Using a Privacy Collection Notice for your form

A privacy collection notice is promoted to a person whose data is being requested and collected. It communicates what data is being requested, why it is, when it would be stored for and where, and to whom it will be disclosed at the time of collection. (Noting that a Privacy Collection Notice is different from a Privacy Collection Statement, Policy or Plan)

Privacy Collection Notice Templates

The OneCX Program has identified the below privacy collection notice template types that Content Authors and Editors can use as a guide for their data collection forms and features on nsw.gov.au

Anonymous Collection Disclaimer

This form does not collect any PI (personal information), notice includes reminder not to place PI in free text/attachments
(Download Anonymous Collection Disclaimer from the list below)

Newsletters

This form collects name and email addresses only, for purposes of newsletter, self-nominated, subscribed communications.
(Download Newsletters from the list below)

Events

This form collects name, email and potentially age/age-range, phone number, and postcode, for events registration. This could also include communications for repeat events.
(Download Events from the list below)

Standard PI Collection

This form collects name, email, phone number and personal information that has been documented via a PIA (Privacy Impact Assessment) and approved.
(Download Standard PI Collection from the list below)

Health and Sensitive Information

This form collects personal information that includes/could include sensitive or health information.
(Download Health and Sensitive Information from the list below)

Business

This form collects names and contacts from a person in their professional capacity, but no information about them in a personal capacity
(Download Business from the list below)

Third-Party Collection

This form collects personal information of third parties (i.e., not the person completing the form) from an organisation.
(Download Third-Party Collection from the list below)

Third-Party Sensitive/Health Information

This form collects information that is considered sensitive or health information and is not the individual to which the information is being provided.
(Download Third-Party Sensitive Health Information from the list below)

Subscription Mailing List

This form collects name and email addresses only, for purposes of newsletter, managed and handled by a third party e.g Campaign Monitor or Mail Chimp etc.
(Download Subscription Mailing List from the list below)

  All webforms must now use a Privacy Collection Notice

To ensure all webforms on nsw.gov.au are in compliance with the Information Protection Principles (IPP) for agencies of NSW, it is now a requirement for all webforms to have a Privacy Collection Notice. Webforms without a Privacy Collection Notice now cannot be created.

Follow the steps below to do this.

How to add in a Privacy Collection Notice to your webform on nsw.gov.au

1. Login to the CMS, and navigate to your webform
2. Click on the Build tab
   
3. Click on the + Add element button
   
4. On the 'Filter by element name' search box, type in Privacy to search for the Privacy notice element. Click on the Add element button to the right of 'Privacy notice'.
   
5. The Privacy Notice element editing window will open. On the Privacy collection notice dropdown list, select the Privacy Collection Notice that is applicable to your webform.
   
6. Ensure that the rest of the fields have these values entered in. These values are required for your webform to be compliant with IPP policies and privacy laws.
   1. Title: Privacy Collection Notice
   2. User declaration* is dependent on the Privacy collection notice chosen for the form
   3. Privacy collection notice error label*: Please read and agree to the Privacy Collection Notice.
   4. Privacy collection notice error message*: Please read and agree to the Privacy Statement/Plan.

   The fields above with a (*) are not editable. If you notice anything that needs to be updated, send through the details of the updates on our form

7. Once done, scroll down to the bottom of the editing window, and click on Save
   
   
8. The Privacy Collection Notice element will show up on the bottom of the webform build page. Click on Save elements.
   
9. Click on the Settings tab
   
10. Scroll down to Data Custodian (owner) and type in the Agency for which the form belongs to. Click on the agency from the list as the results show up.
    

11. Scroll down to the Third party settings accordion and expand it. Fill in Add link to Privacy Impact Assessment (PIA)*, Purpose of data retention and Agency retention period with the appropriate values.

    *A PIA link is a URL to your PIA document that is sent to your agency after your PIA request has been completed by the Digital Channels privacy team
    
12. Once done, click on Save on the bottom of the page.
13. On the top of the page, click on the View tab and scroll down to the Privacy Collection Notice section. Click on the ‘privacy collection notice’ link and review the document.
    (Note: if there is anything on the document that needs to be updated, send through the details on our form)
    
    
    
    
14. The form is now ready for use.
    Clicking on Submit without agreeing to the Privacy Collection Notice checkboxes will not allow the form to be submitted.
    

Need more support on Privacy for nsw.gov.au?

Submit your request now on our Request support for Privacy enquiries form.

Download the templates below: