Privacy and Personal Information Protection Regulation 2019

The Regulation operates by means of definition, prescription and exemption. Its central legal techniques are:

• Prescription of agencies and classes. The Regulation adds particular bodies to lists used in the Act, for example prescribing the Inspector of Custodial Services as an investigative agency (cl 4) and declaring Corrective Services NSW to be part of the Department of Communities and Justice for section 4B(1)(a) purposes (cl 5A).
• Exclusionary definitions of "personal information". Clause 5 narrows the Act’s definition in a targeted way by excluding information about an individual when that information is held in certain public, archival or reference collections: libraries, art galleries, museums, State Records accessible under the State Records Act 1998, and archives as defined under the Commonwealth Copyright Act 1968 (cl 5). The exclusion applies "for the purposes of section 4(3)(k) of the Act", so it is a targeted interpretive rule rather than a free‑standing re‑definition.
• Agency aggregation for privacy management plans. Clause 6 creates mechanisms through which one entity’s privacy management plan can cover another entity: either because staff are part of another agency or because the Minister issues a Gazette order saying the relevant agency is not separate for section 33 purposes. It also provides that Official Community Visitors are not separate agencies for s 33 where the relevant office’s privacy plan expressly extends to them (cl 6(2)-(3)).
• Targeted register exemptions. Clause 7 removes the Part 6 obligations of the Act with respect to specified public registers. This is a list‑based exemption affecting registers under a range of Acts and Regulations (Conveyancing Act 1919, Conveyancing (General) Regulation 2018, Electoral Act 2017, Electoral Funding Act 2018, Justices of the Peace Act 2002, Lobbying of Government Officials Act 2011, Real Property Act 1900, Valuation of Land Act 1916, Water Management Act 2000) (cl 7).
• Delegation scope. Clause 7A prescribes, in the context of section 59ZJ(b) of the Act, that persons employed in or by another public sector agency count as a prescribed class who may be delegated functions (cl 7A).
• Discrete policy exemptions. Clause 8 wholly exempts the Councils of the Bar Association and Law Society from the Act. Clause 9 permits local councils to use CCTV filming of public places without complying with collection and disclosure rules in sections 11 and 18 of the Act provided placement limitations are satisfied.

The Regulation also contains procedural elements: commencement (cl 2), a short definition clause that points to the Act and the Interpretation Act for interpretive context (cl 3), and transitional savings preserving pre‑existing effects under the old Regulation (cl 10(2)). Notes in the Regulation are expressly not part of the law (cl 3(2)), signalling that only the operative clauses govern legal effect.

Mechanically, then, the Regulation does not change the Act’s core architecture but overlays it: it narrows some privacy protections (by excluding some materials and exempting named bodies/activities), clarifies administrative allocation of responsibilities, and prescribes who may exercise or be delegated certain Agency functions under the Act.

The Regulation affects a defined set of actors across the NSW public sector, a small set of professional bodies and various categories of records. The principal affected parties, derived from the Regulation’s clauses, include:

