Privacy policy

Policy document number: 326463 Version: 7 Last updated: 29 September 2025

1. Overview

1.1 At a glance

Sydney Water has obligations to comply with the Privacy and Personal Information Protection Act 1998 NSW ('PPIP Act') and other Privacy Laws when handling Personal Information and/or Health Information.
For the purposes of this policy, any reference to Personal Information will include Health Information, and the PPIP Act together with each of the Privacy Laws identified in section 3 of this policy and is referred collectively as Privacy Laws.

1.2 Scope

This policy applies to all:

• Sydney Water employees and agency hire workers ('Employees'); and
• personnel of Sydney Water’s contractors and agents ('Contractor Personnel'), who handle or hold Personal Information (known as you or your under this policy) for Sydney Water.

This policy does not specifically deal with how we manage and protect any particular type of Personal Information, such as an employment record. For information about how Sydney Water handles specific types of Personal Information, please refer to the relevant procedure or policy document identified in section 3.2 of this policy.

1.3 Objective

The primary objective of this policy is to assist you to comply with the Privacy Laws that are relevant to Sydney Water’s business and to support Sydney Water’s commitment to manage and protect Personal Information of our customers, employees, contractor personnel and to all other individuals who engage with Sydney Water.

1.4 What is Personal Information?

Personal information is defined in section 4 of the PPIP Act as information or an opinion about an individual whose identity is apparent or can reasonably be ascertained by the information or opinion. It is also given its meaning by the various Privacy Laws.

The types of Personal Information that Sydney Water holds and routinely deals with, is in Annexure A of the Privacy Management Plan.

1.5 Management of personal information

How we manage and protect Personal Information is important from both a compliance perspective and the perspective of maintaining an individual’s trust and confidence in how we manage and protect their Personal Information.

The NSW Privacy Laws are structured in a manner that describe the information management lifecycle. There are minimum requirements that must be met from a compliance perspective for each stage of this lifecycle. These requirements are derived from the information privacy principles (IPPs) in the PPIP Act and the health privacy principles (HPPs) in the Health Records and Information Privacy Act 2002 NSW (HRIP Act). These principles are referred to in brackets below:

1.5.1 Collection (IPP/HPP 1-4)

Personal Information is collected by Sydney Water verbally, electronically or in paper form. Collection occurs when we request it from an individual or when an individual provides their Personal Information to Sydney Water voluntarily. Collection can occur as part of an external or internal Sydney Water activity.

When collecting Personal Information from individuals on behalf of Sydney Water, ensure that you:

• Only collect information directly related to the lawful activity being undertaken by Sydney Water and only for the purpose of that activity (lawful collection),
• Only collect the information directly from the individual to whom the information relates unless authorised by that individual or by law to collect it from someone else (direct collection),
• Tell the individual why the information is being collected, for what purpose, who else will be seeing and using it and how it can be accessed and updated (open collection)
• Collect information that is relevant, accurate, up to date, not excessive and obtained without unreasonable intrusion (relevant collection).

1.5.2 Storage (IPP/HPP 5)

When handling Personal Information, you should:

• Ensure it is stored securely and protect it from unauthorised access, use, modification, or disclosure, and
• Not keep or retain it longer than necessary; dispose of it properly (secure storage).

1.5.3 Allow individuals to access their information (IPP/HPP 6-8)

Some of the services that Sydney Water provides allows individuals to access and update their own Personal Information (My Account, Employee Self Service (ESS), digital confidential service file (CSF), Heritage Archive collection).

If an individual asks you to provide access to, or to update their Personal Information (that you know is held by Sydney Water or on behalf of Sydney Water by a contractor) you should:

direct the enquiry to the most appropriate team at Sydney Water which may include the Privacy Team or the GIPA Team if you are not sure.

For example, an individual customer wanting to access or update their Personal Information can be directed to the Contact Centre, an employee wanting to access or update their Personal Information can be directed to Business Connect, or an individual wanting to access or update their Personal Information in connection with the goods, services, or activities that you (as a contractor personnel) have been engaged to provide on Sydney Water’s behalf should be directed to the contractor’s representative for these types of queries,

• provide the access to the Personal Information, and
• update that information (where you have the ability and authorisation to do this). Where it is not practically possible to update, Sydney Water can make a record of the request.

Access and/or update or change to someone’s Personal Information should not be provided unless evidence can be given to you verifying who they say they are.

