Corporate plan 2026–27

Message from the Information Commissioner

As the accountable authority, I am pleased to present the 2026–27 Corporate Plan for the Office of the Australian Information Commissioner (OAIC).

This Corporate Plan covers reporting periods 2026–27 to 2029–30, prepared in accordance with paragraph 35(1)(b) of the Public Governance, Performance and Accountability Act 2013 (PGPA Act). This plan sets out our key activities and how we will measure our performance.

The OAIC plays a critical role in building public trust and confidence in the institutions and systems of government, economy and society that lie at the heart of our democracy. Our mandate as an integrity agency demands lawfulness, transparency, accountability and fairness. These values underpin our regulatory efforts as we adapt our regulatory approaches to meet the challenges of this dynamic regulatory environment.

‘We have identified 3 core priorities: addressing power and information asymmetries; promoting information integrity; and embedding fairness, accountability and transparency in new technology. These priorities are central to our goal of increasing public trust in Australia’s privacy and freedom of information (FOI) systems.’

Our regulatory effectiveness is secured by our expertise and leadership under the OAIC’s 3-Commissioner model. Ms Alice Linacre leads a significant FOI regulatory program having joined the OAIC in September 2025 following her appointment as Freedom of Information Commissioner. Ms Carly Kind, Privacy Commissioner, continues to promote and protect privacy rights at a time of profound impact attributable to new and emerging technology.

We are a collaborative, engaged and responsive regulator. Our community engagement is well demonstrated in our sustained commitment to consult the community. Through this engagement, we can confirm the value the community places on their information rights and the alignment of access to information and privacy values with our ambition for information integrity for the community. In 2026, our surveys confirmed that:

• 96% of Australians consider the right to access government-held information important or very important
• 98% of Australians say that organisations should be responsible for protecting the personal information that they collect, use and share.

More than 1,500 community members were surveyed throughout March 2026 and some of the key findings were:

• 93% say protecting personal information is important to them, and 87% say they are more concerned about their privacy than they were 5 years ago.
• Almost all respondents (98%) say organisations that collect, use or share personal information should be responsible for protecting privacy even if no immediate harm occurs, with 86% placing a very strong emphasis on this responsibility.
• Around two-thirds (68%) say they would be more likely to use digital services requiring personal information if they believed their data was handled fairly and responsibly.
• Nearly all (96%) say some conditions should be in place before artificial intelligence (AI) is used. Around 7 in 10 Australians (71%) consider it somewhat or very uncomfortable for organisations to use personal information originally provided for a service to train AI systems after that service has been completed .

‘The community’s focus on these fundamental rights has directed our case management strategies to deliver demonstrable increases in productivity and timeliness. We received 11,800 matters in the 2025–26 financial year, compared to 7,717 received in 2024–25. We finalised 9,123 matters in the 2025–26 financial year, compared to 7,907 finalised in 2024–25. Our timeframes for finalisation also improved significantly.’

These outcomes confirm the effectiveness of our case management strategies and will inform our future focus. In the year ahead, we will continue to work with agencies and regulated entities to strengthen complaint handling processes, promote understanding of privacy and FOI obligations and equip the public with information on how to exercise their rights. This builds public trust, promotes accountability across institutions and supports productivity gains across the public and private sectors.

‘The OAIC's function as an independent regulator and decision-maker is most effective when it operates as the avenue for review, rather than the first avenue for resolution .’

The OAIC has continued engagement with the FOI community, providing proactive support and guidance about their FOI obligations. Our targeted outreach approach, comprised of FOI webinars and ICON alerts for FOI practitioners, helps keep them informed and supported in their role as custodians of government-held information.

In support of open government principles, we will promote use of our self-assessment tool, to assist agencies to identify gaps and areas for improvement in their FOI practices and will continue to proactively review and update the FOI Guidelines.

In 2026–27, we will conduct another FOI Practitioners’ Survey, which provides insights into the needs of the practitioners delivering Australia’s FOI system and ensures our efforts support best practice.

We continue to publish figures about our FOI complaints and Information Commissioner (IC) review caseloads, and data made available publicly through data.gov.au ensures information is both transparent and accessible for agencies.

To meet the challenge of new technology we will continue to work collaboratively with other regulators. A new Memorandum of Understanding with the eSafety Commissioner, and continuing work with other agency heads through the Digital Platforms Regulatory Forum, ensure we can apply contemporary regulatory insights and intelligence.

