Information Privacy Regulation 2025

1Short title

This regulation may be cited as the Information Privacy Regulation 2025.

2Commencement

(1)This regulation, other than section 10 and part 7, division 1, commences on 1 July 2025.

(2)Section 10 and part 7, division 1 commence on 1 July 2026.

3Disclosing agency and receiving agencies—Act, s 54

(1)For section 54(1)(a) of the Act, the registrar under the Births, Deaths and Marriages Registration Act 2023 is prescribed.

(2)For section 54(1)(b) of the Act, each agency is prescribed.

4Report to Speaker and parliamentary committee on operations of OIC—Act, s 193

(1)For section 193(3) of the Act, the following matters are prescribed—

(a)the number of directions in relation to suspected eligible data breaches given under section 61(2) of the Act;

(b)the number of recommendations in relation to suspected eligible data breaches made under section 61(4) of the Act;

(c)the number of times an authorised officer entered an agency’s place of business, or another place occupied by the agency, under section 67 of the Act;

(d)the number of times an authorised officer required a person to give the authorised officer reasonable help under section 70(1) of the Act;

(e)the number of approvals of waivers or modifications of particular obligations given under chapter 4, part 5 of the Act;

(f)the number of compliance notices given under chapter 4, part 6 of the Act;

(g)the number of privacy complaints made or referred to the information commissioner and the following information about the complaints—

(i)the provisions of the privacy principle requirements or chapter 3A, part 2 or 3 of the Act to which the complaints relate;

(ii)the categories of relevant entities to which the complaints relate;

(h)the outcome of the information commissioner’s dealing with privacy complaints, including the following—

(i)the number of the complaints the information commissioner declined to deal with or continue to deal with;

(ii)the grounds for declining to deal with, or continue to deal with, the complaints mentioned in subparagraph (i);

(iii)the number of the complaints referred by the information commissioner to other entities under section 169 of the Act;

(iv)the number of the complaints resolved by agreement after mediation;

(v)the number of the complaints referred to QCAT under chapter 5, part 4 of the Act;

(i)for applications mentioned in section 217(1) of the Act—the matters mentioned in the repealed Information Privacy Regulation 2009, section 5(1)(a) to (d).

(2)For each matter mentioned in subsection (1)(a) to (d), the details of the matter must not include details identifying the particular agencies to which the matter relates.

5Report to Assembly on Act’s operation—Act, s 194

For section 194(2) of the Act, the following matters are prescribed—

(a)any proceedings brought for an offence against section 184(1) or (3) of the Act;

(b)for applications mentioned in section 217(1) of the Act—the matters mentioned in the repealed Information Privacy Regulation 2009, section 6(1)(a) to (h) and (j);

(c)anything else an agency or Minister did to further the object of the Act.

6Principal office—Act, sch 5, definition principal officer

For schedule 5 of the Act, definition principal officer, paragraph (e), for each public authority stated in column 1 of the table in schedule 1, the office stated in column 2 is declared to be the principal office for the public authority.

7Repeal

The Information Privacy Regulation 2009, SL No. 135 is repealed.

8Continuation of s 5 of repealed regulation for report relating to 2024–2025 financial year

(1)This section applies in relation to a report under section 193(2) of the Act relating to the 2024–2025 financial year.

(2)Section 5 of the repealed Information Privacy Regulation 2009 continues to apply in relation to the report as if this regulation had not been made.

(3)Section 4 as in force from the commencement does not apply in relation to the report.

9Continuation of s 6 of repealed regulation for report relating to 2024–2025 financial year

(1)This section applies in relation to a report under section 194(1) of the Act relating to the 2024–2025 financial year.

(2)Section 6 of the repealed Information Privacy Regulation 2009 continues to apply in relation to the report as if this regulation had not been made.

(3)Section 5 as in force from the commencement does not apply in relation to the report.

10Continuation of former s 5 for report relating to 2025–2026 financial year

(1)This section applies in relation to a report for a financial year to which section 226 of the Act applies.

(2)To remove any doubt, it is declared that—

(a)section 5 as in force before the commencement continues to apply in relation to the report as if the amendment of the section by this regulation had not been made; and

(b)section 5 as in force from the commencement does not apply in relation to the report.

11Regulation amended

This division amends this regulation.

12Replacement of s 5 (Report to Assembly on Act’s operation—Act, s 194)

Section 5—
omit, insert—

5Report to Assembly on Act’s operation—Act, s 194

(1)For section 194(1) of the Act, information relating to an agency or Minister about the matters stated in subsection (3) is prescribed.

(2)For section 194(3) of the Act, the matters stated in subsection (3) are prescribed.

(3)For subsections (1) and (2), the matters are—

(a)any proceedings brought for an offence against section 184(1) or (3) of the Act; and

(b)for applications mentioned in section 217(1) of the Act—the matters mentioned in the repealed Information Privacy Regulation 2009, section 6(1)(a) to (h) and (j).

section 6