The Act’s primary legal concepts are customer service functions, Government agency, delegation/sub‑delegation and the treatment of information. Each is given a precise statutory definition or operation:

• Customer service functions: a statutory list in s 5 sets out activities that qualify, such as receipt of applications/fees for authorities, issue of authorities, provision of advice, financial transactions and ancillary activities (s 5(a)-(h)). The definition is operational: it is these activities that can be delegated or contracted for Service NSW to perform (ss 7-8).

• Government agency: a broad list in s 3 includes Ministers, Public Service agencies under the Government Sector Employment Act 2013, NSW Police, NSW Health Service, councils and other bodies declared by regulation (s 3). That definition determines which bodies can delegate to or contract with Service NSW and affects the application of information‑sharing rules (see s 14).

• Delegation and sub‑delegation: s 7 allows a Government agency or other person to delegate a customer service function to the Secretary where the delegating instrument permits delegation. The provision expressly treats the Secretary as if he or she were someone to whom functions could be delegated under those delegation provisions (s 7(2)). The Secretary may sub-delegate to Service NSW staff or prescribed persons, subject to the terms of the delegation and any restriction on sub‑delegation (s 7(3)-(4)). Section 18 provides a general delegation power to staff or prescribed persons, except that s 18(2) carves out functions already delegated to the Secretary by another person.

• Agreements and agents: ss 8-12 authorise the Secretary to enter commercial or administrative agreements to exercise non‑statutory or delegated customer service functions, to appoint approved persons (including councils where prescribed) as agents to carry out relevant functions, and to enter cross‑jurisdictional and non‑government agreements (ss 8-10, 12). Agreements may specify collection, disclosure and use of information, and may provide for the exercise of functions relating to access to information and state records (s 16).

• Information collection, use and disclosure: There are layered rules. Section 6 permits disclosure to another Government agency only with the person’s consent (s 6(1)-(2)), subject to regulations about consent and a pre‑regulatory consultation requirement with the Privacy Commissioner (s 6(3)-(4)). Section 14 lists authorised disclosures for information obtained in connection with customer service functions to the agency for which the function was provided, to the person concerned, to persons the agency is authorised to disclose to, and to prescribed persons or agencies for specified purposes; s 14(8) explicitly gives these provisions effect despite any other Act. Section 15 creates a mechanism for satisfying the notice requirements in the Privacy and Personal Information Protection Act 1998 and the Health Records and Information Privacy Act 2002, by giving customers a notice that refers them to information provided by the service agency or to information on Service NSW’s website (s 15). Section 11 authorises the collection and use of internal records for Service NSW’s internal administrative purposes (s 11).

• COVID‑19 information protections (Part 3A): Sections 17A-17C recognise special expectations about data collected under public health orders. Section 17B restricts use and disclosure of personal and health information collected in relation to COVID‑19 to: the purposes for which it was collected, contact tracing (including interstate), prosecution/investigation of breaches connected to permits/declarations, or access by the individual or their guardian (s 17B(2)(a)-(e)). Section 17B(5) states these limits apply despite other Acts or warrants; contraventions are to be treated under the enforcement framework in the PPIP Act, Part 5 (s 17B(6)).

These concepts combine to create a statutory mechanism where Service NSW is authorised to act as an integrated frontline agent for multiple other agencies, with bespoke rules about how customer data is handled, who may be appointed or authorised to act, and when Service NSW may waive fees or make payments in special circumstances.

This Act affects multiple classes of actors, each affected in specific ways set out in the text.

• Service NSW, the Secretary and Service NSW staff: the Act confers functions on the Secretary (s 4), permits collection and use of internal records (s 11), allows delegation to staff and prescribed persons (ss 7, 18), and grants immunity for good faith actions with liability attaching to the Crown (s 20). Service NSW is the primary operational actor authorised to receive delegations, enter agreements and act as agent.

• Government agencies: agencies become potential principals that can delegate customer service functions to the Secretary (s 7). The Act permits agencies to disclose information to the Secretary for the purposes of the Secretary exercising customer service functions (s 14(4)). Agencies may transfer assets, rights and liabilities to the Crown to enable Service NSW to exercise functions for them (s 19), and such transfers are protected from being treated as breaches or defaults (s 19(2)-(4)). Local councils, county councils and joint organisations have a special protection: a delegation or agreement with the Secretary requires prior approval by resolution of the council etc (ss 7(5), 8(4), 12(2)(b)).

