Australia's privacy commissioner told a Senate inquiry into the "robo-debt" saga on Thursday the code will be binding for public service agencies, which could be hit with fines for seriously or repeatedly breaching the rules.

The tough new regime was announced as Australian Privacy Commissioner Timothy Pilgrim confirmed his office had resumed informal investigations of the Department of Human Services' release of Centrelink recipients' personal information.

Public servants will have to conduct and publish privacy assessments in cases of data-matching deemed to involve "high risk", Mr Pilgrim said.

"We're looking to make best privacy practice the only practice for government-held data," he said.

The new code could replace voluntary guidelines used by departments data-matching without using tax file numbers, and the commissioner would investigate breaches and decide whether to pursue penalties in the Federal Court.

Mr Pilgrim told the Senate inquiry into "robo-debt" the government needed to handle personal information in a way that met broader community expectations.

"The community's response to this initiative demonstrates that careful consideration should always be given to whether use of personal information strikes an appropriate balance between achieving policy goals and any impact on privacy," he said.

His office will devise the new code with the Department of Prime Minister and Cabinet, which will implement it across the public service.

He told senators his office had resumed informal investigations into the DHS' release of Centrelink recipients' personal information to media.

The commissioner's inquiries come after the AFP dropped an investigation into the DHS' release of recipient Andie Fox's information to the media.

However no formal investigation had started, and the office would not take regulatory action against the DHS over its controversial "robo-debt" program after the Ombudsman's report last month.