State government agencies regularly engage private sector organisations to provide services on their behalf. Should these services involve the collection or handling of personal information, the Information Privacy Principles Instruction (IPPI) (external site) includes provisions to ensure agencies and contracted service providers are accountable for its protection.

The IPPI requires contracted service providers to handle personal information with the same diligence expected of the government agency themselves.

Any contracts that involve the handling of personal information must include obligations on the contracted service provider to ensure the personal information is treated in line with the IPPI.

For further guidance to assist agencies with contracting see the Contracting and Information Assets Standard issued under the State Records Act 1997.

This Standard and the accompanying Contracting and Information Assets Guideline should be applied to all South Australian government contracts as appropriate.

Whilst the IPPI does not apply to local governments and universities, any contracts with service providers should ensure personal information is protected and managed appropriately.