The Act rests on a handful of legal and operational concepts that structure what government actors may do and what constraints apply.

Government sector data and control: Government sector data is any data a government sector agency controls, subject to regulations that may exclude some kinds of data (s 4). Control is defined by possession or custody, and extends to data stored with commercial or cloud providers (s 4(2)). Practically, the Act treats data control as similar to a property-like notion of access and custody; the head of the agency with control is the primary decision-maker on sharing, subject to Ministerial directions where authorised (s 4; s 7).

DAC and data analytics work: The DAC is defined as a part of the Department or another prescribed government sector agency (s 4). Data analytics work is defined as examination or analysis of data to draw conclusions about the data, with examples tying it to assessing Government policy, program management and service delivery (s 4). The DAC can receive data for analytics and share analytic results with government sector agencies, but the Act limits further dissemination of the raw data by the DAC (s 9).

Authorisations and directions: Voluntary sharing is authorised under s 6 for specific purposes (policy improvement, program management and related purposes). Separately, the Minister may direct agencies to provide specified data to the DAC within a specified time if the Premier has advised that the data is required for advancing a Government policy (s 7). The Act requires written directions and a copy to the head (ss 7(1)-(2)). Directions to state owned corporations require Premier approval and consultation with portfolio ministers where relevant, and reimbursement rules kick in where commercial interests would be adversely affected (s 10).

Safeguards and interacting regimes: Part 3 sets the data sharing safeguards. Privacy obligations are paramount: any sharing that involves health information or personal information must comply with the privacy legislation and the Privacy Commissioner maintains functions under that legislation (s 12; s 8(5)). Confidential and commercially sensitive information must be dealt with in a way that complies with contractual or equitable obligations (s 13). Data custody and records management must comply with legal requirements, including State Records Act obligations; where a data recipient uses a non-government contractor to perform analytics, the head of the recipient must ensure appropriate contractual safeguards (s 14(2)). The Act explicitly preserves limitations in the Government Information (Public Access) Act 2009 (GIPA) including Schedule 1 and Schedule 2 exclusions (s 5(2)(b)).

Regulatory power and instruments: The regulations can prescribe additional requirements and may adopt external publications, codes or standards by reference (s 15(1)-(2); s 19). Section 15 anticipates that regulations can make compliance with particular instruments part of the constitution of safeguards, and s 19 allows the Governor to apply or adopt publications as part of the regulatory scaffolding.

Administrative mechanics: The Act enables the Secretary of the Department to report agency non-compliance to Ministers or the Public Service Commissioner and to include incidents in annual reporting (s 17). The Minister can delegate functions to the Secretary except the power of delegation itself (s 18). The Act binds the Crown (s 16) and requires a statutory review five years after assent with a report to parliament (s 20).

These concepts create a framework where sharing is authorised and facilitated but bounded by privacy, confidentiality, records management and regulatory prescription. The Act uses executive directions to compel sharing in government policy contexts while relying on existing statutory regimes and contractual safeguards to govern how shared data is handled.

The Act identifies a defined set of "government sector agencies" and assigns duties, permissions and reporting powers that affect multiple actors. The primary classes of affected parties are government sector agencies (broadly defined), the DAC, Ministers and the Department, heads of agencies, State owned corporations, third-party analytics contractors, and the Privacy Commissioner. The Act does not create private party rights or duties beyond obligations flowing from ownership or contracts, except where third parties act as contractors to agencies.

Government sector agencies: The definition in s 4 is extensive. It includes the DAC, agencies within the meaning of the Government Sector Employment Act 2013, statutory bodies representing the Crown, local government councils (under the Local Government Act 1993), State owned corporations, bodies established for a public purpose by statute, wholly-owned Crown subsidiaries, and any person or body exercising public official functions declared by regulations to be a government sector agency (s 4). That list is comprehensive and includes entities beyond central public service departments. The heads of those agencies bear operational responsibility: the head must ensure compliance with directions (s 7(5)) and ensure contractual protections where external contractors are used (s 14(2)).

Data providers and data recipients: The Act distinguishes the "data provider" as the agency that controls the government sector data and the "data recipient" as the agency to which data is provided (s 4). Both classes have duties under the data sharing safeguards in Part 3, including privacy compliance (s 12), confidentiality obligations (s 13), custody and records-management obligations (s 14), and any regulatory requirements (s 15).

