PRIS legislation: what it means for Government websites

The Privacy and Responsible Information Sharing (PRIS) legislation is now in effect, introducing new requirements for how WA public sector organisations collect, manage and share personal information.

For Local and State Governments, PRIS is an organisation-wide responsibility. But it also has practical implications for your website, particularly anywhere you collect personal information from your community.

If you work in marketing, communications or digital, you don't need to become a privacy expert. However, it's important to understand where your website fits in and work with your organisation's Privacy Officer or responsible team to implement any required changes.

What is the PRIS legislation?

The Privacy and Responsible Information Sharing Act 2024 (WA) establishes a framework for privacy and responsible information sharing across the WA public sector, with most privacy requirements coming into effect on 1 July 2026.

The legislation introduces 11 Information Privacy Principles (IPPs) covering how personal information is collected, used, disclosed, stored and managed.

You can find detailed information about the legislation on the WA Government's PRIS website.

For this article, we're focusing specifically on what PRIS may mean for your Local Government website.

Who does PRIS apply to?

PRIS applies to WA public sector entities, including State and Local Governments.

Organisations therefore need to consider how personal information is managed across the organisation, including through public-facing websites and digital services.

Your organisation's Privacy Officer or relevant privacy, governance or legal team should guide your approach to PRIS. Marketing, communications and digital teams can then help put those requirements into practice online.

What does PRIS mean for your Government website?

Government websites can collect personal information in many different ways, including:

• Contact and enquiry forms
• Service requests
• Complaints and feedback
• Community consultations
• Event registrations
• Newsletter subscriptions
• Applications and registrations
• Online accounts and portals

Even a simple contact form can collect someone's name, email address, phone number and other personal information.

There are a few key areas worth reviewing.

1. Identify where you collect personal information

Start by identifying forms, registrations, subscriptions and other areas of your website that ask people to provide personal information.

It's also worth understanding what happens to that information after someone submits it. For example, is it emailed to a staff member, stored in another system or passed into a third-party platform?

Creating an inventory of these collection points can help your Privacy Officer or responsible team assess how the website fits into your organisation's broader privacy obligations.

2. Review your collection notices

This is likely to be one of the most visible implications of PRIS for Government websites.

Under the Information Privacy Principles, organisations collecting personal information need to make people aware of certain information about that collection. This is commonly done through a collection notice.

A collection notice is different from simply having a general privacy policy linked from your website. It relates to the specific circumstances in which information is being collected.

The Office of the Information Commissioner (OIC) provides a useful Local Government example: a council website that allows ratepayers to update property ownership or contact details. If that form continues to collect personal information after 1 July 2026, the council needs to ensure the appropriate information about that collection is provided.

The OIC provides guidance on collection notices, including what information may need to be included.

Your Privacy Officer or responsible team should determine what notices are required and approve the appropriate wording.

3. Review your privacy information

PRIS also includes requirements around transparency and how organisations communicate their approach to managing personal information.

It's a good opportunity to review the privacy information currently available on your website. Is it up to date? Is it easy to find? Does it reflect your organisation's current approach?

The content and requirements should be determined by your responsible privacy team, with any necessary website updates made once they have been approved.

4. Understand where your website data goes

Your website is often just the starting point for someone's information.

A form submission might be sent to an employee, stored in another system, added to a CRM or passed to a third-party service.

As part of your review, consider where submitted information is stored, who can access it, what systems your website connects with, and whether third parties handle the information.

Marketing and communications teams don't necessarily need to answer all of these questions themselves. The important thing is making sure the right people within your organisation are involved.

What about Privacy Impact Assessments and data breaches?

Under PRIS, a Privacy Impact Assessment (PIA) is required before undertaking certain activities involving personal information that are likely to have a significant impact on people's privacy.

If you're planning a significant new digital service or project involving personal information, involve your Privacy Officer early so they can determine what is required.

Local Governments should also be preparing for the notifiable information breach requirements, which commence on 1 January 2027. Your organisation's broader incident and breach response processes should consider information collected and managed through websites and other digital services.

Who is responsible for PRIS?

PRIS compliance is ultimately the responsibility of your organisation.

Your Privacy Officer and relevant privacy, governance or legal teams should assess the requirements and determine what your organisation needs to do. Your marketing, communications and digital teams can then work with internal teams and external partners as needed to support implementation.

The important distinction is that your organisation determines its PRIS requirements, while your digital partners may be able to assist with relevant website changes once those requirements are understood.

What should you do next?

If you haven't reviewed your website since the PRIS privacy requirements came into effect, now is a good time to start.

Speak with your Privacy Officer or responsible team to understand what work has already been completed and what they need from your marketing, communications or digital team.

From there, review where your website collects personal information, the collection notices and privacy information currently in place, and where that information goes once it is submitted.

PRIS is much broader than your website, but your website is an important part of the picture. Understanding how personal information is collected online can help your organisation identify and implement any changes required.

If you're reviewing how PRIS affects your Government website, ALYKA can work with your team to help identify and implement relevant website changes where appropriate. Get in touch today with our team if you'd like support.

This article provides general information about PRIS in the context of Government websites and is not legal or compliance advice. Organisations should refer to official WA Government and Office of the Information Commissioner guidance and seek appropriate advice when determining their obligations.