By regularly reviewing and refreshing our priorities to be forward-focused and ambitious, we will be well placed to meet the expectations set by government and the public. Our ongoing investment in staff capability and organisational design continues to ensure that we make an enduringly positive impact and promote trust through upholding information access and privacy rights.

In the context of a rapidly changing information driven economy, the evidence shows that people want more transparency from government and are deeply concerned about their privacy rights. At the same time, rapid changes in technology and data systems are changing how public information is created and how personal information is used. We are committed to transparently sharing our regulatory expertise through guidance and engagement and applying the breadth of our regulatory tools to effectively address these challenges.

It is my honour to continue leading the OAIC’s vital contribution to the social, economic and cultural life of Australia.

Elizabeth Tydd

Australian Information Commissioner
11 August 2026

Overview

The OAIC is an independent statutory agency within the Attorney-General’s portfolio. We are the national independent regulator for privacy and freedom of information, responsible for:

• promoting and enforcing compliance with the Privacy Act 1988 (Privacy Act), including protecting individuals’ personal information
• protecting and upholding the public’s right of access to documents under the Freedom of Information Act 1982 (FOI Act), and
• carrying out strategic information management functions within the Australian Government.

In addition to the 3 principal Acts outlined above, 39 pieces of primary and subordinate legislation confer regulatory and other legal responsibilities on the OAIC or require other bodies to consult us on privacy matters (see Appendix A).

In particular, the OAIC has specific regulatory mandates supporting the following Commonwealth programs:

• My Health Records
• Consumer Data Right
• Australian Government Digital ID System
• Identity Verification Service
• Anti-Money Laundering/Counter-Terrorism Financing
• National Consumer Credit
• Social Media Minimum Age
• Taxation Administration (handling of Tax File Numbers).

Under the Commonwealth Performance Framework, our Corporate Plan is part of a planning and reporting cycle that guides our work. It covers the forward 4 years and is updated annually.

The Portfolio Budget Statements (PBS) show the OAIC’s allocated resources and proposed outcomes on an annual basis. The Corporate Plan is the OAIC’s primary planning document describing our role, the key activities we will undertake to achieve those outcomes and how we will measure our performance. The Annual Report and Performance Statements provide an overview of our activities, and a summary of our non-financial and financial performance for the year under review.

Snapshot

Detailed description of Snapshot

About the OAIC

Our purpose

To promote and uphold privacy and information access rights.

Our vision

The protection of personal information and access to government-held information is lawful, transparent, trustworthy, fair, and accountable.

Regulator performance

The OAIC is a recognised Commonwealth Integrity Agency. Our contribution to the Commonwealth Integrity Framework is achieved through our core business in promoting transparency, upholding the right to access information, and protecting and promoting privacy. Four of the integrity metrics are derived from agency performance in upholding their FOI obligations. Our oversight role directly contributes to elevating integrity in the Australian Public Service (APS).

The OAIC aims to be a responsive regulator. We use our full regulatory toolkit across education, complaint resolution, compliance and enforcement to achieve effective regulatory outcomes.

We do this by:

• using education and persuasion to encourage and promote compliance
• resolving complaints to deliver individual outcomes and to set regulatory expectations of the regulated community
• conducting proactive compliance audits through our assessment powers
• if necessary, taking enforcement action and using coercive and compulsory powers to enforce privacy obligations and information access rights.

Our priorities are also informed by our access to data and intelligence. We will continue to partner with other regulators and enforcement bodies on joint responsibilities and priorities to respond to contraventions in a collective and coherent way, drawing on the best of our shared expertise.

The OAIC anticipates that in 2026–27 we will continue to experience a demand for regulatory decision-making. To manage this challenge, while consistently progressing existing and new privacy complaints and requests for FOI reviews, we will continue to determine our regulatory priorities with regard to our Statement of Regulatory Approach.

We are more likely to take regulatory action in response to issues:

• that create a risk of substantial harm to individuals and the community, especially to vulnerable people and groups
• that concern systemic harms or contraventions
• where our action is likely to change sectoral or market practices, or have an educative or deterrent effect
• that are subject to significant public interest or concern
• where our action will help clarify aspects of policy or law, especially newer provisions of the legislation we administer.

