Policy - Privacy Commissioner - Executed Instrument of Delegation to Staff

Read the document below or download it here: Privacy Commissioner - Privacy Commissioner - Instrument of Delegation to Staff March 2026

Instrument of Delegation
Privacy and Personal Information Protection Act 1998 (NSW)
Health Records and Information Privacy Act 2002 (NSW)
Public Interest Disclosures Act 2022 (NSW)

I, Sonia Minutillo, Privacy Commissioner, under section 35H of the Privacy and Personal Information Protection Act 1998 (PPIP Act), revoke all previous delegations made under that Act and delegate the exercise and performance of matters arising under, or incidental to the functions, authorities, duties and powers set out in Schedules 1, 2 and 3 to this instrument, to the officers appointed (whether on an ongoing, acting or temporary basis) to the roles set out in those schedules.

The Privacy Commissioner has such functions as may be conferred or imposed on the Commissioner under the PPIP Act or any other Act: section 36(1), PPIP Act.

This instrument delegates the functions, authorities, duties and powers of the Privacy Commissioner under:

the Privacy and Personal Information Protection Act 1998 (NSW)
the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act)
the Public Interest Disclosures Act 2022 (NSW)

A delegation under this instrument is subject to the following conditions:

A delegate is not authorised to sub-delegate any of the delegated functions to another person
A delegation may be temporarily withdrawn by a more senior delegate at any time, provided it is within their area of responsibility. This is to be managed as a local administrative arrangement and must be communicated in writing to relevant delegates.
Managers have a responsibility to ensure all their staff, particularly those who hold a delegation, are aware of, and understand the powers and limitations of the delegations and the associated responsibilities.
Delegates found to have exercised a delegation improperly or exceeded the scope of their delegation, may have their delegation(s) revoked without notice, in addition to any other disciplinary action.

In relation to the identification of a delegate, the abbreviations used in this Instrument have the following meanings:

RSO	Regulatory Support Officer
RO	Regulatory Officer
SRO	Senior Regulatory Officer
PA	Principal Analyst, Data Evaluation & Reporting
MIR	Manager, Investigations and Reviews
MCPC	Manager, Complaints and Proactive Compliance
AC	Assistant Commissioner, Reviews and Compliance
MCCA	Manager, Communications and Corporate Affairs
DCSBI	Director, Corporate Services and Business Improvement
SPO	Senior Policy Officer
PPO	Principal Policy Officer
SL	Senior Lawyer

This instrument takes effect from the date it is executed.

This delegation will continue until revoked notwithstanding the termination of my term of office as Privacy Commissioner.

Sonia Minutillo

Privacy Commissioner

Date: 6 March 2026

Instrument of Delegation – Schedule 1

Privacy and Personal Information Protection Act 1998 (NSW)

Section

Description

Investigations and Review

Communications and Corporate Services

Legal Counsel and Regulatory Advice

RSO

SRO

MIR

MCPC

MCCA

DCSBI

SPO, PPO

DRAGC

s. 36(2)(a)

Promoting the adoption and monitoring compliance with the information protection principles.

s. 36(2)(b)

Preparing and publishing guidelines relating to the protection of personal information and other privacy matters, and promoting the adoption of such guidelines.

s. 36(2)(c)

Initiating and recommending the making of privacy codes of practice.

s. 36(2)(d)

Providing assistance to public sector agencies in adopting and complying with the information protection principles, privacy codes of practice and the mandatory notification of data breach scheme.

Section

Description

Investigations and Review

Communications and Corporate Services

Legal Counsel and Regulatory Advice

RSO

SRO

MIR

MCPC

MCCA

DCSBI

SPO, PPO

DRAGC

s. 36(2)(e)

Providing assistance to public sector agencies in preparing and implementing privacy management plans under section 33, and data breach policies under section 59ZD of the PPIP Act.

s. 36(2)(f)

Conducting research and collecting and collating information about any matter relating to the protection of personal information and the privacy of individuals.

s. 36(2)(g)

Providing advice on matters relating to the protection of personal information and the privacy of individuals.

s. 36(2)(i)

Conducting education programs and disseminating information for the purpose of promoting the protection of the privacy of individuals.

s.36(2)(k)

Receiving, investigating and conciliating complaints about privacy related matters (including conduct to which Part 5 applies).