• Ministers and heads of agencies: Ministers can direct functions under s 4(c) (see s 4(c)), and the Minister may give written direction for payments under s 5A(1)(b)(ii). The Minister also has statutory duties around regulation‑making: the Minister must certify Privacy Commissioner consultation before recommending regulations under ss 6(3) and 14(2). The Minister is responsible for reviews of the Act (s 22) and Part 3A (s 17C).

• Users/customers of Government services: individuals and businesses who interact with Service NSW will have their applications, payments and authorities processed by Service NSW, and their personal and health information may be collected and stored by the Secretary (ss 5, 11). Section 6 requires consent for certain disclosures to other agencies, and s 15 prescribes how privacy notices can be delivered to customers to satisfy PPIP Act or Health Records Act requirements when Service NSW collects information.

• Non‑government entities and other jurisdictions: the Secretary may enter agreements with agencies of the Commonwealth, other States/Territories and foreign governments for the exercise of customer service functions and for collection, disclosure and use of information (s 9). The Secretary may also enter agreements with non‑government persons or entities where prescribed as customer service functions; such agreements may provide for collection, disclosure and use of information (s 10). Approved persons (including prescribed private persons) can act as Service NSW agents under s 12.

• Persons whose information was collected under public health orders during the COVID‑19 pandemic: Part 3A (ss 17A-17C, and particularly s 17B) affects them by constraining use and disclosure of that data; it expressly covers information collected before commencement and information not required to be provided to the Secretary (s 17B(4)) and limits use to pandemic‑related purposes (s 17B(2)).

• Third parties receiving information: ss 14(1)(d) and (e) and s 9(6) authorise disclosure to persons or agencies an agency is authorised to disclose to, and allow prescribed persons/agencies to be specified as recipients, subject to regulatory consultation requirements (s 14(2)).

Who pays and bears costs: the Act requires Secretary and Service NSW staff to waive or refund fees in special circumstances when a Government agency or Minister gives written notice (s 5A(2)), but the Act itself does not provide an appropriation mechanism for reimbursing Service NSW; s 19 authorises transfer of assets and liabilities from an agency to the Crown to enable Service NSW to exercise functions. The exact financial mechanics and who ultimately bears the budgetary cost will depend on the delegation, agreement and arrangements between the agency, the Minister and the Treasury; the Act provides the legal authority but does not set appropriation lines.

The Act distributes duties, discretions and rights among the Secretary, agencies, Minister and customers. Key duties and entitlements are as follows:

Duties of the Secretary and Service NSW

• Execute customer service functions delegated or conferred under this Act or another Act, and other functions relating to delivery of Government services as directed by the Minister (s 4(a)-(c)). This is a broad, directive power subject to Ministerial direction for functions under s 4(c).

• Comply with written notices from agencies or directions from the Minister to waive, reduce, postpone or refund fees, or to make payments, when a special circumstances declaration has been published (s 5A(2)). The Secretary must act "in accordance with the written notice" (s 5A(2)).

• Collect, maintain and use internal records of transactions, customer preferences and other customer information for internal administrative purposes (s 11(1)).

• Observe consent requirements when disclosing information to other Government agencies in the context of updating agency records: s 6(2) permits disclosure only if the person consents, and s 6(3) allows regulations about how consent may be provided.

• Exercise disclosure powers in s 14 according to the statutory list: disclosure is authorised to a Government agency for which the information was obtained, to the person concerned, to authorised recipients of the agency, and to prescribed persons or agencies as regulated (s 14(1)(a)-(e)). Section 14(6) limits use of disclosed information to the purpose for which it was disclosed.

Duties of Government agencies and Ministers

• Where a Government agency delegates a customer service function to the Secretary, that delegation must be within the delegating Act or instrument’s delegation provision (s 7(1)).

• When entering delegations or agreements with the Secretary, local councils, county councils and joint organisations must approve the delegation or agreement by resolution before the delegation is made or agreement is entered into (ss 7(5), 8(4), 12(1)-(2)).