Alongside our statutory obligations, our regulatory approach is informed by the priorities of the Australian Government, as set out in the Ministerial Statement of Expectations provided to us in 2026. The OAIC described our intentions for meeting those expectations, including how we will demonstrate progress, in the agency’s Statement of Intent, dated 16 April 2026. Both statements are available on our website.

Consistent with regulator best practice principles, the OAIC will:

• seek opportunities to engage and consult genuinely with stakeholders
• be receptive to feedback and diverse stakeholder views
• seek to increase transparency in decision-making processes
• provide up-to-date, clear and accessible guidance and information to assist regulated entities with compliance.

How we work

The OAIC is committed to supporting and building the capability of our staff, guided by 4 pillars which apply across all aspects of our work:

We are proactive and adopt a risk-based, education and enforcement-focused posture.

Our work is people-focused to preserve expertise and talent, enabling us to make the best use of our resources and maximise opportunities for our people.

Our approach is proportionate to prioritise our regulatory effort based on risk of harm to the community.

We are purpose-driven, focusing on harms and outcomes, and are driven by evidence and data.

Regulatory action continuum

Decisions to undertake regulatory action are also taken in accordance with the OAIC’s Statement of Regulatory Approach, and our privacy and FOI regulatory action policies. These policies require consideration of a range of factors including the objects of the relevant statute and the risks and impact of non-compliance.

Key activities

OAIC Strategic Plan for the period 2026–29

The OAIC has developed a Strategic Plan for the period 2026–29. This will assist us in achieving impacts under the Key Activities that we are responsible for delivering.

We have identified 3 core strategic impacts:

• address power and information asymmetries
• promote information integrity
• embed fairness, accountability and transparency in new technology.

These impacts are central to our goal of increasing public trust in Australia’s privacy and FOI systems.

In the period of this Corporate Plan, we will work to deliver the following outcomes for the Australian community under each of those strategic impacts:

• Strategic Impact 1: Address power and information asymmetries – we will work toward the following strategic outcomes:
  • 1.1 Regulated entities embed a positive information rights culture that delivers open access to information and privacy by design in all products and services
  • 1.2 Government policy is informed by the OAIC’s expertise and insights on information integrity and privacy issues including in new technologies
  • 1.3 The rights of people experiencing vulnerability are prioritised and protected.
• Strategic Impact 2: Promote information integrity – we will work toward the following strategic outcomes:
  • 2.1 Regulated entities are transparent and open about how they adopt and use AI and automated decision-making
  • 2.2 The community experiences fairness, efficiency and accessibility when exercising their privacy complaint rights and FOI rights
  • 2.3 Regulated entities embed good governance to ensure information integrity, privacy and FOI rights.
• Strategic Impact 3: Embed fairness, accountability and transparency in new technology – we will work toward the following strategic outcomes:
  • 3.1 Regulated entities use new technologies in ways that support effective, safe and fair management of personal information, and promotes accessibility of government information
  • 3.2 Expectations and standards relating to compliance with privacy and FOI obligations in the context of new technologies are clear
  • 3.3 Robust and proportionate compliance and enforcement action uplifts compliance and serves community interests.

Throughout 2026–27, we are committed to creating processes, tools and a culture to support effective delivery. Our Strategic Plan incorporates a focus on organisational enablers.

• Enablers: Demonstrate organisational agility and impact:
  • E.1 We are a high performing organisation and our people and processes are agile, adaptable and confident
  • E.2 We harness data and deploy technology to deliver insights and provide services effectively
  • E.3 We will be effective and efficient stewards of our resources with a clear focus on productively delivering public value
  • E.4 We are transparent and effective in our engagement with stakeholders and the community.

Key activity 1

Influence and uphold privacy and information access rights frameworks

The OAIC has a wide range of regulatory functions and powers which are prescribed by Commonwealth legislation, primarily the AIC Act, FOI Act and the Privacy Act. We also have specific legislated functions in relation to the Consumer Data Right (CDR), My Health Record, Anti-Money Laundering/Counter-Terrorism Financing, Digital ID and other legislation as set out in Appendix A.

We will continue to discharge these statutory obligations throughout the reporting period.

