{"id":"qld:sl-2025-0075","name":"Information Privacy Regulation 2025","slug":"information-privacy-regulation-2025","collection":"regulation","jurisdiction":"qld","status":"in_force","isInForce":true,"actNumber":"75 of 2025","makingDate":null,"administeringDepartment":null,"currentVersion":{"id":173652,"registerId":"qld-sl-2025-0075-current","compilationNumber":null,"startDate":"2026-04-05","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"pt.1","sectionType":"part","heading":"Preliminary","content":"# Preliminary","sortOrder":0},{"sectionNumber":"sec.1","sectionType":"section","heading":"Short title","content":"### sec.1 Short title\n\nThis regulation may be cited as the Information Privacy Regulation 2025 .","sortOrder":1},{"sectionNumber":"sec.2","sectionType":"section","heading":"Commencement","content":"### sec.2 Commencement\n\nThis regulation, other than section 10 and part 7 , division 1 , commences on 1 July 2025.\nSection 10 and part 7 , division 1 commence on 1 July 2026.\n(sec.2-ssec.1) This regulation, other than section 10 and part 7 , division 1 , commences on 1 July 2025.\n(sec.2-ssec.2) Section 10 and part 7 , division 1 commence on 1 July 2026.","sortOrder":2},{"sectionNumber":"pt.2","sectionType":"part","heading":"Collection, use and disclosure of information for notifying eligible data breaches","content":"# Collection, use and disclosure of information for notifying eligible data breaches","sortOrder":3},{"sectionNumber":"sec.3","sectionType":"section","heading":"Disclosing agency and receiving agencies— Act , s 54","content":"### sec.3 Disclosing agency and receiving agencies— Act , s 54\n\nFor section 54 (1) (a) of the Act , the registrar under the Births, Deaths and Marriages Registration Act 2023 is prescribed.\nFor section 54 (1) (b) of the Act , each agency is prescribed.\n(sec.3-ssec.1) For section 54 (1) (a) of the Act , the registrar under the Births, Deaths and Marriages Registration Act 2023 is prescribed.\n(sec.3-ssec.2) For section 54 (1) (b) of the Act , each agency is prescribed.","sortOrder":4},{"sectionNumber":"pt.3","sectionType":"part","heading":"Requirements for annual reports","content":"# Requirements for annual reports","sortOrder":5},{"sectionNumber":"sec.4","sectionType":"section","heading":"Report to Speaker and parliamentary committee on operations of OIC— Act , s 193","content":"### sec.4 Report to Speaker and parliamentary committee on operations of OIC— Act , s 193\n\nFor section 193 (3) of the Act , the following matters are prescribed—\nthe number of directions in relation to suspected eligible data breaches given under section 61 (2) of the Act ;\nthe number of recommendations in relation to suspected eligible data breaches made under section 61 (4) of the Act ;\nthe number of times an authorised officer entered an agency’s place of business, or another place occupied by the agency, under section 67 of the Act ;\nthe number of times an authorised officer required a person to give the authorised officer reasonable help under section 70 (1) of the Act ;\nthe number of approvals of waivers or modifications of particular obligations given under chapter 4 , part 5 of the Act ;\nthe number of compliance notices given under chapter 4 , part 6 of the Act ;\nthe number of privacy complaints made or referred to the information commissioner and the following information about the complaints—\nthe provisions of the privacy principle requirements or chapter 3A , part 2 or 3 of the Act to which the complaints relate;\nthe categories of relevant entities to which the complaints relate;\nthe outcome of the information commissioner’s dealing with privacy complaints, including the following—\nthe number of the complaints the information commissioner declined to deal with or continue to deal with;\nthe grounds for declining to deal with, or continue to deal with, the complaints mentioned in subparagraph (i) ;\nthe number of the complaints referred by the information commissioner to other entities under section 169 of the Act ;\nthe number of the complaints resolved by agreement after mediation;\nthe number of the complaints referred to QCAT under chapter 5 , part 4 of the Act ;\nfor applications mentioned in section 217 (1) of the Act —the matters mentioned in the repealed Information Privacy Regulation 2009 , section 5 (1) (a) to (d) .\nFor each matter mentioned in subsection (1) (a) to (d) , the details of the matter must not include details identifying the particular agencies to which the matter relates.