Section

Description

Investigations and Review

Communications and Corporate Services

Legal Counsel and Regulatory Advice

RSO

SRO

MIR

MCPC

MCCA

DCSBI

SPO, PPO

DRAGC

s. 36(2)(l)

Conducting inquiries and investigating privacy related matters as the Privacy Commissioner thinks appropriate.

s.36(2)(m)

Investigating, monitoring, auditing and reporting on a public sector agency’s compliance with Part 6A of the PPIP Act, including the agency’s data handling systems, policies and practices.

s. 36(3)

Consulting with the Information Commissioner before preparing guidelines concerning limits in relation to the information protection principle set out in section 18 of the PPIP Act (Limits on disclosure of personal information).

s. 37

Requiring a person or public sector agency to provide a statement of information or produce a document/thing or copy of a document.

s. 38

Conducting inquiries and investigations.

Section

Description

Investigations and Review

Communications and Corporate Services

Legal Counsel and Regulatory Advice

RSO

SRO

MIR

MCPC

MCCA

DCSBI

SPO, PPO

DRAGC

s. 39

Determining the procedure for inquiries and investigations.

s. 40

Preparing and publishing information digest setting out the nature and source of personal information held by public sector agencies and requiring details relating to the personal information from public sector agencies.

s. 42

Requiring agencies to provide information about compliance arrangements.

s. 45

Receiving and dealing with privacy related complaints and requiring information about a complaint.

s. 46(1)

Conducting a preliminary assessment of privacy related complaint.

s. 46(2)

Informing the complainant of the review process.

s. 46(3)

Deciding not to deal with a complaint if satisfied of certain matters.

s. 47

Referring complaints for investigation or other action.

Section

Description

Investigations and Review

Communications and Corporate Services

Legal Counsel and Regulatory Advice

RSO

SRO

MIR

MCPC

MCCA

DCSBI

SPO, PPO

DRAGC

s. 48

Dealing with privacy related complaints and making inquiries and investigations in relation to complaints

s. 49

Resolving privacy related complaints by conciliation.

s. 51

Conducting an inquiry or investigation into general issues or matters raised in connection with the complaint even though the complaint referred or declined.

s. 54(1)

Receiving an application for internal review.

s. 54(2)

Making submissions on internal review.

s. 54(3)

Undertaking an internal review on behalf of an agency and making a report to an agency in relation to application for review.

s. 55(6)

Appearing and making submissions in Tribunal proceedings.

Section

Description

Investigations and Review

Communications and Corporate Services

Legal Counsel and Regulatory Advice

RSO

SRO

MIR

MCPC

MCCA

DCSBI

SPO, PPO

DRAGC

s. 59K(5)

Requesting further information from a public sector agency about the progress of the assessment of a data breach.

s. 59P(5)

Publishing information on the Commissioner’s website about how to access the notification made by a public sector agency.

s. 59Z

Investigating, monitoring, auditing and reporting on the exercise of a function of 1 or more public sector agencies, including the systems, policies and practices of an agency.

s. 59ZA(3)

Enter the premises based upon notice issued under s. 59ZA(1) and observe a demonstration of the agency’s data handling systems, policies and procedures and inspect documents.

Instrument of Delegation – Schedule 2

Health Records and Information Privacy Act 2002 (NSW)

Section	Description	Investigations and Review						Legal Counsel and Regulatory Advice
Section	Description	RSO	RO	SRO	MIR	MCPC	AC	SPO, PPO	SL	DRAGC
s. 24	Issuing guidelines with respect to access to, and retention and amendment of, health information held by private sector persons for the purpose of assisting them to comply with the Health Privacy Principles.				X	X	X			X
s. 42	Receiving privacy related complaints and allowing an extension of time for making a complaint.	X	X	X	X	X	X	X	X	X
s. 43(1)	Making a preliminary assessment of a complaint.		X	X	X	X	X	X	X	X
s. 43(2), (3)	Deciding not to deal with a complaint if satisfied of certain matters and advising complainant of reasons for deciding to not deal with a complaint.				X	X	X			X
s. 44(1)	Assessing of complaints, including making inquiries and investigations to determine prima facie case of breach.		X	X	X	X	X	X	X	X