We will continue to influence and uphold privacy and information access rights frameworks in 2026–27 and discharge our regulatory functions and powers by:

• Implementing our uplift program across the agency, further strengthening our casework effectiveness and regulatory activities. To date, we have reduced the average time to finalise an IC review from 13.5 months in 2024–25 to 7 months in 2025–26 (a reduction of more than 6 months) and reduced the average time to close a privacy complaint from 7.6 months to 6 months in the same period.
• Supporting the Australian Government’s productivity objective through better balancing of risk mitigation with efficiency, growth and dynamism. We will act to ensure that complaints about interferences with privacy are addressed at the earliest and most efficient level possible.
• Identifying opportunities to onboard new external dispute resolution schemes to facilitate accessible and low-cost avenues for individual complaints.
• Continuing to modernise our educational and guidance materials, and maximising opportunities across our privacy and FOI regulatory domains to highlight better practice.
• Publishing data to allow regulated organisations to assess their performance relative to other participants in the system.
• Striving to maximise the deterrent effects of regulatory action and ensure that regulatory outcomes are communicated to impact and elevate widespread compliance, and continue to progress civil penalty proceedings under the Privacy Act against a number of entities.
• Delivering targeted communication, educational and engagement activities, to reinforce our influence in the community and to our regulated entities. We will lead the Australia-wide campaigns for Privacy Awareness Week and International Day for Universal Access to Information (IDUAI).
• Collaborating with international counterparts through our participation in a range of international meetings, seminars and conferences.

Key activity 2

Advance online privacy protections for Australians

The OAIC will advance online privacy protections for Australians to support the Australian economy by influencing the development of legislation, taking a contemporary and harms-based approach to regulation, and raising awareness of online privacy risks and protections.

Privacy is a growing concern for Australians, while rapid changes in technology and data systems are changing how personal information is collected and used. Australians’ expectations about privacy continue to sharpen as the information ecosystem becomes more complex, data-intensive and difficult to navigate. We are building our capacity to respond swiftly and effectively to new and emerging challenges in the digital ecosystem, with a focus on safe usage which preserves rights while unlocking productivity and social benefits.

We will advance online privacy protections for Australians throughout 2026-27 by:

• Pursuing regulatory activities that address privacy harms arising from the practices of online platforms and services that impact individuals’ choice and control, including opaque information-sharing practices or terms and conditions of service.
• Continuing our work on the Children’s Online Privacy Code, which will put children at the centre of privacy protections in Australia.
• Continuing our role in supervising the privacy requirements embedded within the social media minimum age obligation in the Online Safety Act 2021.
• Continuing to build our capability to respond effectively to emerging challenges in the digital sphere such as AI, with a holistic approach to guidance. We will support the safe and responsible adoption of AI across the economy, particularly to improve the efficiency and outcomes of public service delivery as envisioned by the AI Plan for the APS.
• Updating our guidance on facial recognition technology.
• Administering the Notifiable Data Breach scheme.

Key activity 3

Encourage and support proactive release of government information

The OAIC will promote a proactive approach to the publication of government-held information. We will focus on supporting efficient access to information and facilitating innovation and engagement.

Government-held information is a national resource to be managed for public purposes. The OAIC will continue to promote open government to better serve the Australian community. As a regulator, we have set the expectation for steady and sustainable improvement. We have also committed to continue sharing what is working well in FOI administration, lessons learnt and spotlighting better practice examples. Even sharing small insights and learnings can help others move faster and with more confidence, together contributing to broader system-wide uplift.

We will encourage and support access to government information by Australians throughout 2026–27 by:

• Encouraging proactive release of government-held information through our administration of the Information Publication Scheme (IPS) and through promotion of other mechanisms for proactive and timely release, such as administrative access and the use of disclosure logs.
• Working with agencies to uplift their capability in the exercise of their FOI functions by setting the expectation for steady and sustainable improvement in administering agencies obligations under the FOI Act.
• Publishing figures about our FOI complaints and IC review caseloads. We have also published key FOI data as collected by agencies and Ministers which was reported to us.
• Continuing to focus on and highlight good administration leading to lawful compliance including timeliness as a key area of our regulatory activities, including the publishing of performance data and launch of a new “FOI Leaderboard” to encourage and promote best practices.
• Reinforcing timely access to government information is central to ensuring the FOI system meets its statutory objectives, including increasing transparency and trust in government, and aligns directly with the OAIC’s regulatory focus of ensuring timely access to government information.
• Continuing to proactively review and update the FOI Guidelines.
• Monitoring and reporting on agency compliance with the FOI Act by undertaking proactive compliance activities including surveying agency policy and practice and publishing our findings to support best practice in information rights.
• Continuing to engage in more intensive compliance, investigative and enforcement action where agencies’ non-compliance with their FOI obligations is significant, to ensure information rights are respected.

