Online Safety Act 2021 (Cth)

Australia's central online safety law. It establishes the eSafety Commissioner and schemes covering cyberbullying of children, adult cyber abuse, image-based abuse, and removal of seriously harmful content. A broader statutory Digital Duty of Care has been announced as a policy proposal; do not treat it as an enacted general duty. Existing schemes, notices and applicable codes have their own requirements.

eSafety Commissioner

General information, not legal advice

Australian Digital Duty of Care obligations are subject to legislation and service applicability; this platform does not certify compliance. Digital Care provides tools and records to support your own risk management. It is not legal advice.

The text below is explanatory guidance, not a reproduction of legislation. The official complete text and commencement information control. These steps support your work; they do not guarantee that an obligation is met.

Does it apply to your business?

Service type, Australian connection, content thresholds and the relevant scheme determine coverage. Hosting a website alone does not mean every provider duty applies. Check relevant industry codes and standards as well as the Act.

A broader Digital Duty of Care has been announced, not established here as an enacted general duty. Check current legislation and commencement dates before relying on a proposal.

Detailed guidance

The Online Safety Act establishes eSafety’s powers and targeted schemes for child cyberbullying, adult cyber abuse, image-based abuse and specified online content. Different schemes use different legal thresholds; “harmful content” is not one universal legal test.

Providers may receive removal or reporting notices and may fall within registered industry codes or standards. Basic Online Safety Expectations describe expected safety practices for covered services; enforceable reporting requirements and specific notices must be assessed separately.

Act: scheme-specific provisions

Complaints and removal notices

Determine which scheme and provider definition apply. Check the legal basis, scope and deadline of any notice, preserve necessary records and use a documented escalation process. A voluntary response target does not override the notice.

Basic Online Safety Expectations

Safety systems and reporting

For covered services, consider the applicable expectations for safer design, content handling and accessible reporting. eSafety can require provider reports. Failing a reporting requirement is distinct from a blanket statutory obligation on every small business.

Registered codes and standards

Service-specific controls

Check which industry section and current instrument cover the service. Requirements for illegal or restricted material vary across providers and instruments; consult the current code, standard and eSafety guidance.

Digital Care action checklist

0 of 4 preparation steps checked · This page only; not saved to your assessment or evidence records.

1. Establish your service and audience

Identify whether you host user content, private messages, children’s accounts or public uploads. Check which eSafety schemes, codes and notices apply to the actual service, not just your business label.

Keep a record: Service description, audience assumptions and an applicability decision.

Children & young people

All plansAnnual assessment

2. Review moderation and user protection

Assess blocking, reporting, age-appropriate safeguards and content removal. Record the gaps and allocate a responsible person to each remediation action.

Keep a record: Action owners, due dates and moderation responsibilities.

Harmful content

Professional & ManagedRisk register

3. Prepare complaints and notice handling

Maintain a monitored contact point and an escalation procedure. Record the deadline in any actual eSafety notice; do not substitute an internal target for a legal deadline.

Keep a record: Reporting-page screenshots, notice-response procedure and a dated incident record.

Reporting & complaints

Professional & ManagedEvidence

4. Record a dated safety review

Review whether controls are operating on the live service, document unresolved limitations and revisit the assessment when features or audiences change.

Keep a record: Dated self-review with safeguards and follow-up actions.

Harassment & abuse

All plansReport & self-review

Where your plan does not include the risk register or file evidence, retain those records securely outside Digital Care and reference them in your self-review. Legal notifications and technical controls must be completed through the appropriate external channels.

Official full text & sources

Read the complete instrument on the official publisher’s website, including amendments, definitions, exemptions and commencement notes. Official sources may change after this guidance was reviewed.