{"text_format":"1","workbook":"xlsx","n_sheets":3,"sheets":["Privacy Assessment Worksheet","Privacy Assessment Summary (2)","Values"],"not_rendered":{"charts":11,"images":1,"macros":1,"external_links":0,"defined_names":41,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Privacy Assessment Worksheet","index":0,"n_rows":98,"n_cols":7,"rows_kept":98,"cut":false,"hidden":false,"merged":[[1,2,1,5],[16,2,16,5],[0,0,0,6],[41,2,41,5],[75,2,75,5],[2,2,2,5]]}
["[Agency] Privacy Protection Self-Assessment"]
[1,"Culture and leadership"]
[null,null,"Level of compliance",null,null,null,"Compliance References and Guidelines"]
[null,"Strong leadership is key to establishing a culture of privacy protection in agencies.  Executives who recognise the importance of good personal information handling in delivering services and building the trust of their clients, and actively encourage staff to embed privacy in their business processes, will make privacy core to the business and not just a compliance issue.","Select the response that best reflects your agency from the drop down list next to each requirement"]
[null,"Agencies with a privacy positive culture:"]
["a)","Support and advocate a privacy positive culture as a priority from the Board and executive to all levels of the organisation","Processes/procedures in place",null,null,null,"IPC Resources to improve performance and achievement"]
["b)","Have established, metrics-based privacy reporting processes","Processes/procedures in place",null,null,null,"Privacy Governance Framework"]
["c)","Support managers and staff by having strong governance structures that support reporting and managing privacy issues","Processes/procedures in place",null,null,null,"Checklist - Privacy for NSW Public Sector Agencies"]
["d)","Have data governance processes that address sensitive and high risk data","Processes/procedures in place",null,null,null,"Fact Sheet - Understanding your privacy obligations"]
["e)","Promote privacy by design in all projects","Processes/procedures in place"]
["f)","Have on-going audit and monitoring processes in place","Processes/procedures in place",null,null,null,"Fact Sheet - The PPIP Act: Agency delegations, systems and practices"]
["g)","Provide training and support to ensure all staff are aware of their responsibilities","Processes/procedures in place",null,null,null,"Privacy Management Plans"]
[]
[]
[]
[2,"Governance"]
[null,"Reporting on privacy in Annual Reports?","Level of compliance",null,null,null,"Compliance References and Guidelines"]
[null,"Under clause 6 of the Annual Reports (Departments) Regulation 2015 and clause 8 of the Annual Reports (Statutory Bodies) Regulation 2015, all agencies should include statements in their Annual reports that demonstrate their compliance with the PPIP Act (and HRIP Act where applicable) including any internal reviews. Not applicable for councils.","Select the response that best reflects your agency from the drop down list next to each requirement"]
["","Agency annual reports include:"]
["a)","A statement about privacy compliance under the PPIP Act","Compliant"]
["b)","Statistical details of any review conducted under Part 5 of the PPIP Act ","Compliant"]
[]
[]
[]
[]
[]
[]
[]
[null,"Some data breaches are serious and can potentially harm individuals and agencies whose information is breached. While NSW does not currently have a mandatory notifiable data breach reporting requirement, the Privacy Commissioner has a voluntary reporting scheme in place. The voluntary scheme encourages agencies that have experienced a serious data breach to report the details of the breach to the Privacy Commissioner, so that the Privacy Commissioner can assess the breach, provide advice or investigate.","Select the response that best reflects your agency from the drop down list next to each requirement"]
[null,"Agencies have in place: "]
["a)","A data breach policy that is understood by all staff","Processes/procedures in place",null,null,null,"IPC Resources to improve performance and achievement"]
["b)","A data breach response plan","Processes/procedures in place",null,null,null,"Data breach guidance for NSW agencies"]