Key activity 4

Take a contemporary, harms-based approach to regulation

The OAIC will take a contemporary, harms-based approach to promoting and upholding Australia’s privacy and FOI laws. We are committed to developing a skilled, multidisciplinary workforce that is supported by the tools needed to deliver our regulatory role in a dynamic, responsive and targeted manner.

OAIC’s regulatory approach will continue to combine intelligence-driven education, compliance and enforcement activities, recognising the relationship between different levels of intervention in a responsive regulatory continuum.

We will take a contemporary, harms-based approach to regulation throughout 2026–27 by:

• Embedding a regulatory approach that uses both encouragement and deterrence to promote and protect privacy and information access rights. This framework reinforces a central characteristic of the OAIC’s regulatory philosophy: a focus on outcomes, impact and purpose.
• Responding in ways that are proportionate, consistent with the expectations of the community and the Australian Government, and managing risks to adequately protect the public.
• Taking timely and necessary action, while seeking to minimise regulatory burden and cost.

Operating Context

Our work over the coming year will be influenced by the OAIC’s operating context. This includes the environment in which we operate, the capabilities we have to deliver our statutory functions and our approach to risk management and oversight.

Technology has made the privacy and information rights landscape increasingly complex. Internationally, information rights regulators are reporting significant increases in community contacts through dramatic increases in case numbers. The OAIC is also experiencing this increase in demand, and we have introduced strategies to respond.

Our environment

A clear understanding of our operating environment is crucial to the OAIC’s risk-based regulatory approach, and to our education, compliance and enforcement-focused posture. We actively scrutinise our environment, assessing and prioritising our regulatory effort where the potential risk of harm to the community is most significant. Our risk-based approach also means we focus on areas where we can make the best use of our resources and be most effective.

Different factors influence how and why we operate as we do. For example, many of the organisations we regulate do business in different Australian states and territories and are subject to different regulatory regimes in each jurisdiction. Some of our regulated entities also participate in the global economy. This makes it important for the OAIC to be connected to other regulators domestically and internationally to ensure our advice is consistent and strategic. It also means we can springboard off other guidance or regulatory approaches, where available, to promote greater efficiency.

Optimising our resources is always an important consideration. As an agency of government, we are accountable to the Australian public and subject to strict rules on how we acquit the funding that has been provided to us. We must use those taxpayer resources ethically, effectively and efficiently. We have systems to control for risk and to promote integrity, which are described later in this section.

Related to protecting public resources, we are mindful that the system of information access, which promotes integrity and accountability by government, and by government agencies and institutions, needs to be protected. The effective operation of the right to access information is a fundamental feature of open government and democracy and we are committed to safeguarding that right.

Finally, our agency operations are being conducted at a time of rapid technological change and advancement. In response, we are advocating for privacy-by-design that proactively builds privacy protections into the design and development of new systems. As the context we operate in continues to evolve, our response to those changes must, despite the inherit technical complexity and nuance, continue to be clear, accurate and useful for the entities relying on us to lead a path through the new landscape. In this regard we strive to inject certainty and ensure trust in our regulation for both entities and the community.

Elevated trust positively impacts community engagement with government and the digital economy. The OAIC plays a central role in regulating to promote trust and importantly fairness in the face of increasing information asymmetries and global industries operating in the context of Australian laws and values.

Legislative changes

Our operating environment is influenced by changes to the legislation we administer. Building upon reforms to the Privacy Act in December 2024, the Australian Government has announced its intention to bring forward a second tranche of privacy reform.

The OAIC continues to implement the 2024 Privacy Act reforms and related legislative changes, including:

• developing the Children’s Online Privacy Code to address online privacy for children, in relation to which we have begun consulting the community
• developing guidance on the Transparency in Automated Decision-Making reforms to the Privacy Act commencing in December 2026
• updating guidance and compliance programs to account for the expansion of the Australian Government Digital ID System to private sector entities from 30 November 2026
• updating guidance to reflect ongoing changes to My Health Record system
• sharing regulatory expertise and insights with co-regulators into the Government’s announced policy changes relating to Social Media Minimum Age, Interactive Gambling and a Digital Duty of Care.