• Public sector agencies generally, because the Regulation modifies how core provisions of the Act apply to particular agencies or activities (see cl 6, cl 7A). Agencies must check whether they are included in someone else’s privacy management plan or whether the Minister has issued a Gazetted order altering their status under s 33 (cl 6).
• Corrective Services NSW and the Department of Communities and Justice. Clause 5A declares that Corrective Services NSW, for each of its functions, is to be regarded as part of and included in the Department of Communities and Justice for s 4B(1)(a) of the Act. This affects which entity is treated as the agency responsible for duties under the Act for those functions.
• Inspectors and investigators. The Inspector of Custodial Services is expressly prescribed as an investigative agency for the Act (cl 4). That designation changes the class of bodies recognised as investigative agencies under the Act.
• Official Community Visitors and the offices that appoint them. Clauses 6(2)-(3) make Official Community Visitors not separate agencies for privacy management plan purposes, but only if the appointing office’s privacy management plan states it extends to that visitor. The two statutory schemes specified are the Community Services (Complaints, Reviews and Monitoring) Act 1993 and the Ageing and Disability Commissioner Act 2019 (cl 6).
• Local councils. Clause 9 grants local councils narrow exemptions from section 11 (collection) and section 18 (disclosure) of the Act where the council installs a CCTV camera filming a public place and positions it so no other land is filmed, subject to a reasonableness qualification.
• The NSW Police Force. Clause 9(2) creates an exemption for disclosure by live transmission from such council CCTV to the NSW Police Force (cl 9(2)).
• Providers and users of specified public registers. Agencies responsible for the listed registers are exempt from Part 6 of the Act with respect to those registers (cl 7). A non‑exhaustive list of implicated registers includes the Torrens Register (Real Property Act 1900) and indexes under the Conveyancing Act 1919, the Register of Parties (Electoral Act 2017), various electoral funding registers, the Lobbyists Register, the Register of Land Values (Valuation of Land Act 1916) and the Water Access Licence Register (Water Management Act 2000) (cl 7).
• Bar Association and Law Society Councils. Clause 8 exempts those Councils from all provisions of the Act. Practically, those Councils are not subject to the Act’s obligations.
• State Archives and bodies maintaining public records. Clause 5 excludes information that is a State record under the control of the State Archives and Records Authority and available for public inspection under the State Records Act 1998 from being personal information for the Act’s section 4(3)(k) purposes (cl 5(b)).
• Libraries, galleries, museums and holders of archives under the Copyright Act. Clause 5(a) and (c) exclude certain information contained in documents kept for reference, study or exhibition, and archives as defined by the Commonwealth Copyright Act, from amounting to personal information in the specified context (cl 5(a), (c)).
• Persons whose personal information is recorded in the specified registers or archival collections. For these people, certain statutory privacy protections under the Act (notably Part 6 rights) will not apply to the records and some items may be excluded from the Act’s definition of personal information (cl 5, cl 7).

The Regulation therefore reallocates which public entities and classes of records are governed by specific provisions of the Act. It shifts compliance obligations from some entities to others by declaring inclusion in another agency’s privacy management plan or by wholesale exemption. Those who operate or oversee the listed registers and the agencies named are directly affected; individual data subjects are affected indirectly through narrowing of coverage over specific records and by the exceptions for CCTV collection and disclosure in the local government context.

The Regulation does not create a new suite of duties or rights across the board. Instead, it adjusts who owes duties under the Act and when certain parts of the Act apply. The key operational modifications to duties and rights are as follows, with clause references:

• Agency status and responsibility. Clause 5A declares Corrective Services NSW to be part of and included in the Department of Communities and Justice for section 4B(1)(a) purposes. That means for the Act’s purposes the Department will be treated as the accountable agency for Corrective Services functions, affecting which entity must meet duties under the Act (privacy management plans, access, correction obligations) for those functions (cl 5A).

• Investigative agency designation. By prescribing the Inspector of Custodial Services as an investigative agency, clause 4 confers on that Inspector the status recognised in the Act for investigative agencies. The Act’s investigative‑agency‑linked rights or processes now apply to that Inspector (cl 4).

• What is and is not "personal information" for a particular sub‑section. Clause 5 states that, for the purposes of section 4(3)(k) of the Act, certain materials are not to be treated as personal information. That shifts the boundary of what material attracts the Act’s protections and obligations in that specific interpretive context.

• Privacy management plan coverage. Clause 6 sets out when a public sector agency is exempt from the section 33 requirement to have its own privacy management plan because another agency’s plan extends to it. The exemption applies where the staff of the relevant agency are part of the staff of another public sector agency, or where a Minister has declared, by order published in the Gazette, that the relevant agency is not separate for section 33 purposes (cl 6(1)). It also treats Official Community Visitors as part of the Ombudsman’s Office or the Office of the Ageing and Disability Commissioner for s 33 purposes, but only if those offices’ privacy management plans expressly state the plan extends to the Official Community Visitor (cl 6(2)-(3)). The practical duty shifted is the obligation to prepare and maintain a privacy management plan; the right to rely on a single plan accrues to the designated agency and its staff.

