Privacy Impact Assessment Template
Prepare a privacy impact assessment and action register for a new system or AI tool.
Describe categories only. Keep client details out of the assessment. Entries stay in this tab and clear when you leave.
Start a draft
Complete the fields or load an example.
Download the draft to record your practice’s decision.
Complete a Privacy Impact Assessment
Use this privacy impact assessment (PIA) template to decide what your practice must change before it uses a new system with client information. Start with a narrow question, such as whether to pilot an AI document tool.
- Describe the project and who it affects. Compare the proposed use with an option that needs less personal information. Record the concerns raised by people you consult, such as staff who handle the records or clients affected by the change.
- Follow the information from collection to deletion. Include copies in prompts, logs, backups and generated outputs. Record who can access each copy, which providers handle it and where it goes.
- Use the Australian Privacy Principles (APPs) to record the obligations that apply. Check collection and notice under APPs 3 and 5. Consider use or disclosure under APP 6 and any overseas disclosure under APP 8.
- Consider the accuracy of outputs under APP 10, access and correction under APPs 12 and 13, and security and disposal under APP 11. Record a separate risk entry for each problem that needs a control or an action.
Load the fictional example for an AI pilot that uses invented files. In the draft, the practice manager checks that the provider has disabled training and tests deletion before asking to use real files.
The editable text download includes the project description and information flows. It keeps the APP analysis and action register together, with space for the decision and review.
Download the draft before leaving the page and keep it with your practice’s restricted project records.
When a Practice Needs a PIA
The Office of the Australian Information Commissioner (OAIC) encourages organisations to screen projects early and scale the assessment to the privacy risk.
Use the OAIC’s guide to undertaking privacy impact assessments when a project changes how you collect, store, use or disclose personal information.
The OAIC’s guidance on using commercial AI products recommends a PIA during planning. Assess the proposed use before buying the tool, when your practice can still reduce the data it sends.
The Australian Government Agencies Privacy Code requires covered agencies to prepare PIAs for high privacy risk projects. Private practices can use the OAIC’s small business guidance to check which obligations apply to them.
The Tax File Number Rule can apply to a practice that holds tax file number information even if the APPs do not apply to its ordinary operations.
Recording Actions and Sign-Off
Give each action an owner and a due date or milestone. Record which protections already exist and what the owner must change or test. Describe the risk that remains after the action.
In the download, record each action’s status and the evidence that closes it.
Ask the practice principal or delegated decision-maker to sign and date the assessment. Record whether the project can proceed and which conditions must be met before rollout.
Set a review date or a trigger, such as a new provider or a change to how the system uses client information. Revisit the affected flows and actions when that change is proposed.