About our privacy management
The Office of Sport values the privacy of clients, stakeholders and staff. We protect personal information under the Privacy and Personal Information Protection Act 1998 (NSW) and the Health Records and Information Privacy Act 2002 (NSW).
We make sure personal information is:
- Collected only when we need it for an activity or service. We explain why we collect it and who we may share it with and if it is required by law.
- Collected directly from you. We only collect it from another source if you agree, or if a parent or guardian provides it for someone under 16.
- Protected with safeguards against loss, unauthorised access, misuse, modification or disclosure.
- Kept only as long as we need it and then securely disposed of.
- Available to you, on request.
- accessible on request from the individual on whom the information is held.
Email marketing and website enquiry collection notice
The Office of Sport collects your personal information to manage your program registration, respond to your enquiry, process your application or provide information you have signed up for. Providing this information is voluntary. If you choose not to provide it, we may not be able to process your request or deliver the service.
Your personal information is managed in line with the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act). We keep your information secure and use it only for the purpose we collected it for, or for directly related purposes that you would expect.
The Office of Sport may share your information, but only if needed to deliver the service, if you give consent, or where we are authorised or required by law.
You have the right to access and request updates to your personal information at any time without delays or high cost.
Your privacy rights
Access your personal information
Under the Privacy and Personal Information Protection Act 1998 (NSW), you can request access to personal information we hold about you. We must provide this information without delay or high cost.
Updating your personal information
You can ask us to change your personal information to make sure it is:
- accurate
- relevant to its purpose
- up to date
- complete
- not misleading.
Informal requests
If you need to update or correct your personal information, please contact the staff member or team responsible for managing it. You can also use our general contact details.
In some cases, you may be able to update your information yourself through our online booking system. This depends on the type of information and may require you to confirm your identity.
You don’t need to put your request in writing. If needed, we’ll ask you to verify your identity or submit a formal application.
We aim to respond to informal requests within 5 working days. If it’s likely to take longer, we’ll let you know how long it might take.
Formal requests
You have the right to make a formal application to access or change your personal or health information. You don’t need to make an informal request first. You can apply formally at any time, even if you’ve already asked informally.
To make a formal application, contact the Office of Sport Privacy Officer.
Your application should include:
- your name and contact details (postal address, phone number and email if you have one)
- whether your request is about personal information (under PPIPA) or health information (under HRIPA)
- what information you want to access or change
- how you want to access or change it
We aim to respond in writing within 20 working days. If it’s likely to take longer, we’ll let you know.
Public data breach notification register
| Date of Breach | Breach Details | Breach Type | Cause of Breach | How the Breach Occurred | What Data was accessed | What the Office of Sport is doing/ has done to prevent further breaches | What can people affected do | Date of Public Notification | Who to contact for assistance | Public Notification Link | Current Status |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 22-Apr-24 | Personal information about attendees of a camp was disclosed to Department of Communities & Justice (DCJ) via phone call prior to confirmation of the callers identity/authorisation. | Unauthorised disclosure | Human Error | Personal information was disclosed via phone call prior to confirmation of the callers identity/authorisation. | Personal information | Personnel instructed not to release any personal details of any participants in any circumstances. On 29 April 2024, further information/training was provided to the Central Reservations Team about the responsibilities should inquiries be received requesting details of participants. On 10 May 2024, the team was given a copy of the Exchange of Information Policy & Procedure. | Informed to get in touch with Dept of Communities & Justice for further information about matter | ||||
| 19-Oct-25 | Personal & Health information about attendees of a camp was disclosed to an unauthorised person | Unauthorised disclosure | Human Error | Personal information was disclosed via an email to the incorrect address | Personal and health information | The system was updated to include the correct email address. Processes are being reviewed to ensure the breach does not occur in the future. | Informed individual can contact the Office of Sport for further information and the IPC for information on how to manage personal and health data as a result of the breach. |
Privacy complaints
If you believe the Office of Sport has mishandled your personal or health information, you have the right to raise your concerns.
Try informal resolution first
We encourage you to contact us to discuss your concerns before making a formal complaint.
Request an internal review
If you're not satisfied with the outcome of informal discussions, you can request an internal review under the PPIP Act.
You must submit your request within 6 months of becoming aware of the issue. This timeframe applies even if you’re trying to resolve the matter informally.
Only the person affected by the alleged breach, or their authorised representative, can request an internal review.
To request an internal review:
- complete the Internal Review Application Form.
- send it to the Office of Sport’s Privacy Officer.
The internal review will be conducted by the Privacy Officer, unless the complaint is about them. In that case, another qualified staff member will be appointed.
We aim to:
- acknowledge your application within 7 calendar days.
- complete the review within 60 calendar days.
- notify you in writing of the outcome within 14 calendar days of the decision.
If you don’t receive a response within 60 days, or you’re not satisfied with the outcome, you can request an external review.
If you prefer, you can make a complaint directly to the Information and Privacy Commission NSW.
Seek an external review
You can apply to the NSW Civil and Administrative Tribunal (NCAT) for an external review if:
- you’re unhappy with the outcome of the internal review, or
- you haven’t received a response within 60 calendar days.
You must apply to NCAT within 28 calendar days of receiving the internal review decision.
For more information or to apply, visit the NCAT website.
Contact us about privacy
Email: privacy@sport.nsw.gov.au
Phone: 13 13 02
Post: Locked Bag 1422, SILVERWATER NSW 2128
Address: Level 3, 6B Figtree Drive, SYDNEY OLYMPIC PARK NSW 2127