• Register‑specific duties/rights removed. Clause 7 exempts agencies responsible for the listed registers from Part 6 of the Act with respect to those registers. Part 6 of the Act governs certain rights and obligations associated with public registers, including (but not limited to) collection, access, correction and notifiable data handling rules , the Regulation removes those Part 6 obligations for the listed registers, so rights or duties that would otherwise attach under Part 6 do not apply to them (cl 7).

• Delegation to employees of other agencies. Clause 7A prescribes the class of persons who are employed in or by another public sector agency to exercise that agency’s functions under the Act, for the purposes of section 59ZJ(b). This affects who may be delegated functions by the head of a public sector agency, widening the permissible delegate class to include persons employed in or by another public sector agency (cl 7A).

• Professional association Councils outside the Act. Clause 8 exempts the Council of the Bar Association and the Council of the Law Society from all provisions of the Act. Those Councils therefore do not owe duties under the Act and affected individuals cannot rely on the Act with respect to those Councils’ actions or records (cl 8).

• Local council CCTV collection and disclosure. Clause 9 creates narrow rights for local councils to collect personal information via CCTV of public places without contravening section 11 of the Act, if the camera is positioned to avoid filming other land (unless it is not reasonably practicable to do so) (cl 9(1)). It also allows disclosure by live transmission to the NSW Police Force without engaging section 18’s restrictions (cl 9(2)). The positioning constraint is a material duty on council design and deployment of cameras.

Overall, the Regulation transfers, limits or clarifies duties and rights by declaring which bodies count as agencies, what counts as personal information in specified circumstances, and which registers or activities are outside particular Act requirements. For duties that remain with agencies under the Act, the Regulation does not supplant or restate those obligations; it only alters who is subject to them or the scope to which they apply. The Regulation itself contains no new penalty provisions or enforcement powers; it reshapes the Act’s application to the named persons and records (see cl 10(1)-(2) for repeal and savings mechanics).

The Regulation does not specify any penalties or novel enforcement mechanisms. It operates principally through prescription and exemption: identifying which bodies are investigative agencies, which records are not personal information for a specific subsection, which agencies are aggregated for privacy management plan purposes, and which registers or bodies are exempt from particular parts of the Act. Because the Regulation is advisory and declaratory rather than penal, enforcement consequences arise only through the Act’s existing enforcement architecture as it applies (or does not apply) to the entities and records listed.

Concrete points from the instrument:

• No fines, offences or enforcement protocols are created by the Regulation itself. There are no clause‑level penalty provisions in the text provided.
• Where the Regulation exempts an entity or register from a provision of the Act (for example, Part 6 or sections 11 or 18), that effect is a removal of the Act’s duties for that entity/activity; consequences for non‑compliance must be sought in the Act for any remaining applicable provisions. In short, the Regulation reduces the Act’s reach for specified matters rather than imposing separate sanctions under the Regulation.
• The practical enforcement effect is therefore indirect and binary: if the Regulation causes a body or activity to fall outside a particular provision of the Act, enforcement action under that provision cannot be taken against the body or activity in respect of the exempted matter because the statutory requirement no longer applies to it. Conversely, where the Regulation prescribes an agency (for example, the Inspector of Custodial Services under cl 4), the Act’s powers and remedies that attach to investigative agencies will be available for that prescribed body as per the Act’s mechanisms.
• Administrative decision‑making remains meaningful: the exemption for local council CCTV requires the camera to be positioned so no other land is filmed, unless it is not reasonably practicable to avoid filming other land (cl 9(1)). That phrase introduces a reasonableness judgment into whether the exemption applies. Enforcement of the Act’s coverage will therefore depend in practice on administrative recordkeeping and, where contested, evidentiary demonstration that positioning complied with the exemption or that it was not reasonably practicable.
• The Regulation preserves prior regulatory effects via a savings clause (cl 10(2)), ensuring continuity of administrative arrangements from the 2014 Regulation to this instrument where applicable. Enforcement actions begun under the old Regulation will likely continue to be assessed in light of the transitional saving, rather than being extinguished by the repeal.

Practitioners should therefore look to the Act itself for the substantive enforcement and penalty regime and treat this Regulation as a device that alters whether and how those enforcement provisions can be invoked against particular actors or for particular records or activities.