Capability

The OAIC’s information and communications technology (ICT) capability continues to support our role as a contemporary regulator by enabling efficient, transparent and data-driven operations.

We increased our internal support for ICT services during 2025–26 and we will continue to make cost effective and secure investments in ICT to ensure our core tools continue to meet our needs into the future. Over the next year, our activity will focus on ways to use technology to enhance people’s interactions with the OAIC and effective resolution of their matters. We will explore the responsible adoption of artificial intelligence (AI) to improve our ability to deliver on our purpose.

Our people are the cornerstone of our success. They enable us to meet our regulatory responsibilities and to promote and uphold privacy and information access rights. The OAIC remains focused on ensuring we have the right people and capabilities required for now and into the future. To support this, we continue to develop and strengthen the capability of our people through our Learning and Development Strategy. The strategy responds to organisational needs and focuses on these core areas: regulatory capability, core capability and APS Craft.

In line with the Australian Public Service (APS) Strategic Commissioning Framework, the OAIC remains committed to retaining a low reliance on contractors and consultants for core work, drawing on external skills and expertise only where necessary. In 2026-27, the OAIC will continue to uphold the APS Strategic Commissioning Framework and strengthen capability of its workforce. To strengthen capability to deliver core work, we will focus on developing skills through our Learning and Development Strategy and targeted recruitment practices.

Risk oversight and management systems

Governance framework

Our governance arrangements facilitate informed and timely risk-based decision-making and ensure the OAIC is well positioned to harness the collective expertise of our 3 Commissioners, the Executive and our people to address opportunities and challenges of the future.

Key governance and accountability bodies within the OAIC include:

• Governance Board, comprised of 3 Commissioners and 2 Executive General Managers – the board determines the agency’s strategic objectives and priorities. Meeting as the AI Governance Board, the Governance Board also fulfils an important role in shaping the strategic approach to the adoption and management of AI by the OAIC. The Governance Board is supported by an Information and Communications Technology (ICT) Subcommittee.
• Regulatory Board, comprised of the Commissioners as members and Executive General Managers and the OAIC’s General Managers and Principal Directors who manage the regulatory environment as advisors – the board provides collective leadership and support for regulatory activities in FOI, privacy and information access.
• Audit and Risk Committee (ARC), comprised of 3 external members – the ARC provides independent advice to the Information Commissioner on the appropriateness of the OAIC’s financial reporting, performance measurement, systems of risk oversight and management and systems of internal control.
• a range of function-based committees – these provide agency staff with an opportunity to participate in consideration of matters such as workplace health and safety, diversity and enterprise agreement matters.

OAIC Governance Structure

• Accountable Authority
• Governance Board Regulatory Board
• AI Governance
• Board
• ICT Subcommittee
• AI Subcommittee
• Function-Based Committees*
• Executive Management Forum
• Security Governance Committee
• OAIC Consulation Forum
• OAIC Diversity Committee
• Health, Safety and Wellbeing Committee
• *Function based commities report to the Accountable Authority and can report to Governance Board and Regulatory Board to any written directions

Risk management

Our Risk Management Framework and Policy details our robust and holistic approach to risk oversight and management. It is aligned with the requirements of the PGPA Act and the Commonwealth Risk Management Policy.

The Chief Risk Officer and Director of Governance, Risk and Compliance work collaboratively to oversee and champion risk management, risk capability and risk culture across the OAIC. Regular reporting to Executives and various governance bodies, receiving independent advice from our ARC, and having a robust internal audit program enables the OAIC to monitor and respond to current and emerging risks, threats and opportunities efficiently and effectively.

Our risk appetite statement outlines the level of risk we are comfortable accepting, and internal documents provide further guidance on how to apply this specifically to our regulatory and corporate activities.

Our risk tolerances reflect a more informed and specific calibration as adjusted to our risk environment.

We seek to achieve the optimal balance between identifying and engaging with risks in the context of delivering our regulatory activities, while upholding our accountability obligations and reputation as a trusted government agency and advisor. Our risk appetite statement is one of several supporting documents that assist us to develop a better understanding of risk and enable informed risk-based decision-making to embrace opportunities, deal with threats, foster innovation and build a strong risk culture across the OAIC.

