{"id":"F2022L01722","name":"Data Availability and Transparency (National Security Measures) Code 2022","slug":"data-availability-and-transparency-national-security-measures-code-2022","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":441674,"registerId":"F2022L01722-fast-fetch-1775956925495","compilationNumber":null,"startDate":"2026-04-12","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Data Availability and Transparency (National Security Measures) Code 2022","content":"---\nmeta-content-style-type: text/css\nmeta-content-type: application/xhtml+xml; charset=utf-8\nmeta-generator: Aspose.Words for .NET 22.10.0\n---\n\n?xml version=\"1.0\" encoding=\"utf-8\" standalone=\"no\"?>\n\n![Commonwealth Coat of Arms of Australia](image.001.jpeg)\n\n \n\nData Availability and Transparency (National Security Measures) Code 2022\n\nI, Gayle Milnes, National Data Commissioner, make the following code.\n\nDated 16 December 2022\n\nGayle Milnes\n\nNational Data Commissioner\n\n \n\n \n\n \n\n \n\nContents\n\n1 Name\n\n2 Commencement\n\n3 Authority\n\n4 Definitions\n\n5 Access to data by individuals\n\n6 Access to data by foreign individuals—notice to Australian Security Intelligence Organisation\n\n7 Access to data by foreign individuals—Australian universities\n\n1  Name\n\n  This instrument is the Data Availability and Transparency (National Security Measures) Code 2022.\n\n2  Commencement\n\n (1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.\n\n \n\n- Commencement information\n- Column 1 Column 2 Column 3\n- Provisions Commencement Date/Details\n- 1. The whole of this instrument The day after this instrument is registered. 22 December 2022\n\n\nNote: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.\n\n (2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.\n\n3  Authority\n\n  This instrument is made under section 126 of the Data Availability and Transparency Act 2022.\n\n4  Definitions\n\nNote: A number of expressions used in this instrument are defined in the Act, including the following:\n\n(a) accredited entity;\n\n(b) ADSP‑enhanced data;\n\n(c) data sharing agreement;\n\n(d) designated individual;\n\n(e) output.\n\n  In this instrument:\n\nAct means the Data Availability and Transparency Act 2022.\n\nforeign entity means:\n\n (a) a body corporate incorporated outside Australia;\n\n (b) an unincorporated body formed outside Australia that does not have its head office or principal place of business in Australia.\n\npermanent resident has the same meaning as in the AusCheck Act 2007.\n\n5  Access to data by individuals\n\n (1) For the purposes of subsection 19(16) of the Act, a data sharing agreement must require accredited entities to ensure that involvement in the entity’s collection or use of output, or ADSP‑enhanced data, of the project is restricted to designated individuals for the entity:\n\n (a) who are Australian citizens or permanent residents; or\n\n (b) for whom all of the following information is specified in the agreement:\n\n (i) full name, any previous names, and preferred name;\n\n (ii) nationality or (if more than one) each nationality;\n\n (iii) the applicable designation for the individual under section 123 of the Act;\n\n (iv) a description of the individual’s proposed role in the project.\n\n (2) If paragraph (1)(b) applies in relation to a designated individual for an entity, the data sharing agreement must also require the entity to ensure that the individual’s involvement in the entity’s collection or use of output, or ADSP‑enhanced data, of the project is restricted to the role described in the agreement for the purposes of subparagraph (1)(b)(iv).\n\n6  Access to data by foreign individuals—notice to Australian Security Intelligence Organisation\n\nApplication of this section\n\n (1) This section applies if:\n\n (a) a designated individual for an entity (the responsible entity) is neither an Australian citizen nor a permanent resident; and\n\n (b) the individual is permitted by a data sharing agreement to access data.\n\nConsistency with people principle—responsible entity\n\n (2) The responsible entity cannot be satisfied that the project to which the data sharing agreement relates is consistent with the people principle set out in subsection 16(3) of the Act unless:\n\n (a) the responsible entity has provided the following material to the Australian Security Intelligence Organisation:\n\n (i) an electronic copy of the signed data sharing agreement;\n\n (ii) the details about the individual that are specified in subsection (4); and\n\n (b) at least 14 days have passed since the material was provided.\n\nNote 1: Other requirements in relation to the people principle are set out in the Data Availability and Transparency Code 2022.\n\nNote 2: An accredited entity may be required to provide other parties to the data sharing agreement with information about foreign individuals (such as their affiliations) as part of the application of the data sharing principles and, in particular, the people principle.\n\nNote 3: A data custodian is not authorised by section 13 of the Act to share data, and an accredited entity is not authorised by section 13A or 13B of the Act to collect or use data, unless it is satisfied that the project is consistent with the data sharing principles.\n\nConsistency with people principle—entities other than responsible entity\n\n (3) An entity other than the responsible entity cannot be satisfied that the project to which the data sharing agreement relates is consistent with the people principle set out in subsection 16(3) of the Act unless:\n\n (a) it has been informed, in writing, by the responsible entity that the responsible entity has provided the material mentioned in paragraph (2)(a) to the Australian Security Intelligence Organisation; and\n\n (b) at least 14 days have passed since it was so informed.