\n(sec.4-ssec.1) For section 193 (3) of the Act , the following matters are prescribed— the number of directions in relation to suspected eligible data breaches given under section 61 (2) of the Act ; the number of recommendations in relation to suspected eligible data breaches made under section 61 (4) of the Act ; the number of times an authorised officer entered an agency’s place of business, or another place occupied by the agency, under section 67 of the Act ; the number of times an authorised officer required a person to give the authorised officer reasonable help under section 70 (1) of the Act ; the number of approvals of waivers or modifications of particular obligations given under chapter 4 , part 5 of the Act ; the number of compliance notices given under chapter 4 , part 6 of the Act ; the number of privacy complaints made or referred to the information commissioner and the following information about the complaints— the provisions of the privacy principle requirements or chapter 3A , part 2 or 3 of the Act to which the complaints relate; the categories of relevant entities to which the complaints relate; the outcome of the information commissioner’s dealing with privacy complaints, including the following— the number of the complaints the information commissioner declined to deal with or continue to deal with; the grounds for declining to deal with, or continue to deal with, the complaints mentioned in subparagraph (i) ; the number of the complaints referred by the information commissioner to other entities under section 169 of the Act ; the number of the complaints resolved by agreement after mediation; the number of the complaints referred to QCAT under chapter 5 , part 4 of the Act ; for applications mentioned in section 217 (1) of the Act —the matters mentioned in the repealed Information Privacy Regulation 2009 , section 5 (1) (a) to (d) .\n(sec.4-ssec.2) For each matter mentioned in subsection (1) (a) to (d) , the details of the matter must not include details identifying the particular agencies to which the matter relates.\n- (a) the number of directions in relation to suspected eligible data breaches given under section 61 (2) of the Act ;\n- (b) the number of recommendations in relation to suspected eligible data breaches made under section 61 (4) of the Act ;\n- (c) the number of times an authorised officer entered an agency’s place of business, or another place occupied by the agency, under section 67 of the Act ;\n- (d) the number of times an authorised officer required a person to give the authorised officer reasonable help under section 70 (1) of the Act ;\n- (e) the number of approvals of waivers or modifications of particular obligations given under chapter 4 , part 5 of the Act ;\n- (f) the number of compliance notices given under chapter 4 , part 6 of the Act ;\n- (g) the number of privacy complaints made or referred to the information commissioner and the following information about the complaints— (i) the provisions of the privacy principle requirements or chapter 3A , part 2 or 3 of the Act to which the complaints relate; (ii) the categories of relevant entities to which the complaints relate;\n- (i) the provisions of the privacy principle requirements or chapter 3A , part 2 or 3 of the Act to which the complaints relate;\n- (ii) the categories of relevant entities to which the complaints relate;\n- (h) the outcome of the information commissioner’s dealing with privacy complaints, including the following— (i) the number of the complaints the information commissioner declined to deal with or continue to deal with; (ii) the grounds for declining to deal with, or continue to deal with, the complaints mentioned in subparagraph (i) ; (iii) the number of the complaints referred by the information commissioner to other entities under section 169 of the Act ; (iv) the number of the complaints resolved by agreement after mediation; (v) the number of the complaints referred to QCAT under chapter 5 , part 4 of the Act ;\n- (i) the number of the complaints the information commissioner declined to deal with or continue to deal with;\n- (ii) the grounds for declining to deal with, or continue to deal with, the complaints mentioned in subparagraph (i) ;\n- (iii) the number of the complaints referred by the information commissioner to other entities under section 169 of the Act ;\n- (iv) the number of the complaints resolved by agreement after mediation;\n- (v) the number of the complaints referred to QCAT under chapter 5 , part 4 of the Act ;\n- (i) for applications mentioned in section 217 (1) of the Act —the matters mentioned in the repealed Information Privacy Regulation 2009 , section 5 (1) (a) to (d) .