{"id":"nsw:sl-2019-0391","name":"Privacy and Personal Information Protection Regulation 2019","slug":"privacy-and-personal-information-protection-regulation-2019","collection":"regulation","jurisdiction":"nsw","status":"in_force","isInForce":true,"actNumber":"391 of 2019","makingDate":null,"administeringDepartment":null,"currentVersion":{"id":176602,"registerId":"nsw-nsw:sl-2019-0391-current","compilationNumber":null,"startDate":"2026-04-05","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Name of Regulation","content":"#### 1 Name of Regulation\n\n1 Name of Regulation\n\n> This Regulation is the [Privacy and Personal Information Protection Regulation 2019](/view/html/inforce/current/sl-2019-0391).","sortOrder":0},{"sectionNumber":"2","sectionType":"section","heading":"Commencement","content":"#### 2 Commencement\n\n2 Commencement\n\n> This Regulation commences on the day on which it is published on the NSW legislation website.\n> \n> Note.\n> \n> This Regulation repeals and replaces the [Privacy and Personal Information Protection Regulation 2014](/view/html/repealed/current/sl-2014-0549), which would otherwise be repealed on 1 September 2019 by section 10 (2) of the [Subordinate Legislation Act 1989](/view/html/inforce/current/act-1989-146).","sortOrder":1},{"sectionNumber":"3","sectionType":"section","heading":"Definition","content":"#### 3 Definition\n\n3 Definition\n\n> > (1) In this Regulation—\n> > \n> > the Act means the [Privacy and Personal Information Protection Act 1998](/view/html/inforce/current/act-1998-133).\n> > \n> > Note.\n> > \n> > The Act and the [Interpretation Act 1987](/view/html/inforce/current/act-1987-015) contain definitions and other provisions that affect the interpretation and application of this Regulation.\n> \n> > (2) Notes included in this Regulation do not form part of this Regulation.","sortOrder":2},{"sectionNumber":"4","sectionType":"section","heading":"Prescribed investigative agency","content":"#### 4 Prescribed investigative agency\n\n4 Prescribed investigative agency\n\n> The Inspector of Custodial Services is prescribed for the purposes of paragraph (a) (viii) of the definition of investigative agency in section 3 (1) of the Act.","sortOrder":3},{"sectionNumber":"5","sectionType":"section","heading":"Meaning of personal information","content":"#### 5 Meaning of personal information\n\n5 Meaning of personal information\n\n> For the purposes of section 4 (3) (k) of the Act, the following is not personal information—\n> \n> > (a) information about an individual that is contained in a document kept in a library, art gallery or museum for the purposes of reference, study or exhibition,\n> \n> > (b) information about an individual that is contained in a State record under the control of the State Archives and Records Authority that is available for public inspection in accordance with the [State Records Act 1998](/view/html/inforce/current/act-1998-017),\n> \n> > (c) information about an individual that is contained in archives within the meaning of the [Copyright Act 1968](http://www.legislation.gov.au/) of the Commonwealth.","sortOrder":4},{"sectionNumber":"5A","sectionType":"section","heading":"Certain public sector agencies to be regarded as part of another agency","content":"#### 5A Certain public sector agencies to be regarded as part of another agency\n\n5A Certain public sector agencies to be regarded as part of another agency\n\n> For the Act, section 4B(1)(a), it is declared that Corrective Services NSW, for each of its functions, must be regarded as part of and included in the Department of Communities and Justice.\n> \n> **cl 5A:** Ins 2024 (508), Sch 1.4.","sortOrder":5},{"sectionNumber":"6","sectionType":"section","heading":"Privacy management plan exemptions","content":"#### 6 Privacy management plan exemptions\n\n6 Privacy management plan exemptions\n\n> > (1) A public sector agency (the relevant agency) is exempt from the provisions of section 33 of the Act if the privacy management plan of another agency states that the plan extends to the relevant agency and—\n> > \n> > > (a) the staff of the relevant agency are part of the staff of another public sector agency, or\n> > \n> > > (b) the Minister has, by order published in the Gazette, declared that the relevant agency is taken not to be a separate agency for the purposes of section 33 of the Act but is taken to be included in another public sector agency.\n> \n> > (2) An Official Community Visitor appointed for the purposes of the [Community Services (Complaints, Reviews and Monitoring) Act 1993](/view/html/inforce/current/act-1993-002) is not to be regarded as a separate public sector agency and instead is to be regarded for the purposes of section 33 of the Act as part of and included in the Ombudsman’s Office, but only if the privacy management plan of the Ombudsman’s Office states that the plan extends to an Official Community Visitor.