["c)","An identified data breach response team","Processes/procedures in place",null,null,null,"Data breach notification form"]
["d)","A communications plan in the event of a data breach","Processes/procedures in place",null,null,null,"Data breach prevention checklist"]
["e)","Processes to make a voluntary notification of the breach to the IPC","Processes/procedures in place",null,null,null,"Essential Eight Guide to managing cyber security incidents"]
["f)","Processes to monitor to ensure that remediation actions have been followed and residual risks addressed","Processes/procedures in place"]
[]
[]
[]
[]
[3,"Supporting tools and systems"]
[null,null,"Level of compliance",null,null,null,"Compliance References and Guidelines"]
[null,"To be able to manage personal information effectively, agencies need to have a clear understanding of what personal information they hold, why it is collected, where it is stored, and how and by whom it is used.  IT governance structures and processes should support compliance with privacy principles, along with clearly defined roles and responsibilities and training and communication.","Select the response that best reflects your agency from the drop down list next to each requirement"]
[null,"For the personal information held by your agency, is it clear:"]
["a)","What personal information is held?","Processes/procedures in place",null,null,null,"IPC Resources to improve performance and achievement"]
["b)","Who is responsible for this information?","Processes/procedures in place",null,null,null,"Checklist - Identifying privacy issues"]
["c)","Where the information is stored?","Processes/procedures in place",null,null,null,"Fact Sheet - Health Privacy Principles"]
["d)","What the information is used for?","Processes/procedures in place",null,null,null,"Fact Sheet - Information Protection Principles"]
["e)","Who has access to it?","Processes/procedures in place",null,null,null,"Fact Sheet - Processing requests for personal information"]
[null,null,null,null,null,null,"Checklist - Responding to a request to access health information"]
[]
[]
[]
[null,"A Privacy Impact Assessment (PIA) assists public and private sector organisations to identify and minimise the privacy risks of changes to services, policies and new projects. Undertaking a PIA at an early point in a project will contribute to a \"privacy by design\" approach, identify and address any potential privacy concerns and assist compliance with privacy obligations"]
[null,"To comply with best practice for Privacy Impact Assessments your agency should:"]
["a)","Undertake PIAs for new projects, or where there is a significant change planned, at a point where the outcomes of the PIA can influence project design","Processes/procedures in place",null,null,null,"IPC Resources to improve performance and achievement"]
["b)","Include mapping of information flows, and identification of points where there may be privacy risks","Processes/procedures in place",null,null,null,"Guide - A guide to Privacy Impact Assessments"]
["c)","Consult with stakeholders to inform project design","Processes/procedures in place",null,null,null,"OAIC guide to undertaking privacy impact assessments"]
["d)","Check for compliance against the Information Protection Principles and Health Privacy Principles","Processes/procedures in place",null,null,null,"Fact Sheet - Privacy by Design"]
["e)","Identify risks and solutions to mitigate the risks identified","Processes/procedures in place",null,null,null,"Fact Sheet - The role of the Privacy Commissoner: Consulting the IPC on projects and initiatives"]
["f)","Make recommendations that are approved by an Audit and Risk Committee where necessary. These recommendations might consider for example, that the project should not go ahead, that changes to the project should occur, that further consultation is required or that the project does not present any privacy risks in its current form.","Processes/procedures in place"]
["g)","Update the PIA if there are changes made to the project","Processes/procedures in place"]
[]
[null,"The agency has clearly defined the roles and responsibilities of staff in the exercise of privacy functions."]
