Mini vic.gov.au

This is a low bandwidth version of vic.gov.au. Contents may not be up to date. © Copyright State Government of Victoria

Resources, guidance and tools for sharing information

Library of resources to support regulators share information safely, effectively and efficiently.

Details

Topic: Regulatory reform

Audiences: State government - regulatory policy, State government - regulatory operations

Regulatory functions: Legislation, Practice and processes, Digitisation, Compliance and Enforcement, Skills and Capability, Culture

Industry: All relevant industries, Hospitality

Document types: Guide; Framework, Template, Report, Fact sheet, Form, Rubric, Playbook, Research and analysis, Checklist

Author (Department): Department of Treasury and Finance

Date published: 26 November 2025

Effective information sharing between regulators strengthens Victoria’s regulatory system. It helps regulators access the data needed for faster, better decisions, respond sooner to emerging risks, enable digital innovation, and reduce business burden.

How this tool can help

Regulators can use these resources to:

Support to apply this tool

Contact the Department of Treasury and Finance at reg.reform@dtf.vic.gov.au to ask questions or book a discussion about these resources.

Resources, guidance and tools for regulatory data sharing

Effective information sharing between regulators can enable:

The Department of Treasury and Finance and the Department of Government Services have developed this library of resources to support regulators understand the fundamentals of information sharing and support them to overcome common barriers.

Road to data sharing

There are several steps that regulators can follow to help improve data sharing.

The roadmap below outlines these steps and provides some examples of activities or outcomes for each step. Although this is presented as a linear roadmap, some of the steps may occur in parallel or be repeated over time to continue to improve data sharing.

Road to data sharing

Open all

The series of questions below have been compiled to support regulators’ plan and prepare to share information.

Working through these questions will help you understand and prepare for all the aspects of data sharing, from culture to access to distribution.

Planning to share information table Word 33.7 KB (opens in a new window)

Question Considerations/steps (high-level)
Is the data you want to access or share publicly available? A data sharing agreement is unlikely to be required. Share: make available through DataVic if possible. Access: through API (if suitable) or download (may be through DataVic).
Are there any legislative barriers preventing/restricting sharing – e.g., secrecy or confidentiality provisions in the authorising legislation for the regulatory activity/function? Check authorising legislation for the regulatory activity/function. Look for information sharing, secrecy and confidentiality provisions. Look for language enabling or restricting sharing e.g., to perform functions or exercise powers, in particular contexts, by specific roles. If no specific legislative barriers, consider general legislation, including IPPs/HPPs.
Are there any barriers to sharing that are included in the collection notice e.g., sharing prohibited with a specific group or for a particular reason? Does a collection notice exist? Does it specifically allow sharing with the desired organisation / organisation type? If the existing collection notice prohibits sharing with the desired organisation / organisation type, a new collection notice will only allow sharing of data collected after the updated collection notice is used – it does not apply retrospectively.
Where the data contains personal information, does the sharing: align with the primary purpose of collection (refer to the collection notice) align with an allowable secondary purpose (IPP2/HPP2) OR has consent been given by the individual? The permitted purpose should be outlined in the data sharing agreement. Complete/update the PIA if new personal data is collected, used or disclosed. If the sharing does not align with an allowable purpose (or through consent) it may not be possible to share.
Is there a culture of data sharing e.g., executive support and officer training? Create a framework outlining roles, responsibilities and processes – covering different circumstances including emergency situations (governance and accountability). Outline how information will be collected and managed (privacy and security) – privacy and security policies, collection notices. Develop/make available training and awareness programs, including risk management processes.
Are there established mechanisms for data sharing e.g., data sharing agreement, APIs? Existing data sharing mechanisms should be outlined in the framework. Where a suitable mechanism does not exist, identify the type of data to be shared and the technical capability and requirements.
Are there resources to help interpret the data that is shared / you are accessing e.g., a data dictionary to identify common or different definitions? Acknowledge that there will be differences that cannot be standardised across regulators – often due to differences in legislative definitions and risk profile. Provide information for interpretation and ‘mapping’ across regulators where possible. Does a data dictionary exist with definitions of key terms e.g., what is defined as an ‘associate’ or ‘involvement’ for specific regulatory frameworks? Where a data dictionary does not exist, consider other options to provide key metadata or relationships to users e.g., mapping exercise to better understand definitions and differences between data sharing parties.
What is the purpose of sharing the data: policy making, service planning or delivery regulatory activities e.g., enforcement, compliance? VPS data sharing policy and Heads of Agreement: Enables sharing for policy making, service planning or delivery. Does not enable sharing for enforcement/compliance – consider if this can/should be shared and alternative options e.g., bespoke agreement.

