Third-party tools on vic.gov.au and the storage of sensitive data

If you’re looking for iframe specific advice, check out our help article on using an iframe.

Examples of third-party tools include:

  • forms solutions

  • newsletters

  • payment gateways (use of Service Victoria is expected unless the program is not accepted by SV)

  • chatbot and live chat

  • registration and members-only spaces/online groups: use of existing services would be expected unless there’s a reason to use another platform ie. Innovation Network and Microsoft Teams. Social media group functionality e.g. LinkedIn, Facebook also an option for relevant, external audiences

  • search marketing where a script is being embedded (the Master Agency Media Services contract should be used)

Requesting the use of third-party tools on SDP

Third-party tools can be added if the owner can demonstrate they are accessible, user-friendly and have met Privacy Impact Assessment (PIA) standards. If multiple third-party public-facing tools are being requested (e.g. 3 chatbots) then discussions will be had about a preferred supplier.

If embedding third-party content via an iFrame or Embedded video, you must have the third-party URL added to our whitelist or it will not display on the public website. You can do this via our SDP technical support portal.

SDP is not authorised to store sensitive information. If you plan to embed tools or scripts onto content.vic.gov.au you must notify the vic.gov.au team via digital@dpc.vic.gov.au, provide a completed Privacy Impact Assessment (PIA) and suggested updated text, if appropriate, for our privacy statement.
Examples of third-party tools that use data capture can be found on our privacy page.

Your department/business unit is responsible for the accuracy and completeness of the PIA. Your legal department should also be checking the terms of use to make sure you have the rights to use the tool. The vic.gov.au team reserves the right to raise with the relevant statutory body if there are concerns.

Current methods of third party embedding

For media streaming or video, the video should be embedded onto the site via Youtube or Vimeo using the embedding video feature (departmentally approved channel must be used).
For podcasts or audio, the audio should be embedded onto the site via Libsyn, Soundcast or Acast (departmentally approved channel must be used).

Other video or audio channels can be requested but there would need to be demand for the new channel across government. Use our SDP teams group to explore this and the Suggest a new feature on SDP to request the addition.

Visualisation tools can also be embedded. Microsoft Power BI and Tableau are currently supported and can be embedded via an iFrame.

 

Â