The DAC and the Secretary/Department: The DAC is both a potential recipient and a defined entity for receiving and analysing data (s 4). The Secretary of the Department has reporting powers (s 17) and may receive delegations of the Minister’s functions under s 18. The Minister holds direction-making power (s 7, s 8) but may delegate most functions to the Secretary. The Premier plays a gatekeeping role: a Minister can only direct an agency to provide data to the DAC when the Premier has advised that the data is required to advance a Government policy and the Premier’s certificate is conclusive evidence (s 7(1), (4)).

State owned corporations and universities: State owned corporations are within the scope of the government sector agencies list (s 4(e)), but special procedural steps apply to directing them: directions require Premier approval and consultation with portfolio Ministers and entitle the corporation to reimbursement if the board considers provision not in its commercial interests (s 10). Universities are explicitly protected from directions under s 7(6), meaning the Minister may not compel a university to provide data under the Ministerial direction power in s 7.

Third-party contractors and private storage providers: Control of data includes data stored with commercial storage providers, including cloud storage providers (s 4(2)). Where a data recipient arranges for a non-government person or body to perform analytics, the head must ensure appropriate contractual arrangements are in place to comply with privacy, State Records and Government data security policies (s 14(2)). This creates compliance obligations extending to procurement and contracting processes where private contractors are engaged.

Privacy Commissioner and other regulators: The Privacy Commissioner retains existing functions under privacy legislation and receives mandatory notifications from data recipients who become aware of privacy contraventions or likely contraventions (s 12(2), s 8(5)). State Records and GIPA regimes remain operative and constrain handling and disclosure after sharing (s 5(2)(c), (b)).

Who pays and who decides: Agencies control the datasets and thus decide to share unless a Minister gives a direction under s 7. Costs of preparing and providing data fall to agencies; in the State owned corporation context reimbursement may be available under the State Owned Corporations Act as noted in s 10(2). The Act does not provide a general funding allocation for data sharing; regulatory instruments could impose further procedural or cost requirements (s 15, s 19).

In short, the Act affects a broad set of public bodies, sets duties for both providers and recipients, involves executive decision-making when policy objectives are advanced, and reaches private contractors and commercial providers via obligations on data recipients and the statutory definition of control.

The Act assigns specific duties and limited rights to a number of actors. The duties are largely administrative and compliance-focused rather than punitive.

Duties of data providers and data recipients: Where data is shared under the Act both the data provider and recipient must comply with the data sharing safeguards in Part 3 (s 6(2); s 7(3)(b)). These include:

• Privacy compliance: Health information and personal information contained in shared data must not be collected, used, disclosed, protected, kept, retained or disposed of other than in compliance with the privacy legislation (s 12(1)). If a recipient becomes aware of a contravention or likely contravention of privacy legislation while the information is in its control, the recipient must inform the data provider and the Privacy Commissioner as soon as practicable (s 12(2)).

• Confidentiality and commercial-in-confidence: Recipients must deal with confidential or commercially sensitive information in accordance with the data provider’s contractual or equitable obligations (s 13(1)). The Act defines confidential or commercially sensitive information to include information that a person is required to keep confidential by contract or equity, commercial-in-confidence contract provisions or information whose disclosure would prejudice legitimate business interests (s 13(2)).

• Custody and records management: Providers and recipients must maintain and manage shared data in compliance with any legal requirements concerning custody and control such as GIPA or State Records obligations (s 14(1)). If a recipient arranges for a non-government person to conduct analytics, the head of the data recipient must secure contractual arrangements ensuring compliance with privacy legislation, the State Records Act and Government data security policies (s 14(2)).

Duties and powers of Ministers and the Premier: The Minister may direct an agency to provide specified data to the DAC if the Premier has advised the Minister that the data is required to advance a Government policy (s 7(1)). Directions must be in writing and copied to the head of the agency (s 7(1)-(2)). Upon direction, the specified provider is authorised and required to provide the data and both provider and DAC must comply with applicable safeguards (s 7(3)). The Premier may issue a conclusive certificate that the Premier has advised the Minister that the data is required to advance a Government policy (s 7(4)). The Minister may also direct agencies to provide information to enable the DAC to determine the kinds and number of data sets the agency controls (s 8).

