New South Wales to introduce mandatory data breach notification scheme for public sector agencies

This update provides an overview of the Privacy and Personal Information Protection Amendment Act 2022 (NSW) (PPIPAA 2022) which received Royal Assent on 28 November 2022 and will commence 12 months from that date, that is, from 28 November 2023. On commencement, the PPIPAA 2022 will amend the Privacy and Personal Information Protection Act 1998 (NSW) (PPIPA 1998) to introduce a mandatory data breach notification scheme for public sector agencies and extend the operation of the PPIPA 1998 to State Owned Corporations (SOCs) not already covered by the Privacy Act 1988 (Cth) (Privacy Act). This update provides an overview of the amendments to be introduced by the PPIPAA 2022, including the requirements of the mandatory data breach notification scheme. The update also outlines steps public sector agencies can take over the next 12 months to prepare for the commencement of the PPIPAA 2022.