[null,"The agency has in place:"]
["a)","Appropriate delegations/ authorisations","Processes/procedures in place",null,null,null,"Fact Sheet - The PPIP Act: Agency delegations, systems and practices"]
["b)","Delegations/ authorisations are communicated in writing and easily located?","Processes/procedures in place",null,null,null,"Fact Sheet - Providing access to health information - guidance for healthcare providers"]
["c)","Delegations/ authorisations are regularly reviewed ","Processes/procedures in place",null,null,null,"Fact Sheet - Understanding your privacy obligations - for public sector staff"]
[]
[]
[]
[]
[]
[]
[4,"Legislative compliance and achievement "]
[null,"Privacy Management Plans","Level of compliance",null,null,null,"Compliance References and Guidelines"]
[null,"A privacy management plan is a strategic planning document in which the public sector agency describes the measures it proposes to take to ensure that it complies with the Privacy and Personal Information Protection Act 1998 (PPIP Act) and the Health Records and Information Privacy Act 2002 (HRIP Act).  Section 33 of the PPIP Act requires each NSW public sector agency to have a Privacy Management Plan and provide a copy to the NSW Privacy Commissioner.  Clause 6 of the Privacy and Personal Information Protection Regulation 2014 (PPIP Regulation) provides that specified public sector agencies are exempt from the privacy management plan requirements.  ","Select the response that best reflects your agency from the drop down list next to each requirement"]
["","Does your Agency's Privacy Management Plan include:"," "]
["a)","Information about how the agency develops policies that deal with compliance under the PPIP Act and HRIP Act","Compliant",null,null,null,"IPC Resources to improve performance and achievement"]
["b)","An overview of the main types of personal information the agency deals with, and how it is relevant to the agency's functions","Compliant",null,null,null,"Guide - A guide to making privacy management plans"]
["c)","Strategies in place to comply with the Information Protection Principles (IPPs) and Health Privacy Principles (HPPs)","Compliant",null,null,null,"Checklist - Privacy Management Plans"]
["d)","Any exemptions to the PPIP Act or HRIP Act","Compliant",null,null,null,"Guide - Data sharing and privacy"]
["e)","Details of any public registers","Compliant"]
["f)","Details of strategies to minimise the risk of employees committing an offence","Compliant"]
["g)","Procedures for privacy internal reviews","Compliant"]
["h)","The approach to training staff in the agency about privacy requirements, policies and practices","Compliant"]
["i)","References to relevant policies such as record keeping policies.","Compliant"]
["J)","The Privacy Management Plan should be accessible on the agency website and made available in other ways on request.","Compliant"]
["K)","The agency should have a process in place to review and update the plan at least every 2 years, and preferably annually.","Compliant"]
[]
[null,"Under section 53 of the PPIP Act and section 21 of the HRIP Act, individuals who have a privacy complaint have the right to an internal review.  Agencies must notify the Privacy Commissioner that an internal review has been initiated, and inform the Privacy Commissioner of actions that are proposed (PPIP Act, section 54)."]
[null,"To comply with the requirements for internal reviews, your agency should:"]
["a)","Notify the Privacy Commissioner that an application for internal review has been received","Compliant",null,null,null,"Guides - The Privacy Commissioner's oversight role in internal reviews of privacy complaints"]
["b)","Ensure that reviews are undertaken by an individual within the agency who is directed by the agency to deal with the application, is suitably qualified to deal with the subject of the complaint, and was not involved in any way in the original matter","Compliant",null,null,null,"Checklist - Privacy internal reviews"]
["c)","Ensure that reviews are completed within a maximum of 60 days from the date the application was received. After 60 days, the applicant is entitled under section 55 of the PPIP Act to make an application to the Tribunal for administrative review.","Compliant",null,null,null,"Form - Privacy complaints - internal review"]
["d)","Identify remedial actions that should be implemented, and monitor to ensure that these occur. Remedial actions might include for example, staff training, updating relevant policies and providing an apology","Compliant"]
["e)","Ensure that within 14 days of completion of the review, the applicant is notified of the findings of the review, the actions proposed to be taken and the right of the individual to have the findings reviewed by the Tribunal","Compliant"]
["f)","Ensure that the Privacy Commissioner has been notified of the findings of the review and the actions proposed to be taken","Compliant"]

{"sheet":"Privacy Assessment Summary (2)","index":1,"n_rows":10,"n_cols":6,"rows_kept":10,"cut":false,"hidden":true,"merged":[[0,0,0,5]]}
["Privacy Compliance Assessment\nSummary"]
["1.","Does your agency have a fully compliant Privacy Management Plan in place?","2.","Reporting on privacy in Annual Reports?","3."]