Rights and protections: The Act provides particular process protections and rights:

• A direction under s 7 cannot be given to a university (s 7(6)). This is an explicit right/reservation for universities.

• State owned corporations directed to provide data have procedural protections: directions require Premier approval and consultation with the portfolio Minister (s 10(1)). If the board considers provision not in its commercial interests, reimbursement is available under the State Owned Corporations Act (s 10(2)).

• The Premier’s certificate is conclusive evidence, which is an evidentiary right that simplifies administrative proof for the Minister’s power (s 7(4)).

Administrative duties and reporting: The Secretary of the Department may report failures by agencies to comply with the Act or regulations to the relevant Minister or the Public Service Commissioner and may include incidents in annual reporting under the Government Sector Finance Act (s 17). The Minister must undertake a statutory review five years after assent and table a report within 12 months after the end of that five-year period (s 20).

Delegation and regulation duties: The Minister can delegate functions to the Secretary (except the power of delegation itself) (s 18), and the Governor may make regulations, including adopting external publications and standards, to prescribe additional requirements or safeguards (ss 15, 19).

Constraints on sharing and ongoing compliance obligations: The Act itself makes disclosures lawful in relation to other laws to the extent the Act authorises sharing, but it preserves privacy legislation compliance, GIPA exclusions and State Records obligations as ongoing constraints (s 5(1)-(3), s 5(2)). Thus agencies must ensure that any sharing under this Act remains within the parameters of privacy and records law.

In sum, the statutory duties are: comply with privacy law, respect contractual confidentiality, comply with records-management law, comply with directions when lawfully given, implement contractual protections for third parties, and report compliance failures. Rights include procedural protections for universities and SOCs and an evidentiary role for the Premier’s certificate.

The Act does not institute a standalone enforcement schedule of criminal offences or pecuniary penalties specific to breaches of its provisions. Enforcement and remedial mechanisms present in the Act are primarily administrative and rely on existing statutory enforcement regimes outside this Act.

Absence of express offences in the Act: The text of the Act does not create express criminal offences or specified monetary penalties for contravening the Act’s data sharing obligations. There is no schedule of fines, imprisonment, or civil penalties spelled out in the provided text.

Administrative enforcement levers within the Act: The Act provides administrative mechanisms to encourage and enforce compliance:

• Directions and requirements to comply: The Minister’s power to direct agencies to provide data where the Premier has advised it supports advancement of Government policy is a compulsory mechanism; upon direction the agency “is authorised and required” to provide the specified data (s 7(3)(a)). Failure to comply with a lawful direction is therefore a breach of a statutory requirement, though the Act itself does not set out the direct consequences within this text.

• Reporting by the Secretary: The Secretary of the Department may report any failure by an agency to comply with the Act or regulations to the responsible Minister or the Public Service Commissioner (s 17(1)). The Secretary may also include incidents of failure in annual reporting (s 17(2)). These reporting powers create reputational and administrative pressure on agencies.

• Premier’s certificate and evidentiary effect: The Premier’s certificate that the Premier advised the Minister that data is required for advancing a Government policy is conclusive evidence (s 7(4)). This reduces litigation risk for the executive and gives the Minister a strong administrative basis for directions.

External enforcement regimes and overlap: The Act explicitly preserves and defers to existing enforcement mechanisms in other statutes:

• Privacy enforcement: Data sharing involving health information or personal information must comply with privacy legislation and the Privacy Commissioner retains functions under that legislation (s 5(2)(a); s 8(5); s 12). Enforcement action relating to breaches of privacy law would proceed under the Privacy and Personal Information Protection Act 1998 or the Health Records and Information Privacy Act 2002 and any regulatory, complaint or enforcement pathways available under those Acts.

• Records law and information access: The Act does not alter obligations under the State Records Act 1998 regarding dealing with government sector data after it is shared; compliance with the State Records Act is explicitly preserved (s 5(2)(c); s 14(1)). Likewise, the Act does not authorise disclosure of excluded information under GIPA (s 5(2)(b)).

