Privacy requirements for webforms

Owned by Hayley Stockall (Unlicensed), created
Last updated: 21 Jun, 2024 by Emma Cameron
3 min read

Please also read the digital guide on protecting privacy.

Privacy Impact Assessment (PIA)

A Privacy Impact Assessment (PIA) is a useful tool in helping you map out privacy implications. It helps identify, assess and mitigate any impact on the privacy of individuals and helps you consider how you will be handling personal information and any inherent privacy risks. It should detail the purpose and use of the data being collected by your form. 

A PIA is a ‘living document’ and should be reviewed regularly and updated if you make any changes to your form. 

The Office of the Victorian Information Commissioner (OVIC) website provides a generic template and detailed guide for completing a PIA.

VPS organisations are required to comply with Part 3 of the Privacy and Data Protection Act 2014 (Vic), which requires consideration of and compliance with the Information Privacy Principles (IPPs). We strongly advise that a PIA is completed as it is extremely useful in assessing privacy risks more broadly and demonstrating VPS values and commitment to protecting individuals right to privacy.

Contact your department's Privacy Officer for further advice or assistance. 

You may wish to use SDP’s PIA template as a starting point which includes details of our data storage environment.

Collection notice

A collection notice must be included in a form that collects personal information.

It should cover:

  • why you're collecting this information

  • how you will use and handle the information

  • whether the information will be disclosed or shared with other government departments or agencies

  • where this information will be stored

  • a contact option for the person filling out the form

Below is a template that covers the basics, which you should customise to be as specific to your form as possible. Speak with your department's privacy officer if you'd like assistance with this. 

The Department of Government Services (DGS) collects your personal information on behalf of [your department/agency] and discloses that information to [your department/agency] for the purpose of [purpose, e.g. respond to your enquiry/feedback]. 

If legal requirement: You are required to provide this information as a result of [include the legal basis for the compulsory collection if applicable].

If you choose not to provide [type of personal information, e.g. your contact information], we will [include the consequence of not providing this type of personal information, e.g. not be able to contact you regarding your enquiry].

If you have any questions about how your personal information will be handled or would like to gain access to your personal information, you can contact [your department/agency] on [phone number] or [email address].

We're using the services of Drupal 10 to administer this form. The information that you provide is stored by the Department of Government Services (DGS) on the Microsoft Azure infrastructure in Sydney, Australia.

For more information on our handling of any personal information, please refer to our privacy page. 

Collecting and clearing user data

Our CMS is only classified to collect data up to the level 'unclassified, no DLM'. This means no sensitive information can be captured in any forms.

Sensitive information includes:

  • racial or ethnic origin

  • political opinions

  • membership of a political association

  • religious beliefs or affiliations

  • philosophical beliefs

  • membership of a professional or trade association

  • membership of a trade union

  • sexual preferences or practices

  • criminal record­

For further details, see the Office of the Victorian Information Commissioner's website.

Clearing form submissions

It’s a privacy requirement that all webform submissions are cleared regularly. For Drupal forms, this must be at least monthly.

Information Privacy Principle (IPP) 4.2 states an organisation must take reasonable steps to destroy or permanently de-identify personal information if it is no longer needed for the original purpose, or any other reasonable purpose. However, the requirement to retain personal information for recordkeeping or archival purposes overrides this requirement. If you'd like to keep a record of your form submissions, you can export them first and upload to your department's record management system. You should then clear them from the CMS.

The Public Record Office Victoria guidelines are the authoritative material in determining record keeping. It is useful to search the function or activity that relates to your collection purpose (e.g. marketing/accounting/audit) to find the appropriate disposal action (e.g., destroy 7 years after action completed). 

For further advice on record management, please reach out to your department's Information Management team. 

 Related articles