[null,"Strong leadership is key to establishing a culture of privacy protection in agencies.  Executives who recognise the importance of good personal information handling in delivering services and building the trust of their clients, and actively encourage staff to embed privacy in their business processes, will make privacy core to the business and not just a compliance issue.",null,"Under clause 6 of the Annual Reports (Departments) Regulation 2015 and clause 8 of the Annual Reports (Statutory Bodies) Regulation 2015, all agencies should include statements in their Annual reports that demonstrate their compliance with the PPIP Act (and HRIP Act where applicable) including any internal reviews.  ",null,"To be able to manage personal information effectively, agencies need to have a clear understanding of what personal information they hold, why it is collected, where it is stored, and how and by whom it is used.  IT governance structures and processes should support compliance with privacy principles, along with clearly defined roles and responsibilities and training and communication."]
[]
[]
[]
[]
[]
["4.","Privacy Management Plans?"]
[null,"A privacy management plan is a strategic planning document in which the public sector agency describes the measures it proposes to take to ensure that it complies with the Privacy and Personal Information Protection Act 1998 (PPIP Act) and the Health Records and Information Privacy Act 2002 (HRIP Act).  Section 33 of the PPIP Act requires each NSW public sector agency to have a Privacy Management Plan and provide a copy to the NSW Privacy Commissioner.  Clause 6 of the Privacy and Personal Information Protection Regulation 2014 (PPIP Regulation) provides that specified public sector agencies are exempt from the privacy management plan requirements.  "]

{"sheet":"Values","index":2,"n_rows":93,"n_cols":7,"rows_kept":93,"cut":false,"hidden":false,"merged":[]}
["Values"]
[null,null,null,"Privacy Compliance Assessment"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B6","v":"Support and advocate a privacy positive culture as a priority from the Board and executive to all levels of the organisation"},{"$f":"IF('Privacy Assessment Worksheet'!C6=$A$19,2,(IF('Privacy Assessment Worksheet'!C6=$A$18,1,(IF('Privacy Assessment Worksheet'!C6=$A$17,0,0)))))","v":2},{"$f":"ROWS('Privacy Assessment Worksheet'!C6:C12)*2","v":14}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B7","v":"Have established, metrics-based privacy reporting processes"},{"$f":"IF('Privacy Assessment Worksheet'!C7=$A$19,2,(IF('Privacy Assessment Worksheet'!C7=$A$18,1,(IF('Privacy Assessment Worksheet'!C7=$A$17,0,0)))))","v":2},{"$f":"SUM(F12:F18)","v":14}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B8","v":"Support managers and staff by having strong governance structures that support reporting and managing privacy issues"},{"$f":"IF('Privacy Assessment Worksheet'!C8=$A$19,2,(IF('Privacy Assessment Worksheet'!C8=$A$18,1,(IF('Privacy Assessment Worksheet'!C8=$A$17,0,0)))))","v":2},{"$f":"G13/G12","v":1}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B9","v":"Have data governance processes that address sensitive and high risk data"},{"$f":"IF('Privacy Assessment Worksheet'!C9=$A$19,2,(IF('Privacy Assessment Worksheet'!C9=$A$18,1,(IF('Privacy Assessment Worksheet'!C9=$A$17,0,0)))))","v":2},{"$f":"1-G14","v":0}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B10","v":"Promote privacy by design in all projects"},{"$f":"IF('Privacy Assessment Worksheet'!C10=$A$19,2,(IF('Privacy Assessment Worksheet'!C10=$A$18,1,(IF('Privacy Assessment Worksheet'!C10=$A$17,0,0)))))","v":2}]