The Regulation explicitly cross‑references and interacts with multiple statutes and subordinate instruments, creating a web of interdependencies that determine where privacy obligations apply and where they do not. The Regulation relies on the Act for its operative scope and repeatedly ties its clauses to particular Act provisions (for example, section 4(3)(k), section 33, section 4B(1)(a), section 59ZJ(b), sections 11 and 18). It also links to a range of other NSW and Commonwealth laws; the key interactions are as follows:

• Privacy and Personal Information Protection Act 1998 (the Act). The Regulation repeatedly modifies how the Act operates: it prescribes agencies for definitions within the Act (cl 4), specifies what is not "personal information" for s 4(3)(k) (cl 5), sets rules for the operation of s 33 (privacy management plans) by allowing one agency’s plan to extend to another (cl 6), prescribes a class for delegation under s 59ZJ(b) (cl 7A), exempts Councils from the Act (cl 8), and creates local council exemptions from sections 11 and 18 (cl 9).

• Interpretation Act 1987. Clause 3(1) directs readers to the Act and the Interpretation Act 1987 for definitions and provisions that affect interpretation. This signals that interpretive aids and definitions from those Acts must be used when construing the Regulation.

• Subordinate Legislation Act 1989. Clause 2 contains a note that the Regulation repeals and replaces the 2014 Regulation, which would otherwise be repealed on 1 September 2019 by section 10(2) of the Subordinate Legislation Act 1989. The commencement mechanism therefore interacts with that Act’s automatic repeal scheme.

• State Records Act 1998. Clause 5(b) excludes from "personal information" material that is a State record under the control of the State Archives and Records Authority and is available for public inspection under the State Records Act. This creates an interaction in which records open for inspection under the State Records Act are outside the Act’s personal information regime for this specific subsection (cl 5(b)).

• Commonwealth Copyright Act 1968. Clause 5(c) excludes information contained in "archives" within the meaning of the Copyright Act 1968. The Regulation therefore relies on the Commonwealth statute’s definition to determine whether particular archival material is excluded from the Act’s personal information coverage (cl 5(c)).

• Conveyancing Act 1919 and Conveyancing (General) Regulation 2018. Clause 7 exempts specific registers under the Conveyancing Act (General Register of Deeds, indexes under s 198, Central Register of Restrictions) and the register of plans under the Conveyancing (General) Regulation 2018 from Part 6 of the Act (cl 7(a)-(b)). This alters how privacy protections apply to land transaction records.

• Electoral Act 2017 and Electoral Funding Act 2018. Clause 7 exempts the Register of Parties and registers under electoral funding law (cl 7(c)-(d)). The consequence is that those electoral registers are outside Part 6’s obligations.

• Justices of the Peace Act 2002 and Lobbying of Government Officials Act 2011. Clause 7(e)-(f) exempts the Register of Justices of the Peace and the Lobbyists Register/Watch List from Part 6, intersecting with these statutory schemes.

• Real Property Act 1900. Clause 7(g) exempts the Torrens Register and indexes kept by the Registrar‑General from Part 6, affecting how privacy rules apply to land title records.

• Valuation of Land Act 1916 and Water Management Act 2000. Clause 7(h)-(i) exempts the Register of Land Values and the Water Access Licence Register and register of approvals under the Water Management Act 2000 respectively.

• Community Services (Complaints, Reviews and Monitoring) Act 1993 and Ageing and Disability Commissioner Act 2019. Clause 6 treats Official Community Visitors appointed under those statutes as part of the Ombudsman’s Office or the Office of the Ageing and Disability Commissioner respectively for s 33 purposes where the relevant privacy management plan states it extends to them. This creates a dependency on the administering office to extend its plan to capture those visitors.

This network of cross‑references means the Regulation often operates by deferring to other statutes’ definitions or administrative regimes. Practitioners should note that registers that are legally public under other Acts (for example, State Records Act or Real Property Act systems) may be outside certain privacy controls under the Act because of the Regulation’s exemptions. Similarly, delegation arrangements and agency attribution are shaped by the Regulation’s declared links between agencies and by other statutes that create the positions or registers referenced.

