Regulatory Radar

Businesses, advisers and other users that rely on bulk or routine searches of the companies register for due diligence, credit assessment, debt recovery or compliance purposes may wish to review the proposed access categories to assess whether their current search practices would remain available under the new settings. Entities that currently access director addresses or other personal information as part of standard processes could consider making a submission before the consultation closes on 12 October 2026 if the proposed restrictions would affect established workflows or systems that depend on current levels of register access.

Organisations that collect or handle personal information, including those using artificial intelligence or connected devices in customer facing processes, may find it useful to read the exposure draft bill and consultation paper to understand which proposed changes would affect their current privacy policies, consent mechanisms and data handling practices. Because the measures remain in draft and are subject to further consultation and parliamentary process, any internal assessment at this stage is best treated as preparatory rather than as a response to settled law. Estimating the scale of system, policy and contractual changes the draft would require may assist with future budgeting and planning.

Organisations that collect, use or disclose personal information may wish to begin scoping what a fair and reasonable handling standard, a 72 hour breach notification timeframe and new controller and processor concepts would mean for current privacy policies, data handling agreements and incident response procedures. For professional service firms, this includes client data held under retainer and information shared with outsourced providers. Because the Bill remains an exposure draft that has not been introduced into Parliament, any changes made now should be treated as preparatory rather than final, with further adjustment likely once the government settles its position following consultation.

Boards of APRA and ASIC regulated entities may wish to confirm that a documented risk appetite for frontier AI exists and has been considered at board level, covering matters such as escalation authority and recovery priorities, rather than being left to management alone. It may also be worth testing whether incident response and recovery plans have been exercised against scenarios involving AI-accelerated attacks, given the regulators' point that such incidents can unfold faster than traditional cyber events.

Regulated financial entities and their material service providers may wish to benchmark their own cyber and operational resilience arrangements, including patching, access controls, backup integrity and incident response testing, against the themes identified in this publication. Boards could consider whether governance arrangements for escalation, risk appetite and recovery decisions are adequately defined in advance of an incident, given the compressed response timeframes associated with frontier AI related threats. Entities relying heavily on a small number of third party service providers may also want to assess concentration risk in that context.

Providers of apps, games, websites and other online services may wish to assess now whether their service is likely to be accessed by children, or primarily concerned with children's activities, since that assessment determines whether the Code will apply once registered. Where it is likely to apply, relevant documents to review include privacy policies, consent flows for targeted advertising, age assurance processes and deletion request procedures. Because the final Code must be registered by 10 December 2026 and a breach will amount to a breach of the Privacy Act carrying civil penalties, compliance work is worth starting well before that date rather than waiting for the final text.

Australian Government agencies subject to the Freedom of Information Act could use the review's findings to check whether their own disclosure log publication practices meet the 10 working day timeframe in section 11C, including after internal review decisions change what was originally released. Agencies may wish to compare their disclosure log governance and reporting arrangements against the better-practice features the OAIC identified, such as searchability and accessible formats. Private sector organisations are not directly covered by this review, though those that deal with government information requests, or that model their own transparency practices on government approaches, may still find the OAIC's observations a useful reference point.

Retailers selling smart glasses or similar recording wearables, and businesses that manufacture, distribute or deploy such devices in Australia, may wish to monitor the Privacy Commissioner's response to this request, as any resulting guidance or regulatory focus could affect product design, point of sale disclosures or usage policies. Businesses operating premises where customers or staff may use such devices, including retail, hospitality and workplace settings, could also consider their existing policies on recording by visitors or employees in light of the privacy concerns raised.

Retailers using or considering facial recognition technology could test any existing or planned deployment against the updated guidance, with particular attention to whether a privacy impact assessment has been completed and documented, whether an exception to consent genuinely applies given the entity's specific security context, and whether customers have been properly notified. Given the Tribunal's findings turned on the particular threats faced by the retailer in question, businesses may want to document the specific risks their own stores face rather than relying on a general industry justification. Legal teams could also monitor the outcome of the separate Kmart review, since it may provide further guidance on notification obligations.

Businesses that use artificial intelligence in customer facing products, services or decision making may find it useful to map where AI currently features in those processes, so that if a digital duty of care, consumer law changes or privacy reforms proceed, the business can assess its exposure quickly. As this announcement is a statement of policy direction rather than a settled legislative proposal, any internal review undertaken now is best treated as preparatory monitoring rather than a response to a confirmed legal requirement.

Organisations that outsource customer-facing functions involving personal information, such as call centre or contact centre services, may wish to review what personal information is accessible to those providers, what authentication and verification steps are required before access is granted, and what the outsourcing contract says about security standards, incident notification timeframes and audit rights. Because the OAIC examined both Qantas's own protections and its oversight of the third-party provider before reaching its conclusion, similar scrutiny of outsourced arrangements can be expected in any comparable large-scale breach, even where the findings do not ultimately support further regulatory action.

Entities covered by the Privacy Act may wish to test their data breach response plan against the 30 day assessment window used to determine whether notification to the OAIC and affected individuals is required, rather than waiting for an actual incident to reveal gaps in the process. Given that malicious or criminal attacks and social engineering remain the leading causes of notified breaches, it would also be worth reviewing staff awareness training and verification procedures for unusual requests to access or change account information, alongside the adequacy of current cyber incident detection and containment arrangements.

Entities currently captured as responsible entities under the Security of Critical Infrastructure Act, or operating in sectors that may newly fall within scope, may wish to monitor the outcome of this consultation to understand how asset and sector coverage, governance requirements and assurance obligations might change. Businesses that made submissions during the consultation period may want to review the published submissions once available to understand the range of industry positions put to the Department ahead of any legislative amendments being introduced.