• Agencies may disclose information to the Secretary to enable Service NSW to exercise customer service functions (s 14(4)), and must ensure that any disclosure to other recipients is in line with their own statutory permissions and the terms of any delegation or agreement (s 14(3)).

Rights of individuals and classes

• Individuals have a right to access information about themselves that was collected for COVID‑19 purposes, and a right to have that information disclosed to them, to a parent if under 16, or to a carer if lacking capacity (s 17B(2)(e)).

• Individuals have a general privacy regime applicable to collection and disclosure through the PPIP Act and Health Records Act; however, the Act provides processes by which compliance with the notice requirements of those Acts may be satisfied when Service NSW collects the information (s 15).

Regulatory obligations and checks

• Before the Minister recommends regulations providing for the manner of consent under s 6(3), or prescribing persons/agencies under s 14(1)(e), the Minister must certify that the Privacy Commissioner has been consulted (ss 6(4), 14(2)). That creates a statutory consultation/assurance checkpoint with the Privacy Commissioner for regulations that affect information flows.

Recording, contractual and records functions

• Agreements and delegations may provide for the Secretary to exercise functions relating to access to information under the Government Information (Public Access) Act 2009 (GIPA) and State records functions under the State Records Act 1998 when the information arises in connection with functions for that agency (s 16(1)). Section 16(3) states these functions may be exercised "despite any provision" of GIPA, State Records Act, PPIP Act or Health Records Act, signalling that delegations/agreements may reassign these functions to the Secretary irrespective of the usual statutory architecture.

Liability and indemnity

• Individuals (Secretary, staff, persons acting under direction) who act in good faith in executing the Act are shielded from personal liability, and the Crown bears the liability instead (s 20(1)-(2)). This is a statutory indemnity for good faith acts under the Act.

Statutory reviews

• The Minister must review the Act as to whether the policy objectives remain valid and the terms remain appropriate, no later than five years after assent, and table a report in each House within 12 months of the end of that five‑year period (s 22). Part 3A requires a separate review of the COVID Part within one year and tabling a report within six months thereafter (s 17C).

These duties and rights are primarily procedural and operational: they create statutory authorities for service delivery, prescribe how particular information flows must be handled, and provide mechanisms for fee remission in special-incident contexts. The text assigns responsibilities for consent, notices and consultation and sets out circumstances in which the Secretary may act for or with other agencies.

The Act itself contains limited direct penalties; its enforcement architecture mainly interacts with other regulatory regimes, particularly privacy laws.

• Privacy enforcement linkage: Section 17B(6) of Part 3A states that a failure to comply with the COVID‑19 information protections in s 17B is "taken to be conduct to which the Privacy and Personal Information Protection Act 1998, Part 5 applies." Part 5 of the PPIP Act deals with complaints and regulatory enforcement by the Privacy Commissioner, including investigations and potential recommendations; the Act therefore ties contraventions of the COVID‑19 data limitations to the PPIP Act enforcement regime (s 17B(6)). The Act does not itself prescribe criminal penalties for breaches of s 17B; it instead delegates enforcement to the pre-existing PPIP Act machinery.

• Implied legal constraints and civil consequences: Section 14(6) restricts use of information to the purpose for which it was disclosed; misuse outside those purposes could give rise to civil causes of action or regulatory complaints under PPIP or other applicable legislation. The Act itself does not specify additional civil remedies or fines; existing remedies under common law or statutory privacy regimes remain the likely enforcement paths.

• Criminal law interface: The Act expressly states that Part 3A (the COVID protections) applies "despite another Act or law, including a warrant or an order of a court" (s 17B(5)). That limits the circumstances in which other legal compulsion could be used to justify disclosure; however, the Act does not create new criminal offences for unauthorised disclosure beyond the consequences under PPIP Act; note the embedded cross‑reference in s 14 to s 62 of the PPIP Act which makes unlawful disclosure by a public sector official an offence (the Act’s note references s 62 of that Act in relation to s 14).

• Administrative checks: The Act requires the Minister to certify that the Privacy Commissioner has been consulted before recommending regulations under s 6(3) and before making regulations under s 14(1)(e) (ss 6(4), 14(2)). This is an administrative procedural constraint intended to connect any expansion of information‑sharing powers by regulation to privacy oversight.