Foundational guidance

The following guidance and information have been prepared to help regulators build their understanding of core frameworks, standards and concepts of sharing information.

VPS Data Sharing Framework

A policy and agreement to promote and enable the sharing of data.

The Victorian Public Sector Data Sharing Framework includes:

sets a clear expectation on all Victorian government agencies to share data with each other to inform policy making, service planning and delivery, where there is a clear public benefit.

Aligns with the National Data Sharing Principles to help the Victorian government agencies fulfil that responsibility in a considered, safe and secure way, (based around the Five Safes Framework – safe projects, people, settings, data and outputs).

Operationalises the VPS Data Sharing Policy and provides a common framework for Victorian government agencies with general data sharing terms and conditions.

Provides an overarching framework to streamline and accelerate data sharing, while ensuring the right safeguards and controls are in place.

Is signed by all departments, Victoria Police and some agencies and welcomes more signatories:

Once a signatory, individual data sharing agreements (through the template Schedule) can be signed by delegation (do not require the agency head to sign)

Additional resources

Bespoke data sharing agreements

The DSHA provides an overarching framework for data sharing across the Victorian public sector. However, it may not be suitable in all circumstances. Regulators can use it as a foundation for developing bespoke agreements tailored to specific legal and/or operational requirements. Use the below questions to support variations in the DHSA to suit your specific circumstances.

Bespoke data sharing agreements Word 33.94 KB (opens in a new window)

Relevant section Considerations/potential amendments
General considerations (may impact multiple sections) Changes may depend on the type of agreement e.g., Heads of Agreement (used multiples times with Schedules completed for each data sharing arrangement) or single agreement. If a Heads of Agreement, a decision will be required on whether there is a ‘lead’ agency i.e., DGS for the DSHA – this will impact several sections/clauses e.g., where the Secretary DGS is referenced. Reference to the VPS Data Sharing Policy may not be relevant if the purpose of the agreement is to share data that is not enabled under the VPS Data Sharing Policy e.g., for some regulatory activities such as enforcement, compliance. Where clauses or definitions are removed, it is important to update any references to them throughout the agreement.
2 – Term and variation Consider if the agreement is in perpetuity (until terminated by mutual consent) or whether it will be for a specific period. The term for the DSHA is linked to the VPS Data Sharing Policy which may not be relevant to a bespoke agreement. Consider if there is a ‘lead’ agency who manages administration of the agreement or whether all parties are to be involved in decision-making and administration.
3 – Purpose of this Agreement4 – Responsibility to share and principles Consider if reference to the VPS Data Sharing Policy (and National Data Sharing Principles) is required if the purpose is for sharing data that is not enabled by the policy.
5 – Status of this Agreement Consider if there is a desire for the agreement to be legally binding – if so, it is recommended that you engage appropriate legal counsel for advice.
6 – Addition of new Parties to this Agreement Dependent on the type of agreement e.g.: Whether there will be a ‘lead’ agency with decision-making authority under a Heads of Agreement. Whether the agreement is a single agreement requiring the agreement of all parties to any new parties.
7 – Conflict between this Agreement and a Data Sharing Schedule Dependent on the type of agreement and whether there are multiple schedules outlining specific data sharing agreements.
8 – Purposes for Shared Data Consider if reference to the VPS Data Sharing Policy is required if the purpose is for sharing data that is not enabled by the policy
9 – Term and provision of Shared Data10 – Use and confidentiality of Shared Data11 – Rights in relation to Shared Data and Intellectual Property12 – Handling and security of Shared Data Unlikely to require changes. Some sections are based on requirements for VPS agencies.
13 – Retention and destruction of Shared Data Dependent on the type of agreement: Consider whether the details that will be outlined in the schedule are / will be sufficient. May require advice e.g., if an agreement with the details to be written into the clauses rather than the schedule.
14 – Party Representatives Unlikely to require changes.
General Dependent on the type of agreement e.g.: Counterpart clause likely to remain under a Heads of Agreement.
15 – Entire Agreement Dependent on the type of agreement e.g.: The DSHA reference may be updated to the name of another Heads of Agreement if this is relevant.