\n- (i) the provisions of the privacy principle requirements or chapter 3A , part 2 or 3 of the Act to which the complaints relate;\n- (ii) the categories of relevant entities to which the complaints relate;\n- (i) the number of the complaints the information commissioner declined to deal with or continue to deal with;\n- (ii) the grounds for declining to deal with, or continue to deal with, the complaints mentioned in subparagraph (i) ;\n- (iii) the number of the complaints referred by the information commissioner to other entities under section 169 of the Act ;\n- (iv) the number of the complaints resolved by agreement after mediation;\n- (v) the number of the complaints referred to QCAT under chapter 5 , part 4 of the Act ;","sortOrder":6},{"sectionNumber":"sec.5","sectionType":"section","heading":"Report to Assembly on Act’s operation— Act , s 194","content":"### sec.5 Report to Assembly on Act’s operation— Act , s 194\n\nFor section 194 (2) of the Act , the following matters are prescribed—\nany proceedings brought for an offence against section 184 (1) or (3) of the Act ;\nfor applications mentioned in section 217 (1) of the Act —the matters mentioned in the repealed Information Privacy Regulation 2009 , section 6 (1) (a) to (h) and (j) ;\nanything else an agency or Minister did to further the object of the Act .\n- (a) any proceedings brought for an offence against section 184 (1) or (3) of the Act ;\n- (b) for applications mentioned in section 217 (1) of the Act —the matters mentioned in the repealed Information Privacy Regulation 2009 , section 6 (1) (a) to (h) and (j) ;\n- (c) anything else an agency or Minister did to further the object of the Act .","sortOrder":7},{"sectionNumber":"pt.4","sectionType":"part","heading":"Declaration","content":"# Declaration","sortOrder":8},{"sectionNumber":"sec.6","sectionType":"section","heading":"Principal office— Act , sch 5 , definition principal officer","content":"### sec.6 Principal office— Act , sch 5 , definition principal officer\n\nFor schedule 5 of the Act , definition principal officer , paragraph (e) , for each public authority stated in column 1 of the table in schedule 1 , the office stated in column 2 is declared to be the principal office for the public authority.","sortOrder":9},{"sectionNumber":"pt.5","sectionType":"part","heading":"Repeal","content":"# Repeal","sortOrder":10},{"sectionNumber":"sec.7","sectionType":"section","heading":"Repeal","content":"### sec.7 Repeal\n\nThe Information Privacy Regulation 2009 , SL No. 135 is repealed.","sortOrder":11},{"sectionNumber":"pt.6","sectionType":"part","heading":"Transitional provisions","content":"# Transitional provisions","sortOrder":12},{"sectionNumber":"sec.8","sectionType":"section","heading":"Continuation of s 5 of repealed regulation for report relating to 2024–2025 financial year","content":"### sec.8 Continuation of s 5 of repealed regulation for report relating to 2024–2025 financial year\n\nThis section applies in relation to a report under section 193 (2) of the Act relating to the 2024–2025 financial year.\nSection 5 of the repealed Information Privacy Regulation 2009 continues to apply in relation to the report as if this regulation had not been made.\nSection 4 as in force from the commencement does not apply in relation to the report.\n(sec.8-ssec.1) This section applies in relation to a report under section 193 (2) of the Act relating to the 2024–2025 financial year.\n(sec.8-ssec.2) Section 5 of the repealed Information Privacy Regulation 2009 continues to apply in relation to the report as if this regulation had not been made.\n(sec.8-ssec.3) Section 4 as in force from the commencement does not apply in relation to the report.","sortOrder":13},{"sectionNumber":"sec.9","sectionType":"section","heading":"Continuation of s 6 of repealed regulation for report relating to 2024–2025 financial year","content":"### sec.9 Continuation of s 6 of repealed regulation for report relating to 2024–2025 financial year\n\nThis section applies in relation to a report under section 194 (1) of the Act relating to the 2024–2025 financial year.\nSection 6 of the repealed Information Privacy Regulation 2009 continues to apply in relation to the report as if this regulation had not been made.\nSection 5 as in force from the commencement does not apply in relation to the report.\n(sec.9-ssec.1) This section applies in relation to a report under section 194 (1) of the Act relating to the 2024–2025 financial year.