?
A data protection impact assessment covers similar ground. If you operate in both regimes, one combined assessment usually costs less than two separate ones.
Do you assess AI tools?
Yes, including the automated decision-making tests that apply from 10 December 2026 [3] and the AI risks that sit alongside privacy, such as accuracy, bias and transparency.
Not sure which size you need? Start with a privacy threshold assessment, or book a short call.
Related: Privacy impact assessments for Australian organisations · Data mapping and privacy impact analysis for an aged care provider · Contact us