["Processes/procedures absent",null,null,null,{"$f":"'Privacy Assessment Worksheet'!B11","v":"Have on-going audit and monitoring processes in place"},{"$f":"IF('Privacy Assessment Worksheet'!C11=$A$19,2,(IF('Privacy Assessment Worksheet'!C11=$A$18,1,(IF('Privacy Assessment Worksheet'!C11=$A$17,0,0)))))","v":2}]
["Processes/procedures under development",null,null,null,{"$f":"'Privacy Assessment Worksheet'!B12","v":"Provide training and support to ensure all staff are aware of their responsibilities"},{"$f":"IF('Privacy Assessment Worksheet'!C12=$A$19,2,(IF('Privacy Assessment Worksheet'!C12=$A$18,1,(IF('Privacy Assessment Worksheet'!C12=$A$17,0,0)))))","v":2}]
["Processes/procedures in place"]
[]
["Allowed Responses"]
["Non-compliant"]
["In Progress",null,null,"",{"$f":"'Privacy Assessment Worksheet'!B20","v":"A statement about privacy compliance under the PPIP Act"},{"$f":"IF('Privacy Assessment Worksheet'!C20=$A$24,2,IF('Privacy Assessment Worksheet'!C20=$A$25,2,IF('Privacy Assessment Worksheet'!C20=$A$23,1,(IF('Privacy Assessment Worksheet'!C20=$A$22,0)))))","v":2},{"$f":"ROWS('Privacy Assessment Worksheet'!C20:C21)*2","v":4}]
["Compliant",null,null,null,{"$f":"'Privacy Assessment Worksheet'!B21","v":"Statistical details of any review conducted under Part 5 of the PPIP Act "},{"$f":"IF('Privacy Assessment Worksheet'!C21=$A$24,2,IF('Privacy Assessment Worksheet'!C21=$A$25,2,IF('Privacy Assessment Worksheet'!C21=$A$23,1,(IF('Privacy Assessment Worksheet'!C21=$A$22,0,0)))))","v":2},{"$f":"SUM(F23:F24)","v":4}]
["Not applicable",null,null,null,null,null,{"$f":"G24/G23","v":1}]
[null,null,null,null,null,null,{"$f":"1-G25","v":0}]
[]
[]
[]
[]
[]
[]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B31","v":"A data breach policy that is understood by all staff"},{"$f":"IF('Privacy Assessment Worksheet'!C31=$A$19,2,(IF('Privacy Assessment Worksheet'!C31=$A$18,1,(IF('Privacy Assessment Worksheet'!C31=$A$17,0,0)))))","v":2},{"$f":"ROWS('Privacy Assessment Worksheet'!C45:C50)*2","v":12}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B32","v":"A data breach response plan"},{"$f":"IF('Privacy Assessment Worksheet'!C32=$A$19,2,(IF('Privacy Assessment Worksheet'!C32=$A$18,1,(IF('Privacy Assessment Worksheet'!C32=$A$17,0,0)))))","v":2},{"$f":"SUM(F33:F38)","v":12}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B33","v":"An identified data breach response team"},{"$f":"IF('Privacy Assessment Worksheet'!C33=$A$19,2,(IF('Privacy Assessment Worksheet'!C33=$A$18,1,(IF('Privacy Assessment Worksheet'!C33=$A$17,0,0)))))","v":2},{"$f":"G34/G33","v":1}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B34","v":"A communications plan in the event of a data breach"},{"$f":"IF('Privacy Assessment Worksheet'!C34=$A$19,2,(IF('Privacy Assessment Worksheet'!C34=$A$18,1,(IF('Privacy Assessment Worksheet'!C34=$A$17,0,0)))))","v":2},{"$f":"1-G35","v":0}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B35","v":"Processes to make a voluntary notification of the breach to the IPC"},{"$f":"IF('Privacy Assessment Worksheet'!C35=$A$19,2,(IF('Privacy Assessment Worksheet'!C35=$A$18,1,(IF('Privacy Assessment Worksheet'!C35=$A$17,0,0)))))","v":2}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B36","v":"Processes to monitor to ensure that remediation actions have been followed and residual risks addressed"},{"$f":"IF('Privacy Assessment Worksheet'!C36=$A$19,2,(IF('Privacy Assessment Worksheet'!C36=$A$18,1,(IF('Privacy Assessment Worksheet'!C36=$A$17,0,0)))))","v":2}]
[]