• Liability allocation: Section 20 provides a statutory indemnity for individuals acting in good faith, shifting liability to the Crown. That affects enforcement strategy: the Crown, not the individual employee, is the respondent to civil claims in many circumstances arising from good faith acts under the Act (s 20(1)-(2)). The Act does not, however, immunise bad faith conduct or conduct outside the scope of the Act.

• No new direct financial penalty regime for non‑compliance with delegation/agreement terms: While delegations and agreements may govern performance and contain terms about information handling, the Act does not itself prescribe a bespoke enforcement or penalty schedule for breaches of delegations or agreements; remedy and enforcement will derive from the terms of each agreement, relevant statutory instruments, and existing administrative law and civil remedies.

Overall, enforcement is largely channelled through existing privacy law (notably the PPIP Act) and general administrative and civil law mechanisms, with the Act establishing duties and immunities rather than a standalone penal code.

The Act is drafted to interoperate with, and in some cases to modify the practical application of, a range of other NSW and Australian legal instruments. Key interactions are explicit in the text.

Priority and "despite" clauses

• Section 14(8) states that s 14 "has effect despite the provisions of any other Act (whether enacted before or after this Act)." That gives the listed disclosure authorisations in s 14 statutory primacy over other Acts that might otherwise limit disclosure, within the specific circumstances enumerated in s 14(1)(a)-(e). Practically, where information is "obtained in connection with the exercise of customer service functions," the Secretary can disclose to the agency for which the functions were performed or to prescribed recipients notwithstanding other statutory constraints.

• Section 16(3) likewise provides that the Secretary or a Government agency may exercise a function conferred under s 16 "despite any provision" of the Government Information (Public Access) Act 2009, the State Records Act 1998, the PPIP Act or the Health Records Act (s 16(3)). Sub‑allocated records/access functions may therefore be exercised by Service NSW even if the usual statutory assignment is to the originating agency.

Privacy law and notice compliance

• The Act engages directly with the Privacy and Personal Information Protection Act 1998 and the Health Records and Information Privacy Act 2002. Section 15 prescribes how the Secretary’s collection of personal information can meet the notice requirements in s 10 of the PPIP Act and clause 4 of Schedule 1 to the Health Records Act by giving a notice that refers the customer to information provided by the service agency or by material on Service NSW's website (s 15(1)-(3)). This is an authorised compliance pathway rather than an exemption from the privacy regimes.

• The Act requires consultation with the Privacy Commissioner before the Minister recommends regulations under s 6(3) (about consent for disclosure in s 6) and before making regulations under s 14(1)(e) (s 14(2)). That procedural requirement embeds a regulatory check.

Delegation and statutory powers

• Delegations are permitted "under a provision of an Act or an instrument that permits the delegation of a customer service function" (s 7(1)). Section 7(1A) specifically clarifies that delegations by Ministers of delegable functions under s 9.7(1)(b) or (d) of the Government Sector Finance Act 2018 that are customer service functions fall within s 7(1A). The Act therefore operates with existing statutory delegation frameworks, effectively treating the Secretary as an eligible delegate where the delegating Act allows.

• Section 8(2) provides an explicit cross‑interaction with the Fines Act 1996: the Secretary may enter into an agreement with the Commissioner of Fines Administration regarding the penalty notice function, whether or not arrangements under s 114(2) of the Fines Act permit such an agreement. That is a specific override of a potential limitation in the fines architecture for the purpose of contracting with Service NSW.

Inter‑jurisdictional and foreign agency interactions

• Section 9 expressly contemplates functions of agencies of the Commonwealth, other States/Territories or foreign governments being prescribed as customer service functions and allows the Secretary to exercise customer service functions delegated under Commonwealth or other State/Territory Acts or instruments, to sub‑delegate as permitted, and to enter into agreements with such agencies or foreign Governments with respect to the exercise of customer service functions (s 9(1)-(6)). Section 9(6) allows such agreements to provide for collection, disclosure and use of information, creating a statutory channel for cross‑jurisdictional information sharing in the context of customer service delivery.

