Please also read the digital guide on protecting privacy.
Privacy Impact Assessment (PIA)
A Privacy Impact Assessment (PIA) is a useful tool in helping you map out privacy implications. It helps identify, assess and mitigate any impact on the privacy of individuals and helps you consider how you will be handling personal information and any inherent privacy risks. It should detail the purpose and use of the data being collected by your form.
A PIA is a ‘living document’ and should be reviewed regularly and updated if you make any changes to your form.
The Office of the Victorian Information Commissioner (OVIC) website provides a generic template and detailed guide for completing a PIA.
VPS organisations are required to comply with Part 3 of the Privacy and Data Protection Act 2014 (Vic), which requires consideration of and compliance with the Information Privacy Principles (IPPs). We strongly advise that a PIA is completed as it is extremely useful in assessing privacy risks more broadly and demonstrating VPS values and commitment to protecting individuals right to privacy.
Contact your department's Privacy Officer for further advice or assistance.
Collection notice
A collection notice must be included in a form that collects personal information.
It should cover:
why you're collecting this information
how you will use and handle the information
whether the information will be disclosed or shared with other government departments or agencies
where this information will be stored
a contact option for the person filling out the form
Below is a template that covers the basics, which you should customise to be as specific to your form as possible. Speak with your department's privacy officer if you'd like assistance with this.
The Department of Premier and Cabinet (DPC) collects your personal information on behalf of [your department/agency] and discloses that information to [your department/agency] for the purpose of [purpose, e.g. respond to your enquiry/feedback].
If legal requirement: You are required to provide this information as a result of [include the legal basis for the compulsory collection if applicable].
If you choose not to provide [type of personal information, e.g. your contact information], we will [include the consequence of not providing this type of personal information, e.g. not be able to contact you regarding your enquiry].
If you have any questions about how your personal information will be handled or would like to gain access to your personal information, you can contact [your department/agency] on [phone number] or [email address].
We're using the services of Drupal 9 to administer this form. The information that you provide is stored by the Department of Premier and Cabinet (DPC) on the Microsoft Azure infrastructure in Sydney, Australia.
For more information on our handling of any personal information, please refer to our privacy page.
Collecting and clearing user data
Our CMS is only classified to collect data up to the level 'unclassified, no DLM'. This means no sensitive information can be captured in any forms.
Sensitive information includes:
racial or ethnic origin
political opinions
membership of a political association
religious beliefs or affiliations
philosophical beliefs
membership of a professional or trade association
membership of a trade union
sexual preferences or practices
criminal record
For further details, see the Office of the Victorian Information Commissioner's website.
Clearing form submissions
It’s a privacy requirement that all webform submissions are cleared regularly. For Drupal forms, this must be at least monthly.
Information Privacy Principle (IPP) 4.2 states an organisation must take reasonable steps to destroy or permanently de-identify personal information if it is no longer needed for the original purpose, or any other reasonable purpose. However, the requirement to retain personal information for recordkeeping or archival purposes overrides this requirement. If you'd like to keep a record of your form submissions, you can export them first and upload to your department's record management system. You should then clear them from the CMS.
The Public Record Office Victoria guidelines are the authoritative material in determining record keeping. It is useful to search the function or activity that relates to your collection purpose (e.g. marketing/accounting/audit) to find the appropriate disposal action (e.g., destroy 7 years after action completed).
For further advice on record management, please reach out to your department's Information Management team.