Privacy management

Managing and sharing personal and health information imposes additional privacy obligations on regulators.

Personal information is defined as “information about an individual who is identified or whose identity is reasonably ascertainable,’ whereas health information is defined as “information about an individual’s physical or mental health, or disability, including information collected while providing a health, disability or aged care service to an individual”.

Personal and health information should only be collected where it is necessary for a function and/or activity. Any personal and/or health information that is collected must be managed in accordance with the Information Privacy Principles (IPP) and Health Privacy Principles (HPP)*.

Personal information

The IPP are guidelines issued by the Office of the Victorian Information Commissioner (OVIC) under the Privacy and Data Protection Act 2014. The IPPs outline the minimum standard for the collection, storage, handling, use, disclosure and destruction of personal information by VPS organisations.

Chapter 2 of the IIPs covers the use and disclosure of personal information. This states that ‘Personal information can only be used and disclosed for the primary purpose for which it was collected, or for a secondary purpose that would be reasonably expected. It can also be used and disclosed in other limited circumstances, such as with the individual’s consent, for a law enforcement purpose, or to protect the safety of an individual or the public.’

Under the IPPs, the collection of ‘sensitive information’ is prohibited, subject to a number of exceptions. ‘Sensitive information’ is a sub-category of personal information, the collection and handling of which includes inherent risks to a person’s rights. One of the most obvious risks associated with the collection and handling of sensitive information is discrimination, for example, discrimination on the basis of racial or ethnic origin, sexual practices, or political opinions. Unnecessary or unlawful collection or use of these types of sensitive information may give rise to parallel rights under both privacy and anti-discrimination laws.

Health information

Sharing health information is guided by the Health Privacy Principles (HPP) under the Health Records Act 2001. The HPPS are broadly similar to the IPPs, with important differences to ensure the protection of health information. OVIC has developed guidance on these similarities.

OVIC guidance on Health Information Word 505.96 KB (opens in a new window)

Where can this help?

Additional resources

Schedule 1 (p.104 onwards) contains the Health Privacy Principles (HPPs)

Data retention and disposal

Once data has been collected, it needs to be managed appropriately. The IPPs and HPPs outline a regulator’s obligation when managing private and health-related information, including data security and disposal.

The Public Records Office of Victoria (PROV) provides guidance on how information should be managed once collected – including disposal/destruction of this data through their Retention and Disposal Authorities (RDAs).

RDAs are the standards for:

The PROV document library contains a list of all current RDAs. Where can this help?

Managing personal health information safely Additional resources

The tools and resources below will assist regulators in overcoming common barriers to information sharing, including measuring impact (privacy and business), obtaining informed consent when collecting data, discovering VPS datasets, and building data maturity.

Victorian Common Data Taxonomy

The Victorian Common Data Taxonomy is a structured way for regulators to organise information into categories and subcategories based on shared characteristics. It serves as a foundational tool to help regulators manage and structure their data in ways that promote improved information sharing and foster greater collaboration.

The taxonomy has been developed by the Department of Treasury and Finance and the Department of Government Services in collaboration with Victorian regulators. The focus of the taxonomy is on permissioning, describing business and individual data commonly collected and used by regulators, including business identifier data (e.g ABN, address) and data related to compliance history.

Adopting this taxonomy will enable regulators to create a shared business profile, facilitating more effective information exchange across agencies. It helps regulators identify which businesses are subject to oversight by which regulators and interpret data provided by other regulators with greater ease and consistency. This shared framework strengthens collaboration, reduces duplication, and supports a more coordinated regulatory environment.

The model below enables regulators to better structure their data for interoperability with common Customer Relationship Management (CRM) applications used across the Victorian Public Sector, supporting improved information sharing. This model aligns with those used by Service Victoria – making it easier to integrate with effective and efficient centrally developed solutions.

Where can this help?

Regulators should use this model as:

Additional resources

Privacy impact assessments

A PIA should be completed where personal information is collected, used or disclosed.

A PIA helps to assess a program against the IPPs (Part 2 – privacy analysis) and identifies any risks to manage (Part 3 – privacy risk assessment).

The PIA should be reviewed/updated if new information is to be collected, used or disclosed.

Included in the PIA section of the VPS Data Sharing Heads of Agreement template (Annexure 2).