• Criminal offences: The Act notes in s 14 that Part 6 of the Crimes Act 1900 contains offences concerning unauthorised access to or modification of computer-held data. Those criminal offences would apply to unauthorised access, corruption of data or similar conduct even though they are not offences created by this Act.

Potential but unstated enforcement through regulations: Section 15 permits the regulations to prescribe further requirements for providers and recipients in connection with data sharing, and s 19 allows the Governor to make regulations. While the Act as provided does not itself create offences, the regulations could, depending on drafting, include compliance mechanisms, reporting obligations or administrative penalties. The Act does not say that regulations may create offences or penalties, but the Governor’s broad regulation-making power may be used to prescribe operational requirements (s 19). Any such regulatory instruments would themselves have to be examined for express enforcement provisions.

Practical enforcement consequences: Given the Act’s structure, enforcement will likely be administrative and reputational, backed by external legal consequences under privacy and records laws and potential criminal liability under existing computer-crime provisions. The Secretary’s reporting function, the Minister’s direction-making power and Premier certification are the primary internal instruments to secure compliance.

In short, the Act provides compulsory powers and administrative enforcement levers but contains no standalone offence or penalty regime; enforcement of privacy and unauthorised access will proceed under the existing statutory frameworks cited and under any requirements imposed by regulations.

The Act positions itself as a facilitative overlay that authorises sharing while preserving the operation of several other legal regimes. The text contains express interaction clauses and several cross-references which determine which legal constraints continue to apply.

Statutory authorisation versus other prohibitions: Section 5(1) provides that a disclosure of government sector data by a government sector agency to the DAC or to another government sector agency is lawful for the purposes of any other Act or law that would otherwise prohibit that disclosure, provided the Act authorises the agency to share and the sharing is limited to the authorised purpose. That provision creates a statutory shield against other prohibitions, but it is expressly subject to the Act’s own exceptions in s 5(2).

Privacy legislation remains binding: Section 5(2)(a) makes clear that nothing in the Act authorises agencies to handle health information or personal information other than in compliance with the privacy legislation. Part 3 reinforces this: s 12 requires compliance with the privacy legislation and mandates notifications to the Privacy Commissioner where a recipient becomes aware of a contravention or likely contravention (s 12(2)). Section 8(5) also notes that nothing in s 8 affects or limits the Privacy Commissioner’s functions. Therefore, the Act interoperates with privacy law by enabling sharing but conditioning any handling of personal or health information on existing privacy obligations.

GIPA and excluded information: Section 5(2)(b) prevents the DAC or recipient agencies from disclosing government sector data that is excluded information of an agency specified in Schedule 2 to the Government Information (Public Access) Act 2009, or information described in Schedule 1 to that Act. That means the Act does not displace GIPA’s exclusions. Agencies must therefore consider GIPA’s schedules when sharing data and post-sharing handling remains constrained.

State Records obligations: Section 5(2)(c) and s 14(1) require data handling after sharing to comply with the State Records Act 1998. The Act preserves record-keeping and disposal obligations and treats compliance with State Records law as an ongoing requirement.

Crimes Act offences: S 14 includes a note referring to Part 6 of the Crimes Act 1900 about unauthorised access or modification of computer-held data. While not creating new offences, the Act reminds readers that criminal liability under the Crimes Act continues to apply to unauthorised access or interference.

Cross-references to other Acts for institutional detail: The definitions in s 4 import other statutes to define agency heads and what counts as a government sector agency. For example, the Government Sector Employment Act 2013 is used to define a government sector agency for one category of entities, and the Local Government Act 1993 defines councils included in the Act’s scope (s 4(b), (d)). The definition of the Department names the Department of Finance, Services and Innovation (s 4). The State Owned Corporations Act 1989 is invoked for reimbursement mechanics where a SOC’s board considers providing data not in its commercial interests (s 10(2)).

Regulatory and subordinate instruments: Sections 15 and 19 allow regulations to prescribe additional requirements and to adopt external publications such as codes of practice, guidelines and standards. Those subordinate instruments can therefore create a detailed compliance architecture that integrates with privacy guidelines, government data security policies, State Records policies and other published instruments, and can make compliance with such instruments mandatory under this Act.