\n> \n> > (3) An Official Community Visitor appointed for the purposes of the [Ageing and Disability Commissioner Act 2019](/view/html/inforce/current/act-2019-007) is not to be regarded as a separate public sector agency and instead is to be regarded for the purposes of section 33 of the Act as part of and included in the Office of the Ageing and Disability Commissioner, but only if the privacy management plan of the Office of the Ageing and Disability Commissioner states that the plan extends to an Official Community Visitor.","sortOrder":6},{"sectionNumber":"7","sectionType":"section","heading":"Public register exemptions","content":"#### 7 Public register exemptions\n\n7 Public register exemptions\n\n> A public sector agency responsible for keeping any of the following public registers is exempt from the provisions of Part 6 of the Act with respect to that register—\n> \n> > (a) the following registers under the [Conveyancing Act 1919](/view/html/inforce/current/act-1919-006)—\n> > \n> > > (i) the General Register of Deeds under section 184C of that Act,\n> > \n> > > (ii) any index of registers under section 198 of that Act,\n> > \n> > > (iii) the Central Register of Restrictions under Part 24 of that Act,\n> \n> > (b) the register of plans under Part 3 of the [Conveyancing (General) Regulation 2018](/view/html/inforce/current/sl-2018-0424),\n> \n> > (c) the Register of Parties under section 58 of the [Electoral Act 2017](/view/html/inforce/current/act-2017-066),\n> \n> > (d) any Register under Part 7 of the [Electoral Funding Act 2018](/view/html/inforce/current/act-2018-020),\n> \n> > (e) the register of justices of the peace under section 11 of the [Justices of the Peace Act 2002](/view/html/inforce/current/act-2002-027),\n> \n> > (f) the Lobbyists Register under section 8 of the [Lobbying of Government Officials Act 2011](/view/html/inforce/current/act-2011-005) and the Lobbyists Watch List under section 12 of that Act,\n> \n> > (g) the Register under Part 6 of the [Real Property Act 1900](/view/html/inforce/current/act-1900-025) (that is, the Torrens Register) and any index kept by the Registrar-General under that Act in connection with it,\n> \n> > (h) the Register of Land Values under section 14CC of the [Valuation of Land Act 1916](/view/html/inforce/current/act-1916-002),\n> \n> > (i) the Water Access Licence Register under section 71 of the [Water Management Act 2000](/view/html/inforce/current/act-2000-092) and the register of approvals under section 113 of that Act.","sortOrder":7},{"sectionNumber":"7A","sectionType":"section","heading":"Delegation by head of public sector agency—prescribed class of persons","content":"#### 7A Delegation by head of public sector agency—prescribed class of persons\n\n7A Delegation by head of public sector agency—prescribed class of persons\n\n> For the Act, section 59ZJ(b), the class of persons who are employed in or by another public sector agency to exercise that agency’s functions under the Act is prescribed.\n> \n> **cl 7A:** Ins 2023 (629), Sch 1","sortOrder":8},{"sectionNumber":"8","sectionType":"section","heading":"Bar Association and Law Society councils exemption","content":"#### 8 Bar Association and Law Society councils exemption\n\n8 Bar Association and Law Society councils exemption\n\n> The Council of the Bar Association and the Council of the Law Society are exempt from all provisions of the Act.","sortOrder":9},{"sectionNumber":"9","sectionType":"section","heading":"Local council CCTV camera exemptions","content":"#### 9 Local council CCTV camera exemptions\n\n9 Local council CCTV camera exemptions\n\n> > (1) A local council is exempt from section 11 of the Act with respect to the collection of personal information by using a CCTV camera that the council installs for the purpose of filming a public place if the camera is positioned so no other land is filmed (unless it is not reasonably practicable to avoid filming the other land when filming the public place).\n> \n> > (2) The local council is also exempt from section 18 of the Act with respect to the disclosure to the NSW Police Force of personal information by way of live transmission from such a CCTV camera.\n> \n> > (3) In this clause, public place has the same meaning as in the [Local Government Act 1993](/view/html/inforce/current/act-1993-030).","sortOrder":10},{"sectionNumber":"10","sectionType":"section","heading":"Repeal and savings","content":"#### 10 Repeal and savings\n\n10 Repeal and savings\n\n> > (1) The [Privacy and Personal Information Protection Regulation 2014](/view/html/repealed/current/sl-2014-0549) is repealed.