1.5.4 Use (IPP/HPP 9-10)

The following applies to you when using Personal Information:

• ensure it is accurate, relevant and up-to-date before you use it (accurate use),
• and only use the information for the purpose it was collected or expected to be used, or a directly related purpose, or with the consent of the individual (limited use).

1.5.5 Disclosure (IPP/HPP 11-12)

You should not disclose the Personal Information of an individual to any other individual or body unless they were advised that we will at the time of collecting it, or with their consent. Consent can be expressed (i.e. clearly communicated) or reasonably implied having regards to the terms of the collection notice under which we collected the Personal Information. For consent to be valid, it must be voluntary, informed, specific and current. Consent can be revoked.

2. Our expectations of you

It is essential that you recognise and fulfil your obligations according to this policy. If you are a People Leader, you should also ensure that your team is aware of and will implement their responsibilities under this policy.

If you are a supervisor of contractor personnel, you must ensure they have been made aware of and will implement their responsibilities under this policy.

The Privacy team can assist you to understand these responsibilities.

2.1 Using third parties

Before providing Personal Information to a third party for use or management for and on Sydney Water’s behalf, or you intend to use a third party to handle Personal Information on Sydney Water’s behalf, you must be certain that the third party has sufficient contractual safeguards in place to protect the Personal Information. As a minimum, they must comply with NSW Privacy Laws and this policy.

If you are contractor personnel engaged by Sydney Water through an agency contract or through a contract for the supply of goods and services who has been given consent by Sydney Water (under that contract), to collect, use, handle, or to otherwise manage or hold Personal Information, you must be confident that the terms of your contract allow you to approve any other third party to do any one or more of these things. Otherwise, this may be a breach of that contract.

2.2 Data breaches

If you suspect personal information has been impacted by a potential or actual data breach, report it immediately to the Privacy Manager at privacy@sydneywater.com.au for investigation. Further detail about the management of a data breach are found in the Data Breach Policy, including terms in this section of the policy.

2.3 Complaints

You should notify the Privacy Manager promptly of any complaint you receive about the way in which Sydney Water (or third party contractors performing work on behalf of Sydney Water) collects, stores, uses, handles, or to otherwise manages or holds Personal Information. Applications for an internal review that fall outside of the legislated timeframe of six months will be considered on a case-by-case basis taking a fair and just approach.

2.4 Assessing privacy risk

Sydney Water takes a privacy by design approach when introducing new projects and initiatives.

If you plan on handling or sharing Personal Information with a third party, as part of:

• a communication or promotional activity or initiative,
• a project, or a procurement exercise,
• a service or supply contract,
• introducing a new process, system, or a new program of work,
• making any changes to existing processes, systems, or programs of work,
• a data sharing engagement, including with another NSW agency for the purposes of the Data Sharing (Government Sector) Act 2015, or
• using digital hardware, an IOT device or any other digital product, or when receiving technology services, where the supplier of these items and/or services may access Personal Information,

you are required to complete a privacy risk threshold assessment and submit this to the Privacy team prior to commencing. This will help the Privacy Team determine whether a Privacy impact assessment (PIA) is required.

2.5 Proposed use of Personal Information

If you are not sure whether a dataset or information contains Personal Information, then this can be confirmed by contacting the Privacy team or the Information Management Centre at imcc@sydneywater.com.au.

2.6 Training and awareness

You are required to complete the mandatory privacy training available at Sydney Water which will teach you how to handle Personal Information in compliance with the Privacy Laws. See the Privacy page  for further details.

If you are part of a team that handles or otherwise uses a high volume of Personal Information, or you are part of a team that is routinely involved in high risk activities using Personal Information, you may be required to complete additional training as directed.

2.7 Complying with this policy

By complying with this policy, you can ensure that Sydney Water is not at risk of breaching the Privacy Laws. If you do not comply, Sydney Water may be exposed to complaints and claims made by individuals alleging a breach of Privacy Laws. These complaints and claims may:

• lead to scrutiny by our customers and stakeholders which could lead to investigation by the NSW Privacy Commissioner of the Information and Privacy Commission (IPC)
• expose you personally to penalties under the NSW Privacy Laws and could compromise your employment or any other contract with Sydney Water, and/or
• be a privacy contravention under the Public Interest Disclosures Act 2022 (NSW) by virtue of its definition of a serious wrongdoing.

3. Definitions