Non-exclusivity: Section 5(3) states the Act is not intended to prevent or discourage sharing permitted or required by other Acts. That preserves an agency’s ability to share under other statutory powers or obligations distinct from this Act.

Delegation and administrative law: The Minister may delegate functions to the Secretary (s 18). Standard public-law doctrines and procedural fairness principles are not explicitly addressed in the Act; their application will depend on the nature of particular decisions, including directions under s 7 and the statutory review and reporting framework under s 17 and s 20.

In short, the Act is designed to be an enabling statute that provides express authorisation to share while expressly preserving and depending upon privacy, access, records and criminal law regimes to define the permissible handling, disclosure and potential consequences of misuse.

The text provided contains limited explicit amendment annotations. Two amendment notes appear in the text, and otherwise the Act as presented does not show further amendment history or an editorial chronology beyond commencement.

Recorded amendments in the provided text:

• Section 4: There is an annotation "s 4: Am 2017 No 65, Sch 2.6." This indicates that section 4 was amended by the 2017 amending Act (No 65) at Schedule 2.6. The text of s 4 in the provided material reflects the definition set after that amendment. The amendment note is the only explicit markup indicating legislative change in the body provided.

• Section 17: There is an annotation "s 17: Am 2018 No 70, Sch 4.23." This indicates section 17 was amended by the 2018 amending Act (No 70) at Schedule 4.23. The text of s 17 as supplied appears to be the post-amendment version that authorises the Secretary to report compliance failures and to include incidents in annual reporting.

What the act says about review: Section 20 requires a statutory review of the Act five years after assent, the aim being to determine whether the policy objectives remain valid and whether the terms remain appropriate. The report of that review is to be tabled in each House of Parliament within 12 months after the end of the five-year period (s 20(1)-(3)). This provides a built-in mechanism for future amendment by requiring formal review and parliamentary scrutiny.

Regulations and future change: Sections 15 and 19 give the Governor power to make regulations, and expressly allow those regulations to adopt external publications or standards. The Act anticipates that finer-grain obligations and potentially further procedural changes may be implemented by regulation, providing an ongoing route for change without amending the principal Act.

Limitations of the provided amendment history: The supplied text does not include a full legislative history, explanatory memoranda or the text of the amending instruments. The two amendment notes identify changes to s 4 and s 17 only. To construct a full amendment history a practitioner would need to consult the NSW consolidated legislation database, the NSW Legislation website's historical versions, the relevant amending Acts (2017 No 65 and 2018 No 70) and any subordinate instrument histories for regulations made under ss 15 and 19.

In practice, compliance and legal advice should verify whether regulations made under this Act or further amending Acts have imposed additional obligations or altered definitions since the annotations shown. The Act itself requires the Minister’s review after five years; the outcomes of that review may have led to further amendments not visible in the provided text.

The text supplied contains no case law citations, judicial decisions, or references to litigation under this Act. The Act does not list cases, and no judgments are quoted or named in the provided material.

Consequently, from the supplied source one must record that no litigation history is reflected in the text. The Act interacts with other regimes that do have enforcement and case law histories, such as the Privacy and Personal Information Protection Act 1998, the Health Records and Information Privacy Act 2002, the Government Information (Public Access) Act 2009 and the State Records Act 1998. Litigation or tribunal decisions interpreting those Acts and their interactions with data sharing may be relevant in practice but are not cited in the text and thus are outside the scope of this source-grounded note.

If a practitioner requires precedents on how courts or tribunals have interpreted the legal effect of statutory directions to agencies, the evidentiary impact of executive certificates, or the interplay between statutory authorisation and privacy obligations, they should obtain and review relevant case law and tribunal decisions concerning the privacy Acts, GIPA, State Records Act and administrative law on ministerial directions. The Act’s text itself offers no litigation record to analyse.

The Act contains several features that produce practical risks and operational nuances. These are not character judgements but points where an agency may face legal, administrative, or resource consequences if not anticipated.

1. Statutory authorisation is limited and conditional. Section 5(1) renders a disclosure lawful for purposes of other statutes only if the Act provides authorisation and the disclosure is for the authorised purpose. Agencies must ensure the purpose of sharing aligns precisely with the statutory authorisation invoked (for example the purposes in s 6) or with the scope of a Ministerial direction (s 7). A mismatch between stated purpose and statutory authorisation risks undermining the s 5(1) shield.