During 2026–27, we will focus on uplifting and enhancing our risk culture and capability through education and awareness to embed risk-based decisions across our frameworks in alignment with our risk appetite statement and regulatory posture.

Our enterprise risks

Our enterprise risk profile provides a high-level and overarching view of the risks that have the most profound impact on our ability to deliver our strategic and operational priorities. Regular review of the enterprise risk register and engagement with risk stewards, and control and treatment owners enables us to understand and respond in a timely manner to the current and emerging risks that may threaten our operations. We also remain alert to identify new opportunities and innovation.

Our focus in 2026–27 is to remain agile in a complex and evolving regulatory environment where unforeseen opportunities and threats may influence both strategic priorities and daily operations. Recognising that risk is inherent to our role and activities, our Risk Management Framework and Policy understands the aim is not to eliminate risk, but to support informed decision-making by understanding the environment in which we work in to review the effectiveness of our controls and develop appropriate treatments that align accordingly.

Cooperation

Collaboration and consultation lie at the heart of our role as a thoughtful regulator. The agency will continue our collaborative approach across subject matter experts in FOI and privacy, as well cooperating across government to ensure a well-functioning operational environment. Our 3 Commissioners actively engage with and contribute to better regulation through a range of fora and appointments, including through membership of the:

• APS Integrity Agencies Group
• National Data Advisory Council
• Services Australia myGov Strategic Committee
• Regulator Leadership Cohort
• Privacy Authorities Australia (PAA)
• APS Small Agency Forum
• Administrative Review Council (ARC)
• Digital Platform Regulators Forum (DP-Reg)
• International Conference of Information Commissioners (ICIC)
• AI Review Committee.

Our role as a key contributor to a strong administrative system is also evidenced by the active contribution made by the OAIC to the Administrative Review Council. The Information Commissioner is an ex-officio member of the ARC which was re-established in 2024 under the ART Act. The ARC’s functions are to:

• monitor the Commonwealth administrative law system
• inquire into systemic issues in administrative law
• develop and publish guidance
• support education and training for Commonwealth officials.

We work with other domestic information access regulators through the Association of Information Access Commissioners, which promotes best practice in information access policies and laws across Australia and New Zealand. Similarly, we work with counterpart privacy regulators through the Privacy Authorities Australia, to promote best practice and consistency of privacy policies and laws.

The OAIC enhanced our cooperation with digital platform regulators through the Digital Platform Regulators Forum, by signing a Memorandum of Understanding between the 4 agencies (alongside the Australian Competition and Consumer Commission, the Australian Communications and Media Authority and the eSafety Commissioner) to strengthen information-sharing and enable joint regulatory actions.

International cooperation and thought leadership

Our international cooperation will remain an essential component of our work, enabling us to leverage understanding of the global privacy and information access landscape and ensure domestic frameworks are fit for purpose and aligned with best practice.

We engage in several key international networks to keep informed of challenges and opportunities in privacy and access to information. This work includes our involvement in the Global Privacy Assembly and the ICIC.

Our cooperation and collaboration

Regulated community

• Industry
• Australian Government agencies

Australian community

• Community groups
• Consumer advocacy organisations
• Australian Financial Complaints Authority
• External dispute resolution schemes

Domestic and international regulators

• State and territory regulators
• Co-regulators
• International regulators

Academia and research organisations

• Universities

Australian Government

• Attorney-General’s Department
• Australian Communications and Media Authority
• Australian Competition and Consumer Commission
• Australian Digital Health Agency
• Australian Human Rights Commission
• Australian Prudential Regulation Authority
• Australian Securities and Investments Commission
• Commonwealth Ombudsman
• Department of Employment and Workplace Relations
• Department of Finance
• eSafety Commissioner
• National Commission for Aboriginal and Torres Strait Islander Children and Young People
• Office of the National Data Commissioner
• Treasury

Performance

Our performance measurement framework describes how we measure our progress towards achieving our mission and purpose through:

• key activities that describe our key functions and areas of work
• intended results that describe the impact, difference or results we want to achieve in relation to our key activities
• performance measures we use to evaluate our progress towards the intended results
• targets that describe the results we are aiming for in each performance measure
• methodologies and data sources that describe how our performance information is collected, analysed and reported.