[]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B45","v":"What personal information is held?"},{"$f":"IF('Privacy Assessment Worksheet'!C45=$A$19,2,(IF('Privacy Assessment Worksheet'!C45=$A$18,1,(IF('Privacy Assessment Worksheet'!C45=$A$17,0,0)))))","v":2},{"$f":"ROWS('Privacy Assessment Worksheet'!C45:C49)*2","v":10}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B46","v":"Who is responsible for this information?"},{"$f":"IF('Privacy Assessment Worksheet'!C46=$A$19,2,(IF('Privacy Assessment Worksheet'!C46=$A$18,1,(IF('Privacy Assessment Worksheet'!C46=$A$17,0,0)))))","v":2},{"$f":"SUM(F41:F45)","v":10}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B47","v":"Where the information is stored?"},{"$f":"IF('Privacy Assessment Worksheet'!C47=$A$19,2,(IF('Privacy Assessment Worksheet'!C47=$A$18,1,(IF('Privacy Assessment Worksheet'!C47=$A$17,0,0)))))","v":2},{"$f":"G42/G41","v":1}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B48","v":"What the information is used for?"},{"$f":"IF('Privacy Assessment Worksheet'!C48=$A$19,2,(IF('Privacy Assessment Worksheet'!C48=$A$18,1,(IF('Privacy Assessment Worksheet'!C48=$A$17,0,0)))))","v":2},{"$f":"1-G43","v":0}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B49","v":"Who has access to it?"},{"$f":"IF('Privacy Assessment Worksheet'!C49=$A$19,2,(IF('Privacy Assessment Worksheet'!C49=$A$18,1,(IF('Privacy Assessment Worksheet'!C49=$A$17,0,0)))))","v":2}]
[]
[]
[]
[]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B56","v":"Undertake PIAs for new projects, or where there is a significant change planned, at a point where the outcomes of the PIA can influence project design"},{"$f":"IF('Privacy Assessment Worksheet'!C56=$A$19,2,(IF('Privacy Assessment Worksheet'!C56=$A$18,1,(IF('Privacy Assessment Worksheet'!C56=$A$17,0,0)))))","v":2},{"$f":"ROWS('Privacy Assessment Worksheet'!C56:C62)*2","v":14}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B57","v":"Include mapping of information flows, and identification of points where there may be privacy risks"},{"$f":"IF('Privacy Assessment Worksheet'!C57=$A$19,2,(IF('Privacy Assessment Worksheet'!C57=$A$18,1,(IF('Privacy Assessment Worksheet'!C57=$A$17,0,0)))))","v":2},{"$f":"SUM(F50:F56)","v":14}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B58","v":"Consult with stakeholders to inform project design"},{"$f":"IF('Privacy Assessment Worksheet'!C58=$A$19,2,(IF('Privacy Assessment Worksheet'!C58=$A$18,1,(IF('Privacy Assessment Worksheet'!C58=$A$17,0,0)))))","v":2},{"$f":"G51/G50","v":1}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B59","v":"Check for compliance against the Information Protection Principles and Health Privacy Principles"},{"$f":"IF('Privacy Assessment Worksheet'!C59=$A$19,2,(IF('Privacy Assessment Worksheet'!C59=$A$18,1,(IF('Privacy Assessment Worksheet'!C59=$A$17,0,0)))))","v":2},{"$f":"1-G52","v":0}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B60","v":"Identify risks and solutions to mitigate the risks identified"},{"$f":"IF('Privacy Assessment Worksheet'!C60=$A$19,2,(IF('Privacy Assessment Worksheet'!C60=$A$18,1,(IF('Privacy Assessment Worksheet'!C60=$A$17,0,0)))))","v":2}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B61","v":"Make recommendations that are approved by an Audit and Risk Committee where necessary. These recommendations might consider for example, that the project should not go ahead, that changes to the project should occur, that further consultation is required or that the project does not present any privacy risks in its current form."