2. Privacy obligations remain primary. The Act repeatedly reserves privacy legislation (s 5(2)(a), s 12). Sharing that includes personal or health information remains subject to the privacy Acts and any codes or directions under them. Section 12(2) creates a duty to notify the data provider and the Privacy Commissioner if a recipient becomes aware of a contravention or likely contravention. Failure to comply with privacy law will be enforced under the privacy legislation, not under this Act, and may result in independent remedies or regulatory action.

3. GIPA exclusions and Schedule 1/Schedule 2 material are expressly protected. Section 5(2)(b) ensures that disclosures of excluded information remain unauthorised. Agencies must screen datasets for excluded content under GIPA Schedules before sharing.

4. Control extends to cloud and commercial storage. Section 4(2) expressly takes control to include data held by commercial storage providers. Agencies must therefore consider contractual arrangements with cloud providers when assessing whether they control or can share data. This may impose time and procurement implications.

5. Ministerial directions carry a conclusive Premier certificate. Section 7(4) makes the Premier’s certificate that a data provision is required for advancing Government policy conclusive evidence. This reduces the avenues for contesting the policy-ground justification of a direction administratively, which alters the evidentiary posture in any review. Agencies facing a direction should be prepared for limited scope to litigate the policy necessity on evidentiary grounds.

6. No express penalties in the Act itself. The Act lacks an internal penalty regime. Enforcement therefore depends on other Acts, reporting (s 17), ministerial oversight, and criminal or privacy law where applicable. This means compliance primarily carries administrative and regulatory risk rather than specified statutory fines in this Act.

7. Need for contractual safeguards prior to engaging non-government analytics providers. Section 14(2) places an onus on the head of a data recipient to have appropriate contractual arrangements in place before providing data to a non-government person. The Act does not prescribe the content of those contracts, but failure to have them may create privacy and State Records non-compliance.

8. Direction to State owned corporations triggers commercial considerations. Directions to SOCs require Premier approval and portfolio Minister consultation (s 10(1)). Where a board considers data provision not in the corporation’s commercial interests, reimbursement provisions in the State Owned Corporations Act apply (s 10(2)). Practitioners should map the interplay with that Act to determine cost recovery and procedural steps.

9. Universities are excluded from Ministerial compulsion. Section 7(6) prevents directions under s 7 being given to universities. Agencies contracting with universities should note that universities have this statutory protection.

10. Regulations may adopt external instruments. Section 19 allows the regulations to adopt external publications and standards by reference. Agencies must monitor not just Act amendments but also regulations and adopted instruments which could impose additional operational requirements.

11. Reporting may create reputational risk. Section 17 empowers the Secretary to report agency failures to Ministers and to include incidents in annual reports. Even where no penalty is imposed, public or executive disclosure may have career or funding implications for agencies.

12. The Act binds the Crown but is not an exclusive source of sharing power. Section 16 binds the State and extends as far as legislative power permits to Commonwealth and other States. Yet s 5(3) clarifies the Act is not intended to prevent sharing under other statutes, producing potential overlap that requires careful statutory mapping before sharing.

Those "gotchas" indicate areas requiring specific procedural controls: purpose alignment, privacy screening, contractor procurement, records compliance, and tracking of regulations and Premier certificates.

This section offers a practical, source-grounded compliance checklist and process map built from the Act’s provisions. It is not legal advice but a step-by-step operational approach aligned to statutory requirements in the text.

1. Identify whether the dataset is “government sector data” and who controls it. Confirm control under s 4(2) including whether the data are stored in commercial/cloud systems. Document possession, custody and contractual arrangements with storage providers.

2. Screen the data for exclusions and sensitive categories. Before any sharing assess:

   • whether the data contain health information or personal information (s 4 definitions; s 12),
   • whether any portion is excluded information under GIPA Schedule 2 or described in GIPA Schedule 1 (s 5(2)(b) reference),
   • whether any material is confidential or commercially sensitive per s 13(2).

3. Establish legal basis for sharing. Determine whether sharing is:

   • voluntary under s 6 for one of the specified purposes in that section (policy analytics, program management, or prescribed purposes), or
   • pursuant to a Ministerial direction under s 7 (in which case confirm the Premier’s advice/certificate and obtain the written direction and copy for the agency head).