\n(sec.9-ssec.2) Section 6 of the repealed Information Privacy Regulation 2009 continues to apply in relation to the report as if this regulation had not been made.\n(sec.9-ssec.3) Section 5 as in force from the commencement does not apply in relation to the report.","sortOrder":14},{"sectionNumber":"sec.10","sectionType":"section","heading":"Continuation of former s 5 for report relating to 2025–2026 financial year","content":"### sec.10 Continuation of former s 5 for report relating to 2025–2026 financial year\n\nThis section applies in relation to a report for a financial year to which section 226 of the Act applies.\nTo remove any doubt, it is declared that—\nsection 5 as in force before the commencement continues to apply in relation to the report as if the amendment of the section by this regulation had not been made; and\nsection 5 as in force from the commencement does not apply in relation to the report.\n(sec.10-ssec.1) This section applies in relation to a report for a financial year to which section 226 of the Act applies.\n(sec.10-ssec.2) To remove any doubt, it is declared that— section 5 as in force before the commencement continues to apply in relation to the report as if the amendment of the section by this regulation had not been made; and section 5 as in force from the commencement does not apply in relation to the report.\n- (a) section 5 as in force before the commencement continues to apply in relation to the report as if the amendment of the section by this regulation had not been made; and\n- (b) section 5 as in force from the commencement does not apply in relation to the report.","sortOrder":15},{"sectionNumber":"pt.7","sectionType":"part","heading":"Amendment of legislation","content":"# Amendment of legislation","sortOrder":16},{"sectionNumber":"pt.7-div.1","sectionType":"division","heading":"Amendment of this regulation","content":"## Amendment of this regulation","sortOrder":17},{"sectionNumber":"sec.11","sectionType":"section","heading":"Regulation amended","content":"### sec.11 Regulation amended\n\nThis division amends this regulation.","sortOrder":18},{"sectionNumber":"sec.12","sectionType":"section","heading":"Replacement of s 5 (Report to Assembly on Act’s operation— Act , s 194 )","content":"### sec.12 Replacement of s 5 (Report to Assembly on Act’s operation— Act , s 194 )\n\nSection 5 —\nomit, insert—\nFor section 194(1) of the Act, information relating to an agency or Minister about the matters stated in subsection (3) is prescribed.\nFor section 194(3) of the Act, the matters stated in subsection (3) are prescribed.\nFor subsections (1) and (2), the matters are—\nany proceedings brought for an offence against section 184(1) or (3) of the Act; and\nfor applications mentioned in section 217(1) of the Act—the matters mentioned in the repealed Information Privacy Regulation 2009 , section 6(1)(a) to (h) and (j).\n(sec.12-frag-sec.5-ssec.1) For section 194(1) of the Act, information relating to an agency or Minister about the matters stated in subsection (3) is prescribed.\n(sec.12-frag-sec.5-ssec.2) For section 194(3) of the Act, the matters stated in subsection (3) are prescribed.\n(sec.12-frag-sec.5-ssec.3) For subsections (1) and (2), the matters are— any proceedings brought for an offence against section 184(1) or (3) of the Act; and for applications mentioned in section 217(1) of the Act—the matters mentioned in the repealed Information Privacy Regulation 2009 , section 6(1)(a) to (h) and (j).\n- (a) any proceedings brought for an offence against section 184(1) or (3) of the Act; and\n- (b) for applications mentioned in section 217(1) of the Act—the matters mentioned in the repealed Information Privacy Regulation 2009 , section 6(1)(a) to (h) and (j).","sortOrder":19},{"sectionNumber":"sec.12-frag-sec.5","sectionType":"section","heading":"Report to Assembly on Act’s operation—Act, s 194","content":"### sec.12-frag-sec.5 Report to Assembly on Act’s operation—Act, s 194\n\nFor section 194(1) of the Act, information relating to an agency or Minister about the matters stated in subsection (3) is prescribed.\nFor section 194(3) of the Act, the matters stated in subsection (3) are prescribed.\nFor subsections (1) and (2), the matters are—\nany proceedings brought for an offence against section 184(1) or (3) of the Act; and\nfor applications mentioned in section 217(1) of the Act—the matters mentioned in the repealed Information Privacy Regulation 2009 , section 6(1)(a) to (h) and (j).\n(sec.12-frag-sec.5-ssec.1) For section 194(1) of the Act, information relating to an agency or Minister about the matters stated in subsection (3) is prescribed.