The Regulation itself records limited amendment history in the text supplied. Two insertions are explicitly noted:

• Clause 5A (Certain public sector agencies to be regarded as part of another agency) was inserted in 2024: the note reads "cl 5A: Ins 2024 (508), Sch 1.4." This clause declares Corrective Services NSW to be part of and included in the Department of Communities and Justice for the purposes of section 4B(1)(a) of the Act (cl 5A).
• Clause 7A (Delegation by head of public sector agency,prescribed class of persons) was inserted in 2023: the note reads "cl 7A: Ins 2023 (629), Sch 1." Clause 7A prescribes as a class of persons those who are employed in or by another public sector agency to exercise that agency’s functions under the Act (for s 59ZJ(b)).

The Regulation also explicitly repeals the Privacy and Personal Information Protection Regulation 2014 (cl 10(1)). Clause 2(1) explains commencement aligns with publication on the NSW legislation website and contains a note that the 2014 Regulation would otherwise have been repealed automatically on 1 September 2019 by section 10(2) of the Subordinate Legislation Act 1989. Clause 10(2) contains a savings provision preserving any act, matter or thing that had effect under the 2014 Regulation immediately before its repeal, so prior administrative effects continue under this instrument.

Other historical signals:

• Clause 3(1) states that "the Act means the Privacy and Personal Information Protection Act 1998" and notes that the Act and the Interpretation Act 1987 contain definitions affecting interpretation and application. This indicates the Regulation was drafted to sit within an existing statutory scheme and to be read alongside those Acts.

No further amendment chronology, dates of prior insertions, or schedules of historical textual changes are provided in the Regulation text supplied beyond the two insertion notes and the repeal of the 2014 Regulation. Users requiring a comprehensive legislative history should consult the NSW legislation website version history or other official amendment records to trace prior iterations of clauses, the timing of the 2019 instrument’s enactment and the insertions in 2023 and 2024 referenced in the insertion notes.

The Regulation text contains no references to judicial or administrative decisions and does not specify any litigation history. There are no cases named or reported in the instrument itself. Therefore, based solely on this Regulation as provided, there is no recorded litigation history to summarise.

Implications of that absence for practice:

• Interpretive uncertainty. Where the Regulation introduces phrases that require fact‑sensitive judgments (for example, "positioned so no other land is filmed" and "unless it is not reasonably practicable" in cl 9), the absence of settled judicial interpretation means administrative bodies and advisers must make best‑practice determinations and maintain evidentiary records. Future disputes about whether a particular set of CCTV placements qualified for the exemption could produce litigation, but none is recorded here.
• Novelty risk for new clauses. The insertions noted (cl 7A in 2023 and cl 5A in 2024) have not, in this Regulation, been accompanied by any recorded legal challenges or authoritative administrative determinations contained in the text. Parties affected by those changes (for example, Corrective Services NSW and the Department of Communities and Justice, or agencies adjusting delegation arrangements) must operate in the absence of settled case law interpreting the new statements.
• Enforcement pathways remain anchored in the Act. Because the Regulation does not itself create penalty or enforcement mechanisms, disputes about enforcement will be litigated (if at all) under the Act’s regimes. The Regulation’s exemptions and prescriptions will therefore be applied in that litigation context where relevant.

Practitioners should therefore treat the Regulation as a current source of statutory rule but recognise that application to borderline factual scenarios , for example, whether a particular public register falls within the exemption, or whether a council’s CCTV placement was "reasonably practicable" to avoid filming other land , may be litigated in the future. To manage that procedural risk, maintain contemporaneous decision records, technical design documents (for CCTV), and, where a privacy management plan is relied on to extend to another agency or Official Community Visitors, documentary confirmation that the privacy plan expressly includes them (cl 6(2)-(3)).

The Regulation contains a number of specific drafting features and narrow exemptions that can produce unexpected compliance gaps or operational traps if practitioners, agencies or data subjects do not pay close attention to the precise wording. Key "gotchas" grounded in the text:

• Limited scope of the "not personal information" exclusions (cl 5). Clause 5 does not say all material in libraries, museums, galleries, State Records or archives is outside the Act’s reach; it excludes information "contained in a document kept in a library, art gallery or museum for the purposes of reference, study or exhibition" and similar State record/archive references for the purposes of section 4(3)(k) of the Act. If a document in a library is not held for those purposes, or is duplicated elsewhere under a different classification, the exclusion may not apply. The exclusion is expressly tied to a specific subsection of the Act, not a wholesale redefinition of personal information.