Interplay with local government

• For councils, county councils and joint organisations, the Act preserves a procedural safeguard: delegations or agreements with the Secretary require prior approval by resolution (ss 7(5), 8(4), 12(1)-(2)). That is a statutory gating mechanism that sits alongside the local government legislative framework.

Records and access law

• Section 16 allows agreements or delegations to provide for the Secretary to exercise functions relating to access to information under the GIPA Act and functions relating to State records under the State Records Act if those records arise in connection with functions exercised for that agency (s 16(1)). The same provision permits the delegation in reverse, where an agency exercises functions of the Secretary. Section 16(3)’s "despite" clause affects the conventional statutory allocation of those functions.

Warrants and court orders

• Part 3A contains an explicit statement that s 17B applies "despite another Act or law, including a warrant or an order of a court" (s 17B(5)). That constrains the effect of warrants or court orders in relation to COVID‑19 information collected under listed authorities, by setting statutory limits on permissible use and disclosure. The Act does not, however, create a general immunity from lawful judicial processes in other contexts; the COVID‑19 restriction is narrowly expressed.

Practical consequence

• The Act therefore operates both as a facilitator for centralised service delivery and as a statutory framework that can modify the way other Acts operate in practice, especially regarding information handling, delegation and administrative responsibility for records and access functions. Where the Act says its provisions have effect "despite" other Acts (ss 14(8), 16(3), 17B(5)), that is a legal mechanism to reassign or clarify authority for certain activities even if other statutes would otherwise govern those areas.

The Act as presented reflects a series of amendments recorded in the text. The schedule references and marginal notes show the following changes and insertions. Each entry below records the amendment notices that appear in the source text,do not assume policy motives beyond the legislative record.

• Initial Act name and commencement: The name is Service NSW (One-stop Access to Government Services) Act 2013 (s 1), commenced on the date of assent (s 2).

• 2013 amendments: Section 8 shows amendments recorded as "Am 2013 No 82, Sch 2.17 [1] [2]" which appear to have altered s 8 to clarify agreement powers.

• 2017 amendments: Multiple provisions show 2017 amendments. Section 3 lists amendments "Am 2017 No 22, Sch 4.42; 2017 No 65, Sch 2.30 [1]"; s 7 shows "Am 2017 No 65, Sch 2.30 [2] [3]"; s 8 "Am 2017 No 65, Sch 2.30 [4] [5]"; s 12 "Am 2017 No 65, Sch 2.30 [6]"; s 19 "Am 2017 No 65, Sch 2.30 [7]". The schedule references indicate statutory amendments inserted by 2017 amending Acts.

• 2020 amendments: Section 4 was substituted and annotated "Subst 2020 No 3, Sch 2[1]". Sections 5 and 5A were inserted or amended in 2020: s 5 amended "Am 2020 No 3, Sch 2[2]"; s 5A was inserted "Ins 2020 No 3, Sch 2[3]". Sections 6, 7, 11, 12 and Schedule 1 show 2020 references "Am 2020 No 3, Sch 2[4] [5]..." and "Sch 2[6]" etc. Schedule 1 has "sch 1: Am 2020 No 3, Sch 2[11]". These reflect the Better Regulation and Customer Service legislative changes referenced in the Schedule.

• 2021 amendment: Part 3A (ss 17A-17C) was inserted in 2021: the notes show "pt 3A: Ins 2021 No 35, Sch 1[2]" and individual sections 17A-17C "Ins 2021 No 35, Sch 1[2]". This is the COVID‑19 related insertion.

• 2026 amendments: A recent omnibus set of amendments is recorded as "2026 No 2, Sch 1.4[1]" and many sections show 2026 annotations indicating changes: s 3, s 4, s 6, s 7, s 8, s 9, s 10, s 11, s 12 as "Am 2026 No 2, Sch 1.4[2]" or similar. Sections 14-20 all show "Am 2026 No 2, Sch 1.4[2]" references. The 2026 amendments appear to expand or clarify information sharing rules, inter‑jurisdictional agreement powers and delegation/agency arrangements, as reflected in the newly annotated s 9 and s 10 in particular.

