Organisations are collecting, connecting and using more personal and sensitive information than ever before. Digital services, integrated datasets, cloud platforms, analytics, artificial intelligence and third-party service providers are changing how information is collected and used. These arrangements can create significant value, but they can also create privacy risks: the potential for the handling of personal information to cause harm to individuals or expose an organisation to legal, regulatory, reputational or operational consequences.
Organisations may collect information through a new system for a legitimate purpose. Another team may identify an opportunity to use that information for another purpose. A technology provider may host or process the information, an analytics platform may combine it with another dataset, and a contractor may require access. The information may then be retained longer than originally intended.
Individually, decisions about collection, secondary use, hosting, data linkage, access and retention may appear reasonable. Taken together, they can create a materially different privacy environment from the one originally contemplated.
Privacy risk does not always stem from a clear failure to follow policy. It can also emerge from the way a project, system or service is designed.
For directors, councillors, committee members, executives and operational leaders, the question is therefore becoming broader than whether an organisation has a privacy policy or meets its immediate compliance obligations. The more important question is whether those responsible for governance, oversight, design and delivery have sufficient visibility of the information environment being created to understand the associated risks and make informed choices about how those risks should be managed.
The gap between policy and practice
Most organisations have an established privacy framework, including policies, procedures, training, security controls, contractual requirements and designated privacy responsibilities.
These remain important. However, they do not necessarily provide a complete picture of how information moves through an organisation.
In practice, personal information may move between business units and systems, be accessed by different user groups, transferred to external providers or be combined with other datasets. New digital services may introduce collection points that did not previously exist, while analytics and reporting requirements may create secondary uses of information.
The resulting privacy risk often sits at the intersection of these decisions. Privacy risk can arise from the combined effect of these activities, even where each activity has been considered separately.
A recent determination by the Australian Privacy Commissioner illustrates how these issues can arise in practice. In June 2026, the Commissioner found that healthcare providers Medmate Australia and Monash IVF had interfered with individuals’ privacy through third-party tracking pixels on their websites. The pixels collected information about visitors to health-related webpages and enabled it to be used for targeted advertising on social media. The Commissioner determined that this amounted to the collection of sensitive information requiring consent.
The significance is not simply that tracking technology was used. A technology commonly associated with analytics and advertising, when deployed in a healthcare context, resulted in the collection and use of sensitive health information. The privacy implications therefore depended on the context in which the technology was deployed, what could be inferred from its use and what happened to that information afterwards.
The lesson is straightforward: having privacy policies and controls in place does not necessarily mean an organisation understands how personal information is actually being collected and shared.
This is particularly relevant when organisations introduce a new program, system, service or data-sharing arrangement. By the time privacy implications are considered, key decisions may already have been made about technology, procurement, data fields, suppliers and operating processes. At that point, privacy becomes a remediation exercise. The organisation may still be able to manage the risk, but the available options can be narrower, more costly and more disruptive.
Moving privacy into the design process
A Privacy Impact Assessment (PIA) provides a structured way to understand how an initiative will collect, use, share and retain personal information, and where the associated risks sit.
A PIA is not simply a compliance document, it brings together the people who understand the project, technology, data, security and operations to examine how information will be collected, used, accessed, shared and retained in practice.
This means asking straightforward but important questions: What information is being collected? Why is it needed? Where will it go? Who will have access? Will it be shared or combined with other information? How long will it be retained?
Identifying these issues early matters. Changes to data collection, access, information flows or third-party arrangements are generally easier to make during design than after systems and processes are established. The value of a PIA lies not only in the completed document, but in the decisions it enables while there is still an opportunity to influence the outcome.
Where a PIA adds a different lens
Privacy risk can remain even where an initiative has been through established data and cyber risk processes. Those processes focus largely on whether information is appropriately protected. A PIA considers whether the information environment itself is appropriate, including what is collected, how it is used and what new privacy risks arise when information is linked, analysed or shared.
It is of particular importance with data linkage, AI and third-party platforms. Information that may be relatively low-risk when held separately can become significantly more sensitive when combined with other datasets or used for a new purpose. A PIA helps identify these changes before they become embedded in the way an initiative operates.
What this looks like in practice
Moore Australia’s experience, across various industries and sectors, has shown that the hardest part of privacy risk is often not identifying a potential issue, but determining what should be done about it.
PIAs can bring together perspectives that are otherwise considered separately, legal and privacy requirements, operational realities, technology constraints, security considerations and the objectives of the program. The resulting discussion is often less about whether a risk exists and more about whether the proposed approach is appropriate, what safeguards are needed and who is accountable for implementing them.
- In local government: our work has included reviewing privacy practices across services and business processes where information is collected and handled by different teams, systems and service providers. This has involved looking beyond documented arrangements to understand how privacy responsibilities operate in practice, how issues are identified and escalated, and whether controls keep pace as services and technology change.
- In healthcare: we have undertaken PIAs for proposed programs involving personal and sensitive health information, including arrangements where information moves between healthcare providers, data environments and external parties. This work requires consideration of the broader operating model and not just the proposed technology, including governance, access, information-sharing, security, retention and the responsibilities of each party involved.
A recurring lesson is that privacy risk often emerges at the boundaries between these arrangements. A business owner may understand the purpose of a program, a technology team may understand the system, and a supplier may understand its contractual obligations, without anyone having considered the complete picture. A PIA can bring those perspectives together and give directors, councillors, committee members, executives and operational leaders a basis for resolving the gaps between them.
From compliance exercise to management tool
A PIA’s value lies in the decisions that follow it.
Privacy considerations often involve trade-offs between service delivery, innovation, operational efficiency, security and individual privacy. A PIA makes those trade-offs explicit, giving directors, councillors, committee members, executives and operational leaders a clearer basis to determine what is acceptable, what needs to change and where accountability should sit.
It also creates a record of why those decisions were made and becomes increasingly important as initiatives evolve, new uses are introduced or responsibility moves between teams and third parties.
For directors, councillors, committee members, executives and operational leaders, this shifts the PIA from a point-in-time compliance requirement to a practical governance tool – one that supports informed decisions about privacy risk before, and as, an initiative develops. Good privacy governance is not about eliminating every risk. It is about making those risks visible early enough for them to be deliberately managed.
How Moore Australia can help
Moore Australia’s Governance and Risk Advisory team supports organisations to develop privacy governance frameworks, policies procedures and assess privacy and data risks across both existing environments and new initiatives.
Our experience spans privacy reviews, control assessments and PIAs across a range of sectors and operating environments. We bring together governance, risk, technology, privacy and operational perspectives, allowing us to assess privacy risk from both a strategic and practical perspective.
For organisations developing a new program, system, data-sharing arrangement or other initiative involving personal or sensitive information, a PIA can surface risks and concerns that may not otherwise be apparent, test whether the proposed approach remains appropriate as technology and expectations evolve, and provide an opportunity to address issues before they become embedded.
The earlier those questions are asked, the more options directors, councillors, committee members, executives and operational leaders have to answer them.
