Department of Defence Case Study

The Department receives multiple types of information requests from internal teams, contracted personnel and external parties. Different request purposes, requester classifications and approval pathways meant staff were required to navigate a complex set of policies, procedures and legislative obligations.

This created challenges in ensuring:

• Requests were assessed consistently
• Personally identifiable information was appropriately protected
• Authorised approval channels were followed
• Decisions aligned with legislative requirements
• Risks associated with data release were proactively managed

The Department required a practical tool that would help staff navigate obligations with confidence while maintaining strong privacy and governance controls.

Evinact undertook a detailed review of the Department’s data release environment, combining stakeholder engagement with policy and process analysis.

This included:

• Consultation with teams involved in processing information requests
• Review of relevant Defence policies, procedures and governance artefacts
• Identification of critical decision points across approval pathways
• Categorisation of request types into simplified entry points

Evinact then developed a Data Release Decision Framework in the form of a visual flowchart and a structured decision-making model that was used as a practical support tool and training aid for staff and contracted personnel.

The framework incorporated the internationally recognised Five Safes approach to assess and manage risks associated with data sharing and release.

To test robustness and usability, the framework was validated through three scenario-based use cases.

Evinact also identified internal process conflicts and governance issues for further departmental consideration.

The engagement provided the Department with a clearer and more defensible model for assessing requests to share or release sensitive information.

Evinact delivered:

• A simplified decision framework aligned to legislation and policy
• Clearer approval pathways and decision points
• Practical guidance for internal and contracted personnel
• A future-ready model capable of informing automation initiatives

This positioned the department to:

• Improve consistency in data release decisions
• Reduce the risk of inadvertent disclosure of sensitive information
• Strengthen privacy and governance controls
• Help staff understand obligations and authorised channels
• Make lawful, informed decisions with greater confidence

The framework provided a stronger foundation for consistent, lawful and risk-aware decisions relating to the release of sensitive information.