\n(sec.12-frag-sec.5-ssec.2) For section 194(3) of the Act, the matters stated in subsection (3) are prescribed.\n(sec.12-frag-sec.5-ssec.3) For subsections (1) and (2), the matters are— any proceedings brought for an offence against section 184(1) or (3) of the Act; and for applications mentioned in section 217(1) of the Act—the matters mentioned in the repealed Information Privacy Regulation 2009 , section 6(1)(a) to (h) and (j).\n- (a) any proceedings brought for an offence against section 184(1) or (3) of the Act; and\n- (b) for applications mentioned in section 217(1) of the Act—the matters mentioned in the repealed Information Privacy Regulation 2009 , section 6(1)(a) to (h) and (j).","sortOrder":20}],"analysis":{"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"issue_detection":{"absurdities":[{"type":"circular_definition","section":"sec.4(1)(i) and sec.5(b)","severity":"medium","reasoning":"Section 7 repeals the Information Privacy Regulation 2009, yet sections 4(1)(i), 5(b), and the replacement section 5 (inserted by section 12) all mandate ongoing compliance by reference to specific provisions of the repealed regulation (e.g., s.5(1)(a)-(d) and s.6(1)(a)-(h) and (j)). While transitional provisions sometimes preserve repealed law, here the primary operative reporting obligations in the new regulation permanently incorporate content from a document it simultaneously destroys, creating an absurd dependency on a zombie instrument for ongoing compliance.","confidence":0.75,"description":"Both sections require reporting on matters from the 'repealed Information Privacy Regulation 2009' as if it still exists and is accessible as a live reference document, despite section 7 of this very regulation repealing that instrument."},{"type":"impossible_compliance","section":"sec.10","severity":"high","reasoning":"Section 10 is drafted as if this regulation amends a pre-existing section 5, using language typical of amending legislation ('as in force before the commencement', 'the amendment of the section by this regulation had not been made'). However, the regulation is a new instrument (replacing the 2009 Regulation wholesale under section 7), meaning section 5 only came into existence upon commencement. There is no prior version of section 5 'before the commencement' of this regulation. The provision is logically incoherent — it attempts to preserve something that never previously existed.","confidence":0.85,"description":"Section 10 refers to 'section 5 as in force before the commencement' and 'the amendment of the section by this regulation', but this regulation is a new standalone instrument, not an amending regulation — section 5 did not exist before this regulation commenced and thus has no 'before the commencement' version."},{"type":"other","section":"sec.4(1)(i)","severity":"low","reasoning":"Incorporating by reference to a repealed instrument is poor legislative practice and creates practical compliance difficulties. Regulated entities and the OIC must locate and interpret a repealed instrument to understand current obligations. While not strictly self-contradicting, it undermines the regulation's function as a standalone operative instrument.","confidence":0.7,"description":"The annual report to the Speaker and parliamentary committee must include matters from 'the repealed Information Privacy Regulation 2009, section 5(1)(a) to (d)' — but section 5 of the 2009 Regulation was the equivalent OIC report provision, meaning the new regulation perpetually incorporates the old regulation's reporting framework into the new one without restating its content, making compliance opaque."},{"type":"other","section":"sec.12-frag-sec.5(3)","severity":"low","reasoning":"The original section 5 contains three paragraphs (a), (b), (c). The replacement section 5 inserted by section 12 only replicates paragraphs (a) and (b). Paragraph (c) — the catch-all requirement to report anything done to further the Act's object — is dropped entirely. This may be intentional but creates an absurdity where the broader reporting obligation exists for the first year only, then silently contracts.","confidence":0.72,"description":"The replacement section 5 (inserted by section 12, commencing 1 July 2026) omits the original section 5(c) requirement to report 'anything else an agency or Minister did to further the object of the Act', silently narrowing the reporting obligation without acknowledgment or transitional explanation."