Note: the PIA template may be adapted to cover consideration of the Health Privacy Principles – contact the Health Complaints Commissioner for advice. Where can this help?

Additional resources:

Privacy Impact Assessments Template Word 82.01 KB (opens in a new window)

Business Impact Level assessments

economy and finance

legal and regulatory

personal

public services

public order, public safety and law enforcement.

OFFICIAL

OFFICIAL: Sensitive

Protected (may include Cabinet-in-Confidence)

Secret (may include Cabinet-in-Confidence)

Top Secret.

Additional resources

Collection notices

name of collecting organisation and contact details

how the individual can access the information collected

purpose of collection – specific; list all purposes

disclosure of collected information – types of individuals or organisations

if the information is collected under any specific law e.g., authorising legislation

main consequences of not providing information

note where information is collected from another source (unless a serious safety risk).

e.g., permit application and complaint forms should have separate collection notices.

Where can this help?

Tips:

Additional resources

Collection notice example Word 61.55 KB (opens in a new window)

Discovering and sharing VPS data

Use the VPS Data Directory to find and share data across the VPS.

The VPS Data Directory is the Victorian public sector’s open data catalogue: a central index of datasets, metadata and publishing organisations that makes government data discoverable, reusable and accessible to the public and other agencies. The directory is accessible to VPS staff only – access through single sign-on (SSO) or by registering your details.

The VPS Data Directory:

search for data from agencies (as a user)

expose and share data with other agencies (as a provider) – including restricted data

discover other data tools, resources and news.

Where can this help?

Digital maturity to enable sharing

Improving digital maturity can enable safer and easier data sharing between regulators and key stakeholders.

The Digital Regulation Capability Model (DRCM) helps regulators to assess their digital capability and identify focal areas for improvement. Regulators may choose certain core regulatory functions and functional areas based on their regulatory focus, size, capacity, and the areas that may provide the greatest benefits – both to the regulator and their duty holders.

Improved digital maturity enables data sharing – within the organisation and with other regulators and agencies. Deciding on the desired digital maturity supports the design of systems and processes up front to realise the benefits of data sharing. Some areas where digital maturity may support more effecting and efficient operations are highlighted below.

Core function: licensing and permissions

Core function: manage compliance

Core function: manage enforcement

Core function: evaluate, assure and improve

The tools and resources below will assist regulators in overcoming legislative barriers to information sharing, including model legislative provisions that support the development of best practice legislation.

Legislative enablers for data sharing

Model Legislative Provisions

The Department of Treasury and Finance has developed best practice guidance on the topic of information sharing and confidentiality. The Guidance on Adopting Model Legislative Provisions are tools for policymakers working on new or amended legislative provisions. They include model legislative provisions drafted by the Office of the Chief Parliamentary Counsel.

The guidance expresses a preference for sharing where possible, recommends categorising information and confidentiality protections by risk level, and stresses that risk assessments should weigh both the harms of disclosure and the risks or lost opportunities from not sharing.

Regulatory Reform Omnibus Bill

The Department of Treasury and Finance runs an annual Regulatory Reform Omnibus Bill. This program was established to support policymakers in removing ineffective regulations embedded in legislation. The annual Regulatory Reform Omnibus Bill is a useful vehicle for policymakers seeking to make uncontroversial changes to legislation, and is a potential vehicle for the adoption of the confidentiality and information-sharing model legislative provisions.

For more information, or to test a potential reform, please contact reg.reform@dtf.vic.gov.au.

The Victorian Government Solicitor’s Office (VGSO) provide legal services to the VPS. This is an option where legal expertise may not be available within your organisation directly, i.e. where you do not have access to a legal team or General Counsel.

The VGSO can provide advice and support on information management, privacy and data protection, including:

Contact the VGSO to enquire about the legal services available to support safe and appropriate data sharing options for your specific circumstances.

Where can this help?

Resources

Additional resources for sharing Word 31.85 KB (opens in a new window)

Regulatory reform

Updated 27 November 2025

About the VIC Government

Grants and programs

Jobs and careers

Arts, culture and heritage

Business and the workplace

Communities

Education and training

Environment, water and energy

Finance and economy

Health and social support

Housing and property

Law and justice

Safety and emergencies

Science and technology

Sport and recreation

Traffic and transport

Working in the Victorian Government