Information Privacy Regulation 2025


Queensland Crest

Part 1 Preliminary

1Short title

This regulation may be cited as the Information Privacy Regulation 2025.

2Commencement

(1)This regulation, other than section 10 and part 7, division 1, commences on 1 July 2025.
(2)Section 10 and part 7, division 1 commence on 1 July 2026.

Part 2 Collection, use and disclosure of information for notifying eligible data breaches

3Disclosing agency and receiving agencies—Act, s 54

(1)For section 54(1)(a) of the Act, the registrar under the Births, Deaths and Marriages Registration Act 2023 is prescribed.
(2)For section 54(1)(b) of the Act, each agency is prescribed.

Part 3 Requirements for annual reports

4Report to Speaker and parliamentary committee on operations of OIC—Act, s 193

(1)For section 193(3) of the Act, the following matters are prescribed—
(a)the number of directions in relation to suspected eligible data breaches given under section 61(2) of the Act;
(b)the number of recommendations in relation to suspected eligible data breaches made under section 61(4) of the Act;
(c)the number of times an authorised officer entered an agency’s place of business, or another place occupied by the agency, under section 67 of the Act;
(d)the number of times an authorised officer required a person to give the authorised officer reasonable help under section 70(1) of the Act;
(e)the number of approvals of waivers or modifications of particular obligations given under chapter 4, part 5 of the Act;
(f)the number of compliance notices given under chapter 4, part 6 of the Act;
(g)the number of privacy complaints made or referred to the information commissioner and the following information about the complaints—
(i)the provisions of the privacy principle requirements or chapter 3A, part 2 or 3 of the Act to which the complaints relate;
(ii)the categories of relevant entities to which the complaints relate;
(h)the outcome of the information commissioner’s dealing with privacy complaints, including the following—
(i)the number of the complaints the information commissioner declined to deal with or continue to deal with;
(ii)the grounds for declining to deal with, or continue to deal with, the complaints mentioned in subparagraph (i);
(iii)the number of the complaints referred by the information commissioner to other entities under section 169 of the Act;
(iv)the number of the complaints resolved by agreement after mediation;
(v)the number of the complaints referred to QCAT under chapter 5, part 4 of the Act;
(i)for applications mentioned in section 217(1) of the Act—the matters mentioned in the repealed Information Privacy Regulation 2009, section 5(1)(a) to (d).
(2)For each matter mentioned in subsection (1)(a) to (d), the details of the matter must not include details identifying the particular agencies to which the matter relates.

5Report to Assembly on Act’s operation—Act, s 194

For section 194(2) of the Act, the following matters are prescribed—
(a)any proceedings brought for an offence against section 184(1) or (3) of the Act;
(b)for applications mentioned in section 217(1) of the Act—the matters mentioned in the repealed Information Privacy Regulation 2009, section 6(1)(a) to (h) and (j);
(c)anything else an agency or Minister did to further the object of the Act.

Part 4 Declaration

6Principal office—Act, sch 5, definition principal officer

For schedule 5 of the Act, definition principal officer, paragraph (e), for each public authority stated in column 1 of the table in schedule 1, the office stated in column 2 is declared to be the principal office for the public authority.

Part 5 Repeal

7Repeal

The Information Privacy Regulation 2009, SL No. 135 is repealed.

Part 6 Transitional provisions

8Continuation of s 5 of repealed regulation for report relating to 2024–2025 financial year

(1)This section applies in relation to a report under section 193(2) of the Act relating to the 2024–2025 financial year.
(2)Section 5 of the repealed Information Privacy Regulation 2009 continues to apply in relation to the report as if this regulation had not been made.
(3)Section 4 as in force from the commencement does not apply in relation to the report.

9Continuation of s 6 of repealed regulation for report relating to 2024–2025 financial year

(1)This section applies in relation to a report under section 194(1) of the Act relating to the 2024–2025 financial year.
(2)Section 6 of the repealed Information Privacy Regulation 2009 continues to apply in relation to the report as if this regulation had not been made.
(3)Section 5 as in force from the commencement does not apply in relation to the report.