\n> \n> > (2) Any act, matter or thing that, immediately before the repeal of the [Privacy and Personal Information Protection Regulation 2014](/view/html/repealed/current/sl-2014-0549), had effect under that Regulation continues to have effect under this Regulation.","sortOrder":11}],"analysis":{"flash_summary":{"complexity_score":5,"scope_assessment":{"changed":true,"description":"The Regulation replaces the 2014 Regulation (cl 10(1)) but explicitly preserves any acts or arrangements that had effect under the earlier instrument (cl 10(2)). The current text introduces targeted administrative declarations and exemptions — for example, declaring Corrective Services NSW part of the Department of Communities and Justice for the Act (cl 5A), prescribing a class of persons for delegation (cl 7A), exempting named public registers from Part 6 (cl 7), exempting the councils of the Bar Association and Law Society from the Act (cl 8), and allowing specified local council CCTV collection and live-transmission conduct to be exempted from sections 11 and 18 of the Act (cl 9). Those changes alter the regulation’s practical scope by narrowing or reallocating which bodies and activities are subject to particular provisions of the Act, while preserving continuity of any arrangements that already existed under the prior regulation (cl 10(2))."},"complexity_factors":["Multiple, narrowly-tailored exemptions spanning different statutory regimes (privacy plans, public registers, professional councils, CCTV) (cl 6–9)","Cross-references to the principal Act and several other Acts and instruments (e.g. State Records Act 1998, Conveyancing Act 1919, Local Government Act 1993) (cl 3, cl 5, cl 7, cl 9)","Delegation and inclusion rules that shift administrative responsibility between agencies (cl 5A, cl 6, cl 7A)","Use of ministerial power by Gazette order to alter agency separateness for privacy plan purposes (cl 6(1)(b))","Repeal-and-savings provision preserving legacy effects while replacing the instrument (cl 10), requiring attention to transitional continuity","Targeted definitions of what is not \"personal information\" that affect coverage (cl 5)"],"plain_english_summary":"What this regulation does, mechanically\n\n- Replaces the earlier 2014 regulation and takes effect on publication (cl 2, cl 10(1)). Clause 10(2) keeps any acts or arrangements that had effect under the 2014 regulation continuing under this regulation.\n\n- Identifies and defines how particular items are treated under the Privacy and Personal Information Protection Act 1998 (the Act). The regulation:\n  - Declares that certain material is not \"personal information\" for the Act (information held in libraries, galleries or museums for reference/study/exhibition; State records available under the State Records Act 1998; and certain Commonwealth copyright archives) (cl 5).\n  - Prescribes the Inspector of Custodial Services as an \"investigative agency\" for the Act (cl 4).\n  - Declares that Corrective Services NSW is to be regarded as part of the Department of Communities and Justice for the Act (cl 5A).\n  - Sets targeted exemptions and administrative rules about privacy management plans, registers and other agency operations (cl 6, cl 7, cl 7A, cl 8, cl 9).\n\nWho it affects and who decides\n\n- Affected parties are primarily public sector agencies, and particular classes of public officers and registers. The regulation changes which agencies or bodies must comply with particular parts of the Act and when they are treated together for compliance purposes (for example, Corrective Services NSW is treated as part of another department (cl 5A); certain Official Community Visitors are treated as part of the Ombudsman’s Office or Office of the Ageing and Disability Commissioner, but only if those offices’ privacy plans say so (cl 6(2)–(3))).\n\n- Decision-makers named in the text include agency heads (who can rely on other agencies’ privacy plans) and the Minister (who may declare an agency not to be separate for the purposes of a privacy management plan by Gazette order) (cl 6(1)(b)). The regulation also prescribes a class of persons who may exercise an agency’s functions under the Act (cl 7A).\n\nWhat behaviour changes and practical effects\n\n- Agencies can rely on a single privacy management plan where staff are shared or a Ministerial Gazette order declares inclusion; that reduces the need for duplicate plans for those agencies but requires the receiving agency’s plan to state it extends to the other body (cl 6(1)).\n\n- Some public registers are explicitly taken outside Part 6 of the Act, so the rules in Part 6 do not apply to those registers (cl 7). The regulation lists specific registers (for example, several Conveyancing Act registers, the Torrens Register, certain electoral and lobbying registers) (cl 7(a)–(i)).\n\n- Two professional body councils (the Council of the Bar Association and the Council of the Law Society) are exempt from all provisions of the Act (cl 8).\n\n- Local councils are exempt from the Act’s collection rule (section 11 of the Act) for CCTV cameras that film only a public place and are positioned so they do not film other land, and are also exempt from the disclosure rule (section 18 of the Act) for live transmission of such CCTV footage to NSW Police (cl 9). \"Public place\" uses the Local Government Act 1993 meaning (cl 9(3)).\n\n- Delegation and prescribed personnel rules: the regulation prescribes that persons employed in or by another public sector agency to exercise that agency’s functions under the Act count as a prescribed class for delegation purposes (cl 7A).