4. Document purpose alignment. Ensure the share request and data use are tightly aligned with the statutory purpose relied upon. Section 5(1) makes lawful disclosure conditional on the purpose matching the authorisation.

5. Privacy compliance plan. If the data contain personal or health information, require documented compliance with privacy legislation:

   • maintain records demonstrating compliance with collection/use/disclosure/retention/disposal obligations (s 12(1)),
   • implement incident detection and notification procedures so that, if a recipient becomes aware of a contravention or likely contravention, the recipient notifies the data provider and the Privacy Commissioner as soon as practicable (s 12(2)).

6. Contractual and confidentiality protections. For data containing confidential or commercially sensitive information, secure contractual covenants or formal acknowledgements that bind recipients to the provider’s contractual/equitable obligations (s 13(1)). Where the recipient is to provide data to a non-government analytics provider, ensure written contracts require compliance with privacy legislation, State Records Act obligations and applicable Government data security policies (s 14(2)).

7. Records management and custody controls. Ensure the handling, retention, disposal and custody of shared data comply with legal obligations, including State Records and GIPA as applicable (s 14(1); s 5(2)(c)). Maintain an auditable trail of who had access and when.

8. Address third-party storage and processing. Where data are physically or virtually stored with commercial providers, check contractual terms regarding disclosure, security, cross-border transfer, and data destruction. The statutory definition of control includes data in commercial storage providers, so contractual consent and security must be aligned to the sharing decision (s 4(2)).

9. For State owned corporations, follow procedural requirements. If a direction is sought or given, obtain Premier approval and consult the portfolio Minister as required (s 10(1)). If the SOC’s board considers provision not in its commercial interests, calculate reimbursement entitlements under the State Owned Corporations Act and document invoices and cost recovery per s 10(2).

10. For university-held data note prohibition on Ministerial compulsion. The Minister cannot issue a direction under s 7 to a university (s 7(6)), so alternative legal bases must be used for university-held datasets.

11. Retain ministerial directions and Premier certificates. Keep the written direction, the copy provided to the agency head, and any Premier certificates establishing the policy necessity (s 7(1)-(4)). These documents provide evidentiary protection and will be necessary for audit or review.

12. Regulatory watch and instrument alignment. Monitor regulations made under ss 15 and 19 to ensure compliance with any newly prescribed requirements, codes of practice, guidelines or adopted publications. Include checks for versions of adopted instruments as s 19 allows adoption of publications "as in force at a particular time or from time to time."

13. Incident response and reporting. Implement processes for internal reporting that allow the head of the agency to ensure contractual safeguards are in place before sharing, to detect contraventions, and to report to the Secretary where failures occur. Be prepared for the Secretary’s right to report failures to Ministers or the Public Service Commissioner and to include incidents in annual reporting (s 17).

14. Governance and delegations. Confirm internal delegations align with the Act’s delegation architecture; the Minister may delegate functions to the Secretary except the power of delegation itself (s 18). Ensure accountability lines for decisions to share, to accept directions, and to supervise third-party contracts.

15. Audit trail and review. Keep auditable logs of data shared, purpose justifications, contractual arrangements, access lists, security assessments and disposal actions. The Act’s mandated five-year review (s 20) and potential public reporting of non-compliance suggest that robust documentation will reduce administrative risk.

Checklist summary mapped to provisions:

• Establish control and ownership: s 4(2).
• Purpose and statutory authorisation: s 6 and s 7.
• Privacy screening and notification obligations: s 12.
• Confidentiality and contractual compliance: s 13, s 14(2).
• Records management: s 14(1); s 5(2)(c).
• Ministerial/Premier documents: s 7(1)-(4).
• SOC procedural steps and reimbursement: s 10.
• Regulatory compliance: s 15, s 19.
• Reporting obligations to Secretary and for annual reporting: s 17.
• Delegations: s 18.
• Review timetable: s 20.

Following this process will align an agency’s operational practices with the duties and constraints in the Act as provided in the source text. Agencies should also cross-check against active privacy guidance, GIPA practice notes and State Records policies and any regulations made under this Act for additional requirements.