}],"contradictions":[{"severity":"medium","section_a":"sec.7","section_b":"sec.8(2) and sec.9(2)","confidence":0.78,"description":"Section 7 repeals the Information Privacy Regulation 2009 absolutely, while sections 8(2) and 9(2) direct that sections 5 and 6 of that same repealed regulation 'continue to apply' as if the new regulation had not been made."},{"severity":"medium","section_a":"sec.2","section_b":"sec.10","confidence":0.8,"description":"Section 2 states section 10 commences on 1 July 2026, yet section 10 purports to preserve 'section 5 as in force before the commencement' — a commencement that has not yet occurred when section 10 itself is not yet in force. The provision attempts to speak to a historical state of affairs that post-dates its own operative date."},{"severity":"low","section_a":"sec.5(c)","section_b":"sec.12-frag-sec.5(3)","confidence":0.8,"description":"Section 5(c) prescribes 'anything else an agency or Minister did to further the object of the Act' as a mandatory reporting matter for the Assembly report. The replacement section 5 inserted by section 12 (operative from 1 July 2026) omits this paragraph entirely, directly contradicting the scope of the reporting obligation between the two versions of the same operative provision."},{"severity":"low","section_a":"sec.4(2)","section_b":"sec.4(1)(g)(ii)","confidence":0.55,"description":"Section 4(2) prohibits the report from including details identifying particular agencies in relation to matters (a) to (d). However, section 4(1)(g)(ii) requires reporting on 'the categories of relevant entities to which complaints relate' — depending on how narrowly a 'category' is defined, a category could effectively identify a specific agency, creating tension between the anonymity requirement and the categorisation requirement."}]},"kimi_summary":{"content_quality":"ok","complexity_score":4,"scope_assessment":{"changed":false,"description":"The regulation maintains the same scope as its predecessor—prescribing administrative details for the Information Privacy Act. It updates reporting requirements and data breach notification procedures but does not expand beyond the original regulatory purpose of operationalising the parent Act."},"complexity_factors":["Multiple commencement dates (1 July 2025 and 1 July 2026) creating staggered implementation","Extensive cross-referencing to the parent Act (Information Privacy Act) with numerous section citations (e.g., sections 54, 61, 67, 70, 169, 184, 193, 194, 217)","References to repealed legislation (Information Privacy Regulation 2009) requiring historical knowledge","Nested subparagraphs in section 4 with up to 5 levels of indentation (subsection → paragraph → subparagraph → item)","Self-amending provisions in Part 7 where the regulation amends its own content","Transitional provisions that preserve old law for specific financial years while new law applies to others"],"plain_english_summary":"This regulation updates Queensland's privacy reporting rules and replaces the old 2009 regulation.\n\n**What it does:**\n- **Sets up data breach notifications**: It names the Births, Deaths and Marriages registrar as the agency that can share information when there's a serious data breach, and allows all agencies to receive that information.\n- **Updates annual reporting requirements**: It tells the Information Commissioner exactly what statistics to include in their yearly reports to Parliament—things like how many data breach investigations they did, how many times they entered agency premises, how many privacy complaints they handled, and what happened to those complaints.\n- **Names principal officers**: It declares who the \"principal officer\" (the person in charge of privacy compliance) is for various public authorities.\n- **Repeals the old rules**: It scraps the Information Privacy Regulation 2009.\n- **Handles the transition**: It ensures reports for the 2024-2025 financial year still use the old rules, and delays some changes for the 2025-2026 year.\n\n**Who it affects:**\n- Queensland government agencies and public authorities who must handle personal information properly.\n- The Information Commissioner, who must compile detailed statistics.\n- The Births, Deaths and Marriages registrar, who gets a specific role in data breach notifications.\n\n**Why it matters:**\nThis keeps Queensland's privacy laws up to date, ensures transparency about how government handles your personal information, and makes sure agencies properly report when things go wrong with data security."