\n\nOfficial purpose-claims and an evidence-grounded look at trade‑offs\n\n- The text establishes administrative simplifications: it enables one privacy plan to extend to related or co‑employed staff, and it removes particular registers and bodies from parts of the Act. Those mechanics reduce the number of separate privacy plans and the regulatory coverage for specific, named registers and bodies (cl 6, cl 7, cl 8).\n\n- Costs and incentives (as the regulation creates them):\n  - Who pays: public sector agencies bear the compliance decisions and administrative workload (either preparing one plan that covers others, or maintaining separate plans). Where exemptions apply (cl 7, cl 8, cl 9), agencies face lower regulatory compliance costs for the specified activities or registers. Individuals whose information appears in exempt registers will not have those registrations governed by Part 6, because the regulation removes the Part 6 coverage for those registers (cl 7).\n  - Who decides: agency heads and the Minister (via Gazette order) have discretion to consolidate or declare inclusion for privacy-management purposes (cl 6(1)(b), cl 7A). This places choice about how the Act applies (for some bodies) in administrative hands rather than by default statutory separation.\n  - Compliance burden: clauses that permit one plan to cover multiple bodies reduce duplication of plans (cl 6). Prescribed delegations (cl 7A) and declared inclusions (cl 5A) change who must prepare or maintain plans.\n\n- Implementation risk and operational detail: agencies relying on another agency’s plan must ensure the receiving plan explicitly states the extension (cl 6). The Ministerial Gazette mechanism centralises a formal way to alter agency separateness for Part 33 compliance (cl 6(1)(b)), which requires administrative action to effect.\n\n- Effects on private actors and markets: the regulation is narrowly targeted at public sector administrative arrangements and specific public registers. It does not directly regulate private businesses, market prices or ownership. However, by exempting certain registers and bodies from parts of the Act (cl 7, cl 8), it changes the statutory privacy protections that apply to information those registers hold; that is a change in the legal environment without any direct price, competition, or contract rule present in the text.\n\nScope and continuity\n\n- The regulation expressly repeals the 2014 regulation but preserves existing acts and arrangements that had effect under the old regulation (cl 10(1)–(2)). It also contains inserted and updated clauses that declare particular administrative relationships and exemptions (for example, cl 5A and cl 7A are shown as insertions). These provisions change how the Act applies to named agencies and registers and create specified exemptions and delegation rules that agencies must follow (cl 4–9)."},"summary":{"complexity_score":3,"scope_assessment":{"changed":false,"description":"Based on the available information, there is no evidence of scope change from the original intent. The regulation appears to have been updated (in 2023 and 2024) in the ordinary course of refinement, which is consistent with maintaining alignment with its parent Act rather than expanding or narrowing its original purpose. No extraordinary amendments or scope expansions are apparent from the metadata provided."},"complexity_factors":["The document provided contains almost exclusively website navigation metadata and version/status information, with no operative legal provisions visible — limiting substantive analysis","The regulation itself is subordinate legislation (a regulation, not an Act), which typically involves less complexity than primary legislation","Multiple amended versions (2019, 2023, 2024) mean readers must identify the correct version applicable to their situation","The staged repeal mechanism adds a temporal element that requires awareness of the 1 September 2026 sunset date","The regulation operates in conjunction with the parent Privacy and Personal Information Protection Act 1998, meaning readers need to consult multiple documents to understand the full legal framework"],"plain_english_summary":"## Privacy and Personal Information Protection Regulation 2019 (NSW)\n\nThis is a **New South Wales (NSW) government regulation** that supports the *Privacy and Personal Information Protection Act 1998* — the main NSW law that controls how government agencies handle your personal information (things like your name, address, health details, and financial information).\n\n**Who does this affect?**\nAnyone who deals with NSW government agencies — which is essentially every person who lives in, works in, or interacts with NSW government services. It also directly affects NSW public sector employees and agencies who collect, store, use, or share personal information.\n\n**What does it actually do?