},{"$f":"IF('Privacy Assessment Worksheet'!C61=$A$19,2,(IF('Privacy Assessment Worksheet'!C61=$A$18,1,(IF('Privacy Assessment Worksheet'!C61=$A$17,0,0)))))","v":2}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B62","v":"Update the PIA if there are changes made to the project"},{"$f":"IF('Privacy Assessment Worksheet'!C62=$A$19,2,(IF('Privacy Assessment Worksheet'!C62=$A$18,1,(IF('Privacy Assessment Worksheet'!C62=$A$17,0,0)))))","v":2}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,"",{"$f":"'Privacy Assessment Worksheet'!B66","v":"Appropriate delegations/ authorisations"},{"$f":"IF('Privacy Assessment Worksheet'!C66=$A$19,2,(IF('Privacy Assessment Worksheet'!C66=$A$18,1,(IF('Privacy Assessment Worksheet'!C66=$A$17,0,0)))))","v":2},{"$f":"ROWS('Privacy Assessment Worksheet'!C66:C68)*2","v":6}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B67","v":"Delegations/ authorisations are communicated in writing and easily located?"},{"$f":"IF('Privacy Assessment Worksheet'!C67=$A$19,2,(IF('Privacy Assessment Worksheet'!C67=$A$18,1,(IF('Privacy Assessment Worksheet'!C67=$A$17,0,0)))))","v":2},{"$f":"SUM(F68:F70)","v":6}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B68","v":"Delegations/ authorisations are regularly reviewed "},{"$f":"IF('Privacy Assessment Worksheet'!C68=$A$19,2,(IF('Privacy Assessment Worksheet'!C68=$A$18,1,(IF('Privacy Assessment Worksheet'!C68=$A$17,0,0)))))","v":2},{"$f":"G69/G68","v":1}]
[null,null,null,null,null,null,{"$f":"1-G70","v":0}]
[]
[]
[]
[]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B79","v":"Information about how the agency develops policies that deal with compliance under the PPIP Act and HRIP Act"},{"$f":"IF('Privacy Assessment Worksheet'!C79=$A$24,2,(IF('Privacy Assessment Worksheet'!C79=$A$23,1,(IF('Privacy Assessment Worksheet'!C79=$A$22,0,0)))))","v":2},{"$f":"ROWS('Privacy Assessment Worksheet'!C79:C89)*2","v":22}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B80","v":"An overview of the main types of personal information the agency deals with, and how it is relevant to the agency's functions"},{"$f":"IF('Privacy Assessment Worksheet'!C80=$A$24,2,(IF('Privacy Assessment Worksheet'!C80=$A$23,1,(IF('Privacy Assessment Worksheet'!C80=$A$22,0,0)))))","v":2},{"$f":"SUM(F76:F86)","v":22}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B81","v":"Strategies in place to comply with the Information Protection Principles (IPPs) and Health Privacy Principles (HPPs)"},{"$f":"IF('Privacy Assessment Worksheet'!C81=$A$24,2,(IF('Privacy Assessment Worksheet'!C81=$A$23,1,(IF('Privacy Assessment Worksheet'!C81=$A$22,0,0)))))","v":2},{"$f":"G77/G76","v":1}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B82","v":"Any exemptions to the PPIP Act or HRIP Act"},{"$f":"IF('Privacy Assessment Worksheet'!C82=$A$24,2,(IF('Privacy Assessment Worksheet'!C82=$A$23,1,(IF('Privacy Assessment Worksheet'!C82=$A$22,0,0)))))","v":2},{"$f":"1-G78","v":0}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B83","v":"Details of any public registers"},{"$f":"IF('Privacy Assessment Worksheet'!C83=$A$24,2,(IF('Privacy Assessment Worksheet'!C83=$A$23,1,(IF('Privacy Assessment Worksheet'!C83=$A$22,0,0)))))","v":2}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B84","v":"Details of strategies to minimise the risk of employees committing an offence"},{"$f":"IF('Privacy Assessment Worksheet'!C84=$A$24,2,(IF('Privacy Assessment Worksheet'!C84=$A$23,1,(IF('Privacy Assessment Worksheet'!C84=$A$22,0,0)))))","v":2}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B85","v":"Procedures for privacy internal reviews"},{"$f":"IF('Privacy Assessment Worksheet'!C85=$A$24,2,(IF('Privacy Assessment Worksheet'!C85=$A$23,1,(IF('Privacy Assessment Worksheet'!C85=$A$22,0,0)))))","v":2}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B86","v":"The approach to training staff in the agency about privacy requirements, policies and practices"},{"$f":"IF('Privacy Assessment Worksheet'!C86=$A$24,2,(IF('Privacy Assessment Worksheet'!C86=$A$23,1,(IF('Privacy Assessment Worksheet'!C86=$A$22,0,0)))))","v":2}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B87","v":"References to relevant policies such as record keeping policies."},{"$f":"IF('Privacy Assessment Worksheet'!C87=$A$24,2,(IF('Privacy Assessment Worksheet'!C87=$A$23,1,(IF('Privacy Assessment Worksheet'!C87=$A$22,0,0)))))","v":2}]