},"summary":{"complexity_score":5,"scope_assessment":{"changed":false,"description":"The regulation stays firmly within its intended scope as an administrative instrument supporting the Information Privacy Act. It replaces the 2009 Regulation on a like-for-like basis, updating references and adding new reporting metrics for data breaches that reflect changes in the parent Act. There is no evidence of scope creep or departure from its original administrative purpose."},"complexity_factors":["Multiple staggered commencement dates (1 July 2025 and 1 July 2026) requiring careful tracking of which provisions are in force","Self-amending structure — the regulation amends itself via Part 7, Division 1, which is unusual and requires reading two versions of the same section","Cross-referencing to multiple external instruments: the parent Act (Information Privacy Act), the repealed 2009 Regulation, the Births Deaths and Marriages Registration Act 2023, and references to QCAT","Transitional provisions for three different reporting periods (2024-25 under old rules, 2025-26 under interim rules, and future years under new rules) create layered reading complexity","Reporting requirements incorporate by reference sections from a repealed regulation, meaning readers must locate a defunct instrument to understand current obligations","Technical legal structure with subsection-level cross-references throughout, making it difficult to read any single provision in isolation"],"plain_english_summary":"This regulation replaces the Information Privacy Regulation 2009 and sets the operational rules for how Queensland government agencies, the Information Commissioner, and the public handle privacy: who can share information for eligible data‑breach notifications, annual public reporting on breaches and complaints (without naming agencies), and reporting to Parliament on compliance and prosecutions. Most provisions start 1 July 2025, with some self‑amendment rules delayed to 1 July 2026, and a transitional rule for 2024–25 reports."},"flash_summary":{"complexity_score":6,"scope_assessment":{"changed":true,"description":"The regulation changes scope relative to the repealed 2009 instrument. It expands and clarifies required parliamentary reporting (adding specific counts and complaint outcome breakdowns and a non‑identification rule) and expressly prescribes the registrar and agencies for breach notifications. Transitional clauses retain old reporting rules for the 2024–25 financial year and some 2025–26 reports, so most practical changes take effect after the stated commencement dates (see s.2, s.4, s.8–10)."},"complexity_factors":["Extensive cross‑references to the Act (notably s.54, s.61, s.67, s.70, s.184, s.193, s.194, s.217 and chapter/part citations) increasing interpretive work","Detailed prescribed reporting metrics (counts of directions, recommendations, authorised‑officer entries, waivers, compliance notices, complaint outcomes) require data collection and aggregation (s.4)","Non‑identification constraint for report details adds redaction/aggregation obligations (s.4(2))","Transitional provisions preserve the repealed regulation for specific reporting years, creating parallel rules for 2024–25 and some 2025–26 reports (s.8–10)","Staggered commencement dates split operational effects across two financial years (s.2)","Repeal and replacement of the earlier regulation and in‑place self‑amendment structure (pt.7, s.7, s.11–12) require comparison against prior instrument to determine current obligations","Duplicated and fragmented drafting within the text may increase uncertainty about authoritative wording"],"plain_english_summary":"This regulation updates administrative rules under the Information Privacy Act. It prescribes which officers and agencies handle eligible data‑breach notifications, sets the information to appear in annual parliamentary reports about the information commissioner’s operations, declares principal offices for listed public authorities, repeals the 2009 regulation and provides transitional and staggered commencement dates.\n\nIt affects state agencies, the information commissioner and Ministers by changing reporting content and timing, adding record‑keeping and reporting tasks, and restricting identification of particular agencies in published report details."}},"importantCases":[],"_links":{"self":"/api/acts/information-privacy-regulation-2025","history":"/api/acts/information-privacy-regulation-2025/history","analysis":"/api/acts/information-privacy-regulation-2025/analysis","conflicts":"/api/acts/information-privacy-regulation-2025/conflicts","importantCases":"/api/acts/information-privacy-regulation-2025/important-cases","documents":"/api/acts/information-privacy-regulation-2025/documents"}}