**\nBecause the document provided is primarily metadata (website navigation and version information) rather than the full text of the regulation's operative provisions, the specific rules it sets out cannot be fully detailed here. What *is* clear is that:\n- It is a **subordinate piece of legislation** (meaning it sits below and works alongside the main Privacy Act, filling in the practical details)\n- It has been **updated twice** since it was first made in August 2019 — once in November 2023 and again in October 2024 — suggesting it has been refined over time\n- It is **scheduled to be automatically repealed** (cancelled) on **1 September 2026** under NSW's Subordinate Legislation Act 1989, which is a standard process to ensure regulations don't become outdated\n\n**Why does it matter?**\nPrivacy regulations like this one determine how safely your personal information is handled when you apply for a licence, access government services, or interact with NSW public bodies. If an agency breaches these rules, you may have rights to complain or seek a review."},"kimi_summary":{"content_quality":"ok","complexity_score":4,"scope_assessment":{"changed":false,"description":"The Regulation appears consistent with its original purpose as a machinery provision supporting the parent Act. The 2019 version replaced the 2014 version to prevent a legislative gap, and subsequent amendments (2023, 2024) have added specific agency delegations and administrative consolidations without expanding the Regulation's fundamental scope. The exemptions and prescriptions remain tightly focused on operationalising the parent Act's privacy framework."},"complexity_factors":["Short length (10 clauses plus definitions)","Minimal defined terms — only 'the Act' and 'public place' are explicitly defined in the Regulation itself","Heavy reliance on external references — cites 15+ other Acts and Regulations, requiring cross-referencing to understand full effect","Nested conditional logic in clauses 6 and 9 (exemptions that apply only if specific conditions in other documents are met)","Multiple agency amalgamation declarations (clauses 5A, 6(2), 6(3)) that create conditional legal status","Amendment history visible in text (clauses 5A and 7A show insertion notes) indicating evolving structure"],"plain_english_summary":"**What this legislation does:**\n\nThis Regulation sets out detailed rules for how the *Privacy and Personal Information Protection Act 1998* (NSW) works in practice. It specifies which organisations must follow the privacy rules, which ones get exemptions, and what counts as \"personal information\" in specific situations.\n\n**Who it affects:**\n\n- **Public sector agencies** in NSW — government departments, local councils, and statutory bodies\n- **Specific organisations** like the Inspector of Custodial Services, Corrective Services NSW, Official Community Visitors, and the Bar Association/Law Society councils\n- **Ordinary people** — because it determines when your personal information is protected (or not protected) by privacy laws\n\n**Key things it does:**\n\n- **Expands the definition of \"investigative agency\"** to include the Inspector of Custodial Services, giving them special privacy law powers\n- **Carves out exceptions** for what counts as personal information — notably excluding certain historical records held in libraries, museums, and archives\n- **Merges agencies for privacy purposes** — Corrective Services NSW is treated as part of the Department of Communities and Justice; Official Community Visitors are treated as part of the Ombudsman's Office or Ageing and Disability Commissioner's Office\n- **Exempts specific public registers** from privacy rules — including land titles (Torrens Register), electoral rolls, lobbyist registers, and water access licences. These remain publicly accessible without privacy restrictions\n- **Allows CCTV exemptions for councils** — local councils don't need to comply with certain privacy rules when filming public places with CCTV, and can share live footage with police\n- **Completely exempts the Bar Association and Law Society councils** from the Act\n- **Sets rules for privacy management plans** — allowing some agencies to be covered by another agency's plan rather than writing their own\n\n**Why it matters:**\n\nThis Regulation determines the practical boundaries of your privacy rights against NSW government agencies. It decides when government bodies can collect, use, and share your personal information without needing to follow the usual privacy safeguards. The exemptions are significant — they keep important public records transparent (like property ownership records) but also mean some government surveillance (like council CCTV) faces fewer restrictions than you might expect."},"issue_detection":{"absurdities":[],"contradictions":[]}},"importantCases":[],"_links":{"self":"/api/acts/privacy-and-personal-information-protection-regulation-2019","history":"/api/acts/privacy-and-personal-information-protection-regulation-2019/history","analysis":"/api/acts/privacy-and-personal-information-protection-regulation-2019/analysis","conflicts":"/api/acts/privacy-and-personal-information-protection-regulation-2019/conflicts","importantCases":"/api/acts/privacy-and-personal-information-protection-regulation-2019/important-cases","documents":"/api/acts/privacy-and-personal-information-protection-regulation-2019/documents"}}