[null,null,null,"",{"$f":"'Privacy Assessment Worksheet'!B88","v":"The Privacy Management Plan should be accessible on the agency website and made available in other ways on request."},{"$f":"IF('Privacy Assessment Worksheet'!C88=$A$24,2,(IF('Privacy Assessment Worksheet'!C88=$A$23,1,(IF('Privacy Assessment Worksheet'!C88=$A$22,0,0)))))","v":2}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B89","v":"The agency should have a process in place to review and update the plan at least every 2 years, and preferably annually."},{"$f":"IF('Privacy Assessment Worksheet'!C89=$A$24,2,(IF('Privacy Assessment Worksheet'!C89=$A$23,1,(IF('Privacy Assessment Worksheet'!C89=$A$22,0,0)))))","v":2}]
[]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B93","v":"Notify the Privacy Commissioner that an application for internal review has been received"},{"$f":"IF('Privacy Assessment Worksheet'!C93=$A$24,2,(IF('Privacy Assessment Worksheet'!C93=$A$23,1,(IF('Privacy Assessment Worksheet'!C93=$A$22,0,0)))))","v":2},{"$f":"ROWS('Privacy Assessment Worksheet'!C93:C98)*2","v":12}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B94","v":"Ensure that reviews are undertaken by an individual within the agency who is directed by the agency to deal with the application, is suitably qualified to deal with the subject of the complaint, and was not involved in any way in the original matter"},{"$f":"IF('Privacy Assessment Worksheet'!C94=$A$24,2,(IF('Privacy Assessment Worksheet'!C94=$A$23,1,(IF('Privacy Assessment Worksheet'!C94=$A$22,0,0)))))","v":2},{"$f":"SUM(F88:F93)","v":12}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B95","v":"Ensure that reviews are completed within a maximum of 60 days from the date the application was received. After 60 days, the applicant is entitled under section 55 of the PPIP Act to make an application to the Tribunal for administrative review."},{"$f":"IF('Privacy Assessment Worksheet'!C95=$A$24,2,(IF('Privacy Assessment Worksheet'!C95=$A$23,1,(IF('Privacy Assessment Worksheet'!C95=$A$22,0,0)))))","v":2},{"$f":"G89/G88","v":1}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B96","v":"Identify remedial actions that should be implemented, and monitor to ensure that these occur. Remedial actions might include for example, staff training, updating relevant policies and providing an apology"},{"$f":"IF('Privacy Assessment Worksheet'!C96=$A$24,2,(IF('Privacy Assessment Worksheet'!C96=$A$23,1,(IF('Privacy Assessment Worksheet'!C96=$A$22,0,0)))))","v":2},{"$f":"1-G90","v":0}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B97","v":"Ensure that within 14 days of completion of the review, the applicant is notified of the findings of the review, the actions proposed to be taken and the right of the individual to have the findings reviewed by the Tribunal"},{"$f":"IF('Privacy Assessment Worksheet'!C97=$A$24,2,(IF('Privacy Assessment Worksheet'!C97=$A$23,1,(IF('Privacy Assessment Worksheet'!C97=$A$22,0,0)))))","v":2}]
[null,null,null,null,{"$f":"'Privacy Assessment Worksheet'!B98","v":"Ensure that the Privacy Commissioner has been notified of the findings of the review and the actions proposed to be taken"},{"$f":"IF('Privacy Assessment Worksheet'!C98=$A$24,2,(IF('Privacy Assessment Worksheet'!C98=$A$23,1,(IF('Privacy Assessment Worksheet'!C98=$A$22,0,0)))))","v":2}]