The OAIC has carefully considered its key activities and has identified measures and targets that are appropriate to measure and assess the agency’s performance. Each measure is based on data and records that will be relied on in the OAIC’s performance statements to report on the measures.

Our performance management framework is reflected in our 2026–27 portfolio budget statement (PBS).

Since our 2025–26 PBS, we have made changes to our performance measures. The details and rationale for each change are outlined in Appendix B. The measurement and assessment of the performance measures outlined in our 2026–27 Corporate Plan will be published in our 2026–27 annual performance statements.

Key activities–Performance measures

Key activity 1

Influence and uphold privacy and information access rights frameworks

*This does not include privacy complaints, FOI complaints and Information Commissioner reviews that are subject to other regulatory action the OAIC is taking in respect of the same facts or incident. Records of these cases are maintained in the OAIC’s information management system.

Key activity 2

Advance online privacy protections for Australians

Key activity 3

Encourage and support proactive release of government information

Key activity 4

Take a contemporary, harms-based approach to regulation

Appendix A

Legislation conferring functions on Information Commissioner or the OAIC

The following is a non-exhaustive list of Acts or instruments conferring regulatory and other functions, powers, responsibilities or obligations on the Information Commissioner or the OAIC in relation to privacy and information access matters.

• Administrative Review Tribunal Act 2024
• Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
• Anti-Money Laundering and Counter-Terrorism Financing Rules (Cth)
• Child Care Act 1972 (Cth)
• Competition and Consumer Act 2010 (Cth)
• Competition and Consumer (Consumer Data Right) Rules 2020 (Cth)
• Consumer Data Right (Authorised Deposit-Taking Institutions) Designation 2019 (Cth)
• Consumer Data Right (Energy Sector) Designation 2020 (Cth)
• Counter-Terrorism Legislation Amendment (Foreign Fighters) Act 2014 (Cth)
• Crimes Act 1914 (Cth), pt VIIC (spent convictions)
• Data Availability and Transparency Act 2022 (Cth)
• Data-matching Program (Assistance and Tax) Act 1990 (Cth)
• Digital ID Act 2024
• Environment Protection and Biodiversity Conservation Act 1999
• Financial Sector Reform Act 2022 (Cth)
• Foreign Influence Transparency Scheme Act 2018 (Cth)
• Healthcare Identifiers Act 2010 (Cth)
• Healthcare Identifiers Regulations 2010 (Cth)
• Identity Verification Services Act 2023 (Cth)
• Imported Food Control Act 1992 (Cth)
• Information Privacy Act 2014 (ACT)
• My Health Records Act 2012 (Cth)
• My Health Records Regulations 2012 (Cth)
• My Health Records Rules 2016 (Cth)
• My Health Records (Information Commissioner Enforcement Powers) Guidelines 2016 (Cth)
• National Cancer Screening Register Act 2016 (Cth)
• National Consumer Credit Protection Act 2009 (Cth)
• National Health Act 1953 (Cth)
• National Health (Privacy) Rules 2021 (Cth)
• Online Safety Act 2021
• Personal Property Securities Act 2009 (Cth)
• Privacy (Tax File Number) Rules 2015 (Cth)
• Product Emissions Standards Act 2017 (Cth)
• Road Vehicle Standards Act 2018 (Cth)
• Social Security (Administration) Act 1999 (Cth)
• Student Identifiers Act 2014 (Cth)
• Taxation Administration Act 1953 (Cth) (handling of tax file numbers)
• Telecommunications Act 1997 (Cth)
• Telecommunications (Interception and Access) Act 1979 (Cth)

Appendix B

Changes to performance information
The OAIC’s Corporate Plan has been prepared in accordance with the requirements of section 35 of the PGPA Act, sections 16E and 16EA of the Public Governance, Performance and Accountability Rule 2014, and the Resource Management Guide 132 (Corporate plans for Commonwealth entities).

Appendix C

List of requirements

The OAIC’s Corporate Plan has been prepared in accordance with the requirements of section 35 of the PGPA Act, sections 16E and 16EA of the Public Governance, Performance and Accountability Rule 2014, and the Resource Management Guide 132 (Corporate plans for Commonwealth entities).