• Transitional provisions: Schedule 1 contains transitional and savings provisions consequential on the 2020 amendment Act (Better Regulation and Customer Service Legislation Amendment (Bushfire Relief) Act 2020), with specific clauses applying to functions exercised during the "relevant period" (18 July 2019 to immediately before commencement of the amendment Act) and validating actions taken in that period (Schedule 1, Part 2, cls 3-5).

Taken together, the amendments show three main phases: the establishment and initial framework (2013 and early amendments), expansion for fee relief and operational delegation (2020, including bushfire‑related provisions and special circumstances fee waivers), the COVID‑19 specific inserts (2021), and further modification and clarification of delegation and information‑sharing and cross‑jurisdictional arrangements in 2026. The text annotates these changes; the Act itself contains the current operative provisions as amended.

The legislative text provided contains no judicial decisions, case references, or litigation history. There are notes referring to other statutes and the privacy enforcement regime (for example, s 14 includes a note that s 62 of the Privacy and Personal Information Protection Act 1998 makes disclosure of personal information by a public sector official an offence unless disclosed in the exercise of official functions), but the Act text does not cite any cases, nor does it include recorded judicial interpretation. Consequently:

• There are no reported cases contained in the source text that interpret this Act to cite.
• Enforcement paths mentioned in the Act point users to other statutes (for privacy enforcement, see PPIP Act Part 5 referenced in s 17B(6)), so litigation or tribunal matters likely arise under those regimes rather than under bespoke enforcement provisions in this Act.

Practitioners should therefore expect disputes to be litigated or reviewed under general administrative law, privacy law (PPIP Act and Health Records Act), contractual remedies for breaches of agreements or delegations, and ordinary civil law remedies. Any interpretation disputes about the Act’s "despite" clauses (for example s 14(8) or s 16(3)) will turn on statutory construction and the relationship with other statutory schemes; however, no case law appears in the provided text.

The Act contains several provisions that materially affect legal risk and operational practice, and which require care in drafting delegations, agreements, notices and compliance procedures. Below are specific "gotchas" grounded in statutory text.

1. "Despite" clauses reassign authority and can override other Acts in narrow contexts (ss 14(8), 16(3), 17B(5))

   • s 14(8) gives the disclosure authorisations in s 14 effect "despite the provisions of any other Act". That means information disclosure authorised under s 14 can occur even if another Act would otherwise prohibit or restrict it, provided the statutory conditions in s 14 are met. Likewise s 16(3) allows exercise of GIPA and State records functions despite the GIPA Act or State Records Act.
   • Practical effect: agreements or delegations that meet s 14 or s 16 thresholds can legally displace other statutory limitations; drafting must therefore explicitly state the legal basis for the information flows and ensure that the conditions are strictly met.

2. Consent requirement in s 6 sits adjacent to broader disclosure powers in s 14 , they are not identical

   • s 6(1)-(2) allows the Secretary to disclose information obtained in the course of providing a relevant function to another Government agency only if the person consents. By contrast, s 14(1)(a) allows the Secretary to disclose information obtained "in connection with the exercise by the Secretary of customer service functions for that agency" to that Government agency. The distinction matters operationally: when Service NSW is acting on behalf of Agency A and collects information, it can pass that information back to Agency A under s 14(1)(a) without a separate consent requirement; but if Service NSW seeks to update Agency B, s 6 requires consent. The practical gotcha is that the Act treats intra‑principal disclosures differently from cross‑agency updates.

3. s 15 "sufficient compliance" pathway requires that the agency’s privacy material actually contains the required matters

   • s 15 establishes that compliance with PPIP Act s 10 or Health Records Act notice requirements can be achieved by giving a notice referring people to the service agency’s information or to Service NSW website material, but only if that agency material does contain the matters required (s 15(1)(b) and s 15(2)(b), s 15(3)(b)). If the referred material is deficient, the "sufficient compliance" shield will not apply. Agencies and Service NSW must therefore ensure privacy statements are comprehensive and kept current.