• Privacy management plan coverage requires express extension (cl 6). Official Community Visitors are to be regarded as part of the Ombudsman’s Office or the Office of the Ageing and Disability Commissioner for s 33 only "if the privacy management plan of [that Office] states that the plan extends to an Official Community Visitor" (cl 6(2)-(3)). A mere administrative assumption is insufficient. The privacy management plan must be explicit. Agencies that rely on coverage without a clear statement risk non‑compliance.

• Ministerial Gazette orders as a route to exemption (cl 6(1)(b)). Clause 6 allows a Minister to declare by Gazette order that a relevant agency is "taken not to be a separate agency for the purposes of section 33". That is an administrative lever that shifts compliance obligations but requires a published order. If agencies assume a de facto integration without confirming a Gazette order, they risk mismatch between practice and statutory effect.

• Part 6 exemptions are register‑specific and limited (cl 7). Clause 7 removes Part 6 obligations only "with respect to" the listed registers. Agencies should not assume a global exemption; they must identify whether the activities or records they handle are part of a named register and, if so, that exempted Part 6 obligations no longer apply to those registers. Misclassification can leave other records still subject to Part 6.

• Bar Association and Law Society Councils are exempt from all Act provisions (cl 8). This is a broad exemption. Where individuals or third parties seek rights under the Act in relation to these Councils (for example, access or correction), the Act is not available as a remedy against those Councils. Practitioners must look to other regulatory or contractual frameworks for redress.

• CCTV positioning phrase triggers a reasonableness test (cl 9). The council exemption from section 11 applies only where the camera is positioned so no other land is filmed "unless it is not reasonably practicable to avoid filming the other land". The "reasonably practicable" qualification introduces subjectivity. Councils will need to document technical design constraints and alternative options considered to justify reliance on the exemption. The exemption for live transmission to the NSW Police Force removes s 18 constraints for live disclosure only for such cameras; offline disclosure pathways may still engage s 18.

• Delegation clause expands permissible delegates (cl 7A). Clause 7A prescribes, for s 59ZJ(b), a class of persons "employed in or by another public sector agency" who may exercise functions. This could allow cross‑agency delegation where previously not contemplated. The administrative boundaries of delegation should be reviewed; agencies must ensure delegation instruments are consistent with the Regulation and with employment arrangements.

• Transitional continuity may mask substantive change (cl 10(2)). Clause 10(2) saves any act or thing that had effect under the 2014 Regulation immediately before repeal. That preserves administrative actions but may conceal substantive changes introduced in the 2019 Regulation. Agencies should inventory existing arrangements to confirm which prior practices survive and which are altered by the new clauses (for instance, insertion of cl 5A or cl 7A post‑2019).

• The Regulation does not create enforcement detail. Because penalties and enforcement remain in the Act, an exemption in the Regulation may have the effect of removing an enforcement avenue. Parties seeking remedies for privacy harms involving exempted registers or exempted bodies must look beyond the Act.

In sum, the Regulation’s narrow drafting and reliance on other statutory schemes create multiple points at which an agency’s assumptions can be wrong. The safe course is to map each clause to operational processes, document the factual basis for any claimed exemption (e.g., placement of CCTV, public inspection availability of State Records, express coverage in a privacy management plan), and verify Gazette orders where relied upon.

Practical compliance under this Regulation is about mapping obligations under the Act to the exceptions and prescriptions in the Regulation, documenting decisions, and ensuring agency governance instruments are updated. Below are concrete steps tied to the relevant clauses.

1. Inventory and classification

   • Catalogue all registers and record systems your agency controls. Cross‑check against the list in clause 7 to determine whether any register falls within the Part 6 exemption (cl 7). If a register is listed (for example, Torrens Register, Water Access Licence Register), treat Part 6 obligations as not applying to those registers and document that legal basis.
   • Identify whether any records your agency holds are State records available for public inspection under the State Records Act 1998, or archives within the meaning of the Commonwealth Copyright Act 1968; those records may be outside personal information coverage for s 4(3)(k) under cl 5.