Section	Description	Investigations and Review						Legal Counsel and Regulatory Advice
Section	Description	RSO	RO	SRO	MIR	MCPC	AC	SPO, PPO	SL	DRAGC
s. 44(2), (3)	If there is no prima facie case, ceasing to deal with complaint and advising complainant of reasons for ceasing to deal with complaint.		X	X	X	X	X	X	X	X
s. 45	Dealing with complaints, considering certain matters and notifying complainant and respondent of outcome.		X	X	X	X	X	X	X	X
s. 46	Resolving complaint by conciliation.		X	X	X	X	X	X	X	X
s. 50(2)	Appearing and making submissions in Tribunal proceedings in relation to an inquiry.			X	X	X	X	X	X	X
s. 58(a)	Promoting the adoption and monitoring compliance with the Health Privacy Principles and the provisions of Part 4 of the HRIP Act.	X	X	X	X	X	X	X	X	X
s. 58(b)	Preparing and publishing guidelines relating to the protection of health information and other privacy matters, and to promote the adoption of such guidelines.				X	X	X			X

Section

Description

Investigations and Review

Legal Counsel and Regulatory Advice

RSO

SRO

MIR

MCPC

SPO,

PPO

DRAGC

s. 58(c)

Providing assistance to organisations in adopting and complying with the Health Privacy Principles and the provisions of Part 4 of the HRIP Act.

s. 58(d)

Conducting research, and collecting and collating information about any matter relating to the protection of health information and the privacy of individuals.

s. 58(e)

Providing advice on matters relating to the protection of health information and the privacy of individuals.

s. 58(f)

Receiving, investigating and conciliating complaints about alleged contraventions of the Health Privacy Principles, the provisions of Part 4 or any health privacy code of practice.

s. 59(1)(a)-

(c)

Requiring a person or organisation to give a statement of information, or to produce any document or other thing, or to give a copy of any document.

Section	Description	Investigations and Review						Legal Counsel and Regulatory Advice
Section	Description	RSO	RO	SRO	MIR	MCPC	AC	SPO, PPO	SL	DRAGC
s. 60	Conducting inquiries and investigations.		X	X	X	X	X	X	X	X
s. 61	Determining procedures for inquiries and investigations.				X	X	X			X
s. 63	Requiring an organisation to provide information about compliance arrangements and demonstrating the means by which the organisation is implementing such arrangements.				X	X	X			X
s. 64	Issuing, amending and replacing guidelines.				X	X	X			X
s. 65	Referring privacy related complaint to Health Care Complaints Commission if the complaint concerns the professional conduct of a health service provider or a health service that affects the clinical management or care of a person who uses or receives a health service (including a patient)				X	X	X			X
s. 66	Referring and communicating a privacy related complaint to the Commonwealth Privacy Commissioner.				X	X	X			X

Section

Description

Investigations and Review

Legal Counsel and Regulatory Advice

RSO

SRO

MIR

MCPC

SPO,

PPO

DRAGC

s. 67

Referring a privacy related complaint to other persons or bodies(the relevant authority).

Instrument of Delegation - Schedule 3

Public Interest Disclosures Act 2022 (NSW)

Section	Description	Investigations and Review						Legal Counsel and Regulatory Advice
Section	Description	RSO	RO	SRO	MIR	MCPC	AC	SPO, PPO	SL	DRAGC
s. 34	Referrals of information relating to detrimental action offences						X			X
s. 54(2)	Consult the Ombudsman or another integrity agency in relation to action or proposed action to deal with a voluntary public interest disclosure.				X	X	X			X
s. 55 and 56	Investigate a voluntary public interest disclosure.			X	X	X	X		X	X
s. 57(3)	Consider, consult if required and refer a voluntary public interest disclosure.						X			X
s. 78	Provide annual return to Ombudsman						X			X

Policy - Privacy Commissioner - Executed Instrument of Delegation to Staff March 2026

Policy - Privacy Commissioner - Executed Instrument of Delegation to Staff

Instrument of Delegation
Privacy and Personal Information Protection Act 1998 (NSW)
Health Records and Information Privacy Act 2002 (NSW)
Public Interest Disclosures Act 2022 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW)

Instrument of Delegation – Schedule 2

Health Records and Information Privacy Act 2002 (NSW)

Instrument of Delegation - Schedule 3

Navigate

Useful links

IPC Social Media

Policy - Privacy Commissioner - Executed Instrument of Delegation to Staff

Instrument of DelegationPrivacy and Personal Information Protection Act 1998 (NSW) Health Records and Information Privacy Act 2002 (NSW)Public Interest Disclosures Act 2022 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW)

Instrument of Delegation – Schedule 2

Health Records and Information Privacy Act 2002 (NSW)

Instrument of Delegation - Schedule 3

Navigate

Useful links

IPC Social Media

Instrument of Delegation
Privacy and Personal Information Protection Act 1998 (NSW)
Health Records and Information Privacy Act 2002 (NSW)
Public Interest Disclosures Act 2022 (NSW)