10Continuation of former s 5 for report relating to 2025–2026 financial year

(1)This section applies in relation to a report for a financial year to which section 226 of the Act applies.
(2)To remove any doubt, it is declared that—
(a)section 5 as in force before the commencement continues to apply in relation to the report as if the amendment of the section by this regulation had not been made; and
(b)section 5 as in force from the commencement does not apply in relation to the report.

Part 7 Amendment of legislation

Division 1 Amendment of this regulation

11Regulation amended

This division amends this regulation.

12Replacement of s 5 (Report to Assembly on Act’s operation—Act, s 194)

Section 5—
omit, insert—

5Report to Assembly on Act’s operation—Act, s 194

(1)For section 194(1) of the Act, information relating to an agency or Minister about the matters stated in subsection (3) is prescribed.
(2)For section 194(3) of the Act, the matters stated in subsection (3) are prescribed.
(3)For subsections (1) and (2), the matters are—
(a)any proceedings brought for an offence against section 184(1) or (3) of the Act; and
(b)for applications mentioned in section 217(1) of the Act—the matters mentioned in the repealed Information Privacy Regulation 2009, section 6(1)(a) to (h) and (j).

Division 2 Other amendments

13Legislation amended

Schedule 2 amends the legislation it mentions.

Schedule 1 Declared principal offices for public authorities

section 6

Column 1

Column 2

Public authority

Declared principal office

the Supreme Court of Queensland

the principal registrar of the Supreme Court of Queensland

the District Court of Queensland

the principal registrar of the District Court of Queensland

a Magistrates Court

the principal registrar of Magistrates Courts

the Industrial Court of Queensland

the registrar under the Industrial Relations Act 2016

the Land Court

the registrar of the Land Court

the Mental Health Court

the registrar of the Mental Health Court

the Childrens Court of Queensland constituted by a Childrens Court judge

the principal registrar of the District Court of Queensland

the Planning and Environment Court

the principal registrar of the District Court of Queensland

the Childrens Court of Queensland constituted by a Childrens Court magistrate

the principal registrar of Magistrates Courts

the Coroners Court

the executive director of the Coroners Court

an Industrial Magistrates Court

the registrar under the Industrial Relations Act 2016

QCAT

the principal registrar under the QCAT Act

the Queensland Industrial Relations Commission

the registrar under the Industrial Relations Act 2016

the Mental Health Review Tribunal

the executive officer of the Mental Health Review Tribunal under the Mental Health Act 2016

a development tribunal under the Planning Act 2016

the registrar under the Planning Act 2016

a medical assessment tribunal under the Workers’ Compensation and Rehabilitation Act 2003

the secretary appointed to the medical assessment tribunal under the Workers’ Compensation and Rehabilitation Act 2003, section 496(a)

the Queensland Independent Remuneration Tribunal

the chairman under the Queensland Independent Remuneration Tribunal Act 2013

the Office of the Ombudsman under the Ombudsman Act 2001

the ombudsman, as the ombudsman and the inspector of detention services, under the Ombudsman Act 2001

Central Queensland University

the vice-chancellor of Central Queensland University

Griffith University

the vice-chancellor of Griffith University

James Cook University

the vice-chancellor of James Cook University

Queensland University of Technology

the vice-chancellor of the Queensland University of Technology

The University of Queensland

the vice-chancellor of The University of Queensland

University of Southern Queensland

the vice-chancellor of the University of Southern Queensland

University of the Sunshine Coast

the vice-chancellor of the University of the Sunshine Coast

Schedule 2 Other amendments

section 13

1Section 7, heading, ‘RTI provisions do’—

omit, insert—

Right to Information Act 2009 does

2Section 7(1), (2) and (3), ‘RTI provisions do’—

omit, insert—

Right to Information Act 2009 does

3Section 7(4), definition RTI provisions

omit.

1Sections 13 and 19J, headings, ‘information’—

omit, insert—

Queensland

2Sections 13 and 19J, ‘and 3’—

omit, insert—

and 2

1Section 13(5)(a)(iv), ‘the Information Privacy Act 2009 or’—

omit.

1Section 19AL(1)(f)—

omit, insert—
(f)comply with the Queensland privacy principles set out in the Information Privacy Act 2009, schedule 3; and

2Section 19AL(2), definitions Information Privacy Principles and National Privacy Principles

omit.

1Schedule 3, entries for Information Privacy Regulation 2009 and Right to Information Regulation 2009

omit.