Governance · Australia

Privacy assessments: retain the decision and its supporting evidence

Published on NORMIX: 2026-10-26 · NORMIX

OAIC’s 23 October reminder makes privacy assessment decisions a practical governance priority.

A threshold assessment helps decide whether a full privacy impact assessment is needed. Keep the screening rationale, assessment, risk treatments and review record.

For Commonwealth agencies covered by the Government Agencies APP Code, high-privacy-risk projects require a PIA. Other APP entities are encouraged to assess privacy impacts. The reminder does not make a PIA mandatory for every AI project. NORMIX suggests assigning an owner and due date to unresolved treatments, with evidence of closure.