A NSW Government website
NSW GovernmentNSW GovernmentNSW ICT Procurement Risk Screening Tool
Appearance

Step 4 of 10

Privacy and data

Does the solution involve the collection, use, storage, processing, analysis, generation or disclosure of personal, health or other sensitive information?
Will a third-party vendor, reseller, subcontractor, cloud, AI or support provider have access to personal, health or government information?
Will the solution involve information sharing with another agency, public sector body, private entity, supplier or subcontractor?
Will personal, health or government information be stored, processed, accessed, supported or disclosed outside NSW or Australia, including by staff or service providers based overseas?
Will the solution involve data matching, analytics, linkage, profiling, automated recommendations, AI-enabled processing or automated decision-making?
Will the solution create new information, records, classifications, profiles, scores, recommendations, summaries, audit logs or other derived information?
Could the solution affect a person's ability to access government information, understand how information is used, or exercise privacy, access or correction rights?
Is it unclear who will hold the information, in what form, where it will be stored, and how agency access will be provided during and after the engagement?
Is it unclear whether contract arrangements address data return, deletion, retention, audit rights, access to logs, incident notification and data-breach responsibilities?
Will production data be used in non-production environments such as development, testing, training, support, demonstrations or AI model training?
Will any supplier, administrator or project team member be able to directly change, correct, migrate, extract or manipulate production data?