4. Fee waiver mechanics do not themselves appropriate funds

   • s 5A requires Service NSW to waive, reduce, postpone or refund fees or to make payments in accordance with written notices from an agency or directions from the Minister (s 5A(2)), but the Act does not specify how the resulting costs are to be funded or reimbursed. Section 19 creates a mechanism for transfer of assets, rights and liabilities to the Crown, but operational funding, appropriation and accounting treatment will depend on separate financial and Treasury processes. Practitioners should ensure there is a funding mechanism and clarity on who bears the cost when fee remissions are given.

5. Local government gatekeeping , council resolution required

   • For delegations or agreements involving a council, county council or joint organisation, the Act requires prior approval by resolution (ss 7(5), 8(4), 12(1)-(2)). Failing to obtain the required resolution could render a delegation or agreement ineffective or susceptible to challenge.

6. Delegation limits and sub‑delegation subject to delegating instrument

   • s 7(4) specifies that sub‑delegation is subject to the terms of the original delegation, including any restriction on sub‑delegation. Delegations that appear to permit sub‑delegation must be checked against the instrument granting the delegating power. A misplaced assumption that Secretary may sub-delegate broadly can create ultra vires acts.

7. Agent arrangements and third party recipients

   • s 12 permits agreements with "approved persons" to act as agents; s 10 permits agreements with non‑government entities and prescribes that any such agreements may provide for collection, disclosure and use of information. These arrangements create risk vectors for data security and privacy compliance; the Act allows them but does not prescribe the controls. Contracts must therefore include precise data handling, security and liability clauses.

8. COVID‑19 restrictions are narrow but have a strong statutory priority

   • s 17B restricts the use and disclosure of COVID‑19 related personal or health information to specified purposes and provides that this section operates despite other Acts or warrants (s 17B(5)). Contravention draws PPIP Part 5 enforcement (s 17B(6)). Ensure systems handling legacy COVID‑era data flag these records, enforce purpose‑binding and record access logs to demonstrate compliance.

9. Personal liability immunity attaches to good faith acts; "good faith" is a legal threshold

   • s 20 grants protection for acts done in good faith, with liability attaching to the Crown. This does not protect malicious, dishonest or outside‑scope conduct. Ensure training and governance frameworks reinforce lawful scope and good faith.

10. Regulation‑making requires Privacy Commissioner consultation certification

• Both s 6(4) and s 14(2) require the Minister to certify Privacy Commissioner consultation before recommending regulations in those areas. Any rush to regulate information handling without privacy consultation will create procedural non‑compliance risk in the regulation‑making process.

These points are mechanistic, statutory traps and operational constraints that practitioners must manage through careful delegations, agreement drafting, privacy statements and governance.

Below is a practical compliance checklist and recommended governance steps for agencies, Service NSW, private parties and counsel preparing and implementing delegations, agreements and data flows under the Act. Each step references the relevant section where the requirement or permission is specified.

1. Confirm the delegability of the function in the originating Act or instrument (s 7(1))

   • Before any delegation to the Secretary, confirm the delegating Act or instrument contains a delegation provision that permits delegation of the particular customer service function. Record the legal basis and keep an executed instrument.

2. Draft delegations and agreements with explicit term controls

   • Use detailed written delegations or agreements (s 8(1)-(3)). Specify the scope of the function, authority to sub‑delegate, confidentiality and data security obligations, indemnities, funding and reimbursement, and records management responsibilities. For councils or joint organisations, obtain and record a prior council resolution approving the delegation or agreement (ss 7(5), 8(4), 12(1)-(2)).

3. Address sub‑delegation limits and confirm authority to sub‑delegate (s 7(3)-(4))

   • Ensure the original delegating instrument permits sub‑delegation and that any sub‑delegation by the Secretary complies with the terms of the delegation. Record the chain of delegation and maintain an auditable delegation register.

4. Privacy notice and consent compliance pathway (s 15 and s 6)

   • When Service NSW collects information, ensure the notice satisfies PPIP Act s 10 or Health Records Act Schedule 1, cl 4 by either providing the required information directly or giving a notice referring to the agency’s material that contains the necessary matters (s 15(1)-(3)). Where s 6 applies (disclosure to another agency for updating records), obtain express consent from the person before disclosure (s 6(2)). Where consent is implemented by regulation, comply with the regulation’s specified method (s 6(3)).

