Spam Act 2003 (Cth)
Governs commercial electronic messages (email, SMS, instant messages). Messages require consent, must identify the sender, and must include a working unsubscribe facility.
Australian Communications and Media Authority (ACMA)
General information, not legal advice
Australian Digital Duty of Care obligations are subject to legislation and service applicability; this platform does not certify compliance. Digital Care provides tools and records to support your own risk management. It is not legal advice.
The text below is explanatory guidance, not a reproduction of legislation. The official complete text and commencement information control. These steps support your work; they do not guarantee that an obligation is met.
Does it apply to your business?
Commercial electronic messages with an Australian link, including marketing email, SMS and some instant messaging, are covered. Check designated-message provisions and exceptions; factual service notifications can be treated differently.
These steps review your own messaging practices; they do not enable bulk marketing through Digital Care or establish that a purchased contact list can be used lawfully.
Detailed guidance
The Spam Act regulates sending commercial electronic messages rather than all digital communication. Consent, accurate sender identification and a compliant unsubscribe facility are central requirements.
Outsourcing messages or buying a list does not remove responsibility for lawful sending. The existence of an email address, a previous transaction or a public contact listing does not automatically establish legally supportable consent for every message.
Section 16 & Schedule 2
Consent
Do not send unsolicited commercial electronic messages. Establish express consent or a legally supportable basis for inferred consent. Keep evidence of the circumstances; do not send an unsolicited commercial message merely asking for consent.
Section 17
Sender identification
Accurately identify the person or organisation authorising the message and include relevant contact information. Check the conditions for that information to remain accurate after the message is sent.
Section 18 & Schedule 2
Unsubscribe
Include a functional unsubscribe facility meeting the legal conditions. Honour requests within five working days and keep the facility functional for at least 30 days after sending. Avoid fees or unnecessary barriers.
Digital Care action checklist
0 of 4 preparation steps checked · This page only; not saved to your assessment or evidence records.
Map email, SMS and other electronic messaging. Distinguish commercial messages from factual or exempt messages and check whether the Australian-link requirement applies.
Keep a record: Channel inventory and message classification.
Document the basis for express or inferred consent. Check sender identification and contact details in every commercial message; an unsolicited message cannot be used just to request consent.
Keep a record: Consent records, opt-in wording and approved message examples.
Test each channel’s unsubscribe facility and suppression process. Honour requests within five working days and ensure the facility remains functional for at least 30 days after sending.
Keep a record: Dated unsubscribe test results and remediation owner.
Check imported lists, agencies and messaging tools. Record how consent and suppression records move between systems and verify that settings work before sending.
Keep a record: Dated self-review of messaging controls.
Where your plan does not include the risk register or file evidence, retain those records securely outside Digital Care and reference them in your self-review. Legal notifications and technical controls must be completed through the appropriate external channels.
Official full text & sources
Read the complete instrument on the official publisher’s website, including amendments, definitions, exemptions and commencement notes. Official sources may change after this guidance was reviewed.