2. Privacy management plans

   • Review all privacy management plans. If your agency’s staff are part of another public sector agency or you are subject to a Ministerial Gazette order declaring you not separate for s 33 purposes, ensure the other agency’s plan explicitly states it extends to your agency where clause 6 is relied upon (cl 6(1)).
   • If your agency appoints Official Community Visitors (for the Community Services or Ageing and Disability Commissioner schemes), ensure the Ombudsman’s or Office’s privacy management plan explicitly extends to those visitors if you intend to treat them as part of that Office under cl 6(2)-(3).
   • Maintain written evidence (published privacy management plan extracts or signed governance documents) demonstrating the extension of coverage.

3. Delegations and staffing

   • Where delegations under section 59ZJ(b) are used, update delegation instruments and records to reflect that persons employed in or by another public sector agency are a prescribed class under cl 7A. Ensure employment or engagement arrangements authorise such delegations and maintain records of delegation instruments (cl 7A).

4. CCTV deployment and policing arrangements

   • For local councils installing CCTV for public place filming: design camera placement to avoid filming other land where practicable. If avoidance is not practicable, document the technical or environmental constraints that make avoidance impracticable and the stepwise alternatives considered (cl 9(1)). Keep a design brief and minutes of procurement or technical decisions.
   • If live transmission to the NSW Police Force is relied upon, build formal protocols with the NSW Police Force documenting the legal basis (cl 9(2)), retention, access and audit trails.
   • Maintain logs of live transmissions and rationale for disclosure under the clause.

5. Corrective Services NSW and departmental reporting

   • Administratively treat Corrective Services NSW functions as included in the Department of Communities and Justice for purposes of the Act, including privacy governance and reporting, as declared in cl 5A. Update internal governance documents to show which department is accountable for privacy management plan compliance and FOI/Act‑related obligations for corrective functions (cl 5A).

6. Bar and Law Society Councils

   • If advising or working with the Councils of the Bar Association or the Law Society, recognise they are exempt from all provisions of the Act (cl 8). Do not advise reliance on the Act for access‑to‑information or correction requests; seek alternative contractual, regulatory or professional standards pathways.

7. Recordkeeping and evidentiary preparation

   • For any exemption relied upon, prepare a contemporaneous legal memo explaining the factual basis and the chosen legal basis from the Regulation. Where a discretion or reasonable practicability test applies (e.g., cl 9), maintain technical reports, site surveys, and decision logs to support the claim.
   • Where an agency’s privacy management plan covers other agencies or staff, retain a signed statement or published plan extract showing the extend‑to language required by cl 6.

8. Training and policy updates

   • Update privacy training materials to reflect the Regulation’s exclusions and the limited circumstances in which the Act does not apply (cl 5, cl 7, cl 8).
   • Update internal policy manuals to reflect that prescribed investigative agencies now explicitly include the Inspector of Custodial Services (cl 4), and explain implications for information sharing and handling.

9. Cross‑statutory coordination

   • Liaise with records managers and counsel to map dependencies with the State Records Act 1998, Real Property Act 1900, Conveyancing Act 1919 and other laws referenced in clause 7. Confirm whether records are classified as publicly inspectable State records or fall within the other statutes’ registers.
   • If Ministerial Gazette orders are being considered to aggregate agencies for s 33 purposes, coordinate with the Minister’s office and ensure the order is published in the Gazette and a copy is retained in the agency’s compliance file (cl 6(1)(b)).

10. Risk management

    • For any decision to rely on an exemption, assess residual legal, reputational and operational risk. Exemption from the Act does not remove other legal obligations, contractual duties, or professional standards. Maintain oversight mechanisms to review whether exemptions remain appropriate as operational circumstances change.

Each compliance step is grounded in the Regulation’s clauses. The practical focus is documentation, explicit inclusion language in privacy management plans where required, technical justification where "reasonably practicable" tests apply, and updated governance to reflect declared agency relationships and prescribed classes of delegated persons.