5. Draft information‑use clauses to reflect statutory purpose limits and "despite" provisions (ss 14, 16)

   • For disclosures under s 14, ensure the agreement or delegation clearly records the purpose of disclosure and that recipients are authorised to use the information only for the disclosed purpose (s 14(6)). If a party relies on s 14(8) or s 16(3) to displace another statutory constraint, record rationale and ensure the factual conditions are met , for example, that the information was "obtained in connection with the exercise of customer service functions" for the relevant agency (s 14(1)(a)).

6. COVID‑19 data handling special rules (s 17B)

   • For information collected under public health orders or related instruments, tag records as subject to s 17B and ensure use and disclosure are strictly limited to permitted purposes (s 17B(2)). Implement access controls, logging and a documented process to respond to requests by the individual or an authorised carer or parent (s 17B(2)(e)). Dispose of data when appropriate (s 17B(3)).

7. Data sharing with other jurisdictions and foreign governments (s 9)

   • When entering agreements under s 9 with Commonwealth, State, Territory or foreign agencies, include express clauses on collection, disclosure, storage location, cross‑border transfer, retention and applicable legal bases, and verify legal authority for the foreign agency to receive and use the information (s 9(4)-(6)).

8. Non‑government agents and third party contractors (ss 10, 12)

   • For agreements with non‑government entities acting as Service NSW agents, ensure they are "approved persons" under s 12 where required, include data protection, audit, access and breach reporting obligations, and ensure the agreement complies with the prescribed criteria (if any) in regulations to avoid exceeding the statutory authorisation.

9. Records management and access functions (s 16)

   • If an agreement assigns GIPA or State records functions to the Secretary, set out operational responsibilities: document how access requests will be processed, who holds records, how records will be created and archived, and ensure conformity with State Records Act procedures even where s 16(3) gives effect "despite" that Act , the obligations for recordkeeping remain practically relevant for audit and accountability.

10. Financial and accounting arrangements for fee waivers and payments (s 5A, s 19)

    • When agencies or the Minister direct fee waivers or payments under s 5A, ensure there is a documented funding/reimbursement mechanism. Use s 19 to formalise any necessary transfer of assets, rights or liabilities to the Crown to avoid contractual or securities problems, and record Ministerial consents where required (s 19(1)). Do not assume that waiving fees absolves Service NSW from needing appropriation or budget adjustments.

11. Regulatory consultation and Ministerial certification (ss 6(4), 14(2))

    • If a proposed regulation would prescribe consent forms, classes of functions, or classes of prescribed recipients under s 6(3) or s 14(1)(e), ensure the Minister obtains and certifies consultation with the Privacy Commissioner before recommending the regulation.

12. Training, procedures and recordkeeping

    • Train Service NSW staff and agents on scope of delegations, permitted information uses, consent requirements, COVID‑19 special rules and obligations under s 15. Maintain logs of disclosures, consents, delegations, agreements and council resolutions. Keep a register of agents, sub‑delegations and agreements in force.

13. Audit, review and reporting

    • Implement periodic internal audits to ensure disclosures are purpose‑limited, that privacy notices are accurate, and that special categories of data (e.g. COVID records) are handled according to s 17B. Prepare to support the statutory review requirements under s 22 and s 17C by assembling records of delegations, agreements, compliance incidents and policy rationales.

14. Legal and procurement review

    • Before entering agreements under ss 8-10, have counsel review compliance with the originating Act’s delegation provisions, GIPA implications, data protection obligations, cross‑border transfer consequences and procurement or contracting law constraints. For agreements that entail significant risk, include indemnities and insurance requirements; remember s 20’s indemnity applies only for good faith acts under the Act and does not replace contractual risk allocation.

15. Handling of complaints and enforcement

    • Develop an internal complaints pathway consistent with PPIP Act Part 5 for privacy complaints, and cooperate with the Privacy Commissioner in investigations. For COVID‑19 data matters, document all uses and disclosures to demonstrate compliance with s 17B and be prepared to have contraventions dealt with under the PPIP Act’s enforcement framework (s 17B(6)).

By following these steps, agencies and Service NSW can map statutory authorisation to operational practice: ensure legal authority for delegations exists, document agreements tightly, obtain required consents and notices, and embed privacy‑compliant data handling for core customer service functions.