Australian digital duty of care, in plain language
The key Australian laws, schemes and guidance that shape a small business's digital duty of care — each mapped to the risk categories in your Digital Care assessment, so you can see which obligations connect to which risks.
This library is general information, not legal advice. Which laws apply depends on your business, and Digital Care does not certify compliance. Seek independent legal advice for your circumstances.
Australia's central online safety law. It establishes the eSafety Commissioner and schemes covering cyberbullying of children, adult cyber abuse, image-based abuse, and removal of seriously harmful content. A broader statutory Digital Duty of Care has been announced as a policy proposal; do not treat it as an enacted general duty. Existing schemes, notices and applicable codes have their own requirements.
Key considerations
Have systems and processes to respond to eSafety removal notices and complaints.
Provide accessible reporting mechanisms for users.
Take reasonable steps to minimise harmful and illegal content on your service.
Document applicable safety measures and periodically review how they operate.
Office of the Australian Information Commissioner (OAIC)
Regulates how personal information is collected, used, stored and disclosed. Applies to organisations with annual turnover above $3 million and to smaller organisations in specific classes, including health service providers handling health information and businesses that trade in personal information. Childcare and education activities do not automatically establish coverage.
Key considerations
Publish a current privacy policy describing what you collect and why.
Collect only the personal information you reasonably need, and secure it.
Destroy or de-identify personal information you no longer need.
Give individuals access to, and correction of, their information on request.
Entities covered by the Privacy Act must assess suspected data breaches and, where a breach is likely to result in serious harm, notify affected individuals and the OAIC.
Key considerations
Maintain a data breach response plan.
Assess suspected eligible breaches expeditiously; take reasonable steps to complete the assessment within 30 days.
Notify affected individuals and the OAIC for eligible breaches.
Australian Communications and Media Authority (ACMA)
Governs commercial electronic messages (email, SMS, instant messages). Messages require consent, must identify the sender, and must include a working unsubscribe facility.
Key considerations
Send marketing messages only with consent.
Clearly identify your business in every message.
Provide a functional unsubscribe option and honour it promptly.
Imposes security and mandatory cyber incident reporting obligations on operators of critical infrastructure assets. Most small businesses are not directly regulated, but may be affected through supply-chain requirements from larger customers.
Key considerations
Know whether your services support a critical infrastructure operator.
Be ready to meet security and incident-notification clauses in customer contracts.
Australian Cyber Security Centre (guidance, not legislation)
The Australian Cyber Security Centre's baseline of eight mitigation strategies against common cyber threats. It is guidance, not a general legal duty; separate policy or contractual requirements may apply to particular entities.
Recommended practices
Apply application control, patching and macro restrictions.
Use multi-factor authentication and restrict administrative privileges.
Back up important data regularly and test restoration.
Prohibits misleading or deceptive conduct online, and sets rules for online sales, reviews and subscriptions. Relevant where AI features or chatbots make representations to customers.
Key considerations
Ensure statements made by your website and AI features are accurate.
Avoid misleading impressions from automated systems; disclose automation where appropriate to the context.
Meet consumer guarantee and subscription disclosure requirements.
Department of Industry, Science and Resources (voluntary guidance)
Voluntary responsible-AI resources, including the eight ethics principles and the 2024 Voluntary AI Safety Standard. The newer Guidance for AI Adoption simplifies the guardrails into six practices. These resources are not legislation; other laws can apply to AI uses.
Recommended practices
Tell users when they are interacting with AI.
Test AI features for harmful outputs and configure guardrails.
Keep a human review path for consequential AI decisions.
Your assessment report and risk register keep a dated record of how you addressed each category — useful evidence of your ongoing duty-of-care management.