\n\nNote 1: Other requirements in relation to the people principle are set out in the Data Availability and Transparency Code 2022.\n\nNote 2: An accredited entity may be required to provide other parties to the data sharing agreement with information about foreign individuals (such as their affiliations) as part of the application of the data sharing principles and, in particular, the people principle.\n\nNote 3: A data custodian is not authorised by section 13 of the Act to share data, and an accredited entity is not authorised by section 13A or 13B of the Act to collect or use data, unless it is satisfied that the project is consistent with the data sharing principles.\n\nDetails to be notified to ASIO\n\n (4) For the purposes of subparagraph (2)(a)(ii), the details about the individual are the following:\n\n (i) full name, any previous names, and preferred name;\n\n (ii) nationality or (if more than one) each nationality;\n\n (iii) date and place of birth;\n\n (iv) any current employment (including the individual’s place of employment and the geographical location of any employers);\n\n (v) any current contractual arrangements for the provision of services by the individual (including the geographical location of any entity to which services are provided);\n\n (vi) any current or previous arrangements under which the individual is authorised to act as the agent of a foreign government or an authority of a foreign government, or of any other foreign entity;\n\n (vii) current work and personal email addresses;\n\n (viii) current work telephone number and personal mobile telephone number;\n\n (ix) the applicable designation for the individual under section 123 of the Act;\n\n (x) a description of the individual’s proposed role in the project.\n\n7  Access to data by foreign individuals—Australian universities\n\n (1) For the purposes of subsection 19(16) of the Act, this section prescribes requirements to be met by a data sharing agreement if:\n\n (a) an accredited entity that is party to the agreement is an Australian university; and\n\n (b) a designated individual for the Australian university, who is permitted by the agreement to access data, is neither an Australian citizen nor a permanent resident.\n\n (2) The agreement must require the Australian university to do the following:\n\n (a) ensure that due diligence has been carried out with respect to the individual and that the individual has undertaken training in national security issues, including foreign interference;\n\n (b) have regard to any guidance and reports, published by Australian government security or regulatory agencies responsible for regulating the higher education or research sectors, that deal with foreign interference threats in those sectors (including the Guidelines to counter foreign interference in the Australian university sector published by the Department of Education).\n","sortOrder":0}],"analysis":{"flash_summary":{"complexity_score":5,"scope_assessment":{"changed":false,"description":"This instrument implements and specifies how the Act’s people principle must be applied to data‑sharing agreements (who may access outputs, ASIO notification, university duties). The instrument alone does not show a change from the Act’s original scope; it prescribes operational requirements rather than expanding or narrowing the Act’s statutory reach."},"complexity_factors":["Cross‑references to the Data Availability and Transparency Act and the separate Data Availability and Transparency Code 2022","Different rules for citizens/permanent residents versus non‑citizens (information and process requirements)","Notification to ASIO with a mandatory 14‑day wait period before satisfying the people principle","Detailed personal and contact information list required for foreign individuals","Separate, sector‑specific obligations for Australian universities (due diligence and training)","Multiple actors and roles (responsible entity, other entities to the agreement, accredited entities, ASIO)","Operational compliance burdens on accredited entities (documentation, training, vetting)","Ambiguity in standards of satisfaction (when an entity can be \"satisfied\" project meets the people principle) and reliance on other instruments for full requirements"],"plain_english_summary":"This Code requires data‑sharing agreements under the Data Availability and Transparency Act 2022 to limit who can access shared outputs and ADSP‑enhanced data: designated individuals must be Australian citizens or permanent residents, or be specifically identified by name, nationality, role and other personal details. For non‑citizens the responsible entity must send detailed personal and role information to ASIO and wait 14 days before treating the project as consistent with the Act’s people principle. It also imposes due‑diligence and national‑security training duties on Australian universities. Accredited entities bear the compliance costs and must decide who may access data."},"flash_summary_failed":{"failed":true,"reason":"Unauthenticated. Configure AI_GATEWAY_API_KEY or use a provider module. Learn more: https://ai-sdk.dev/unauthenticated-ai-gateway","source":"analysis-cron"},"kimi_summary":{"content_quality":"ok","complexity_score":4,"scope_assessment":{"changed":false,"description":"The instrument remains tightly scoped to its original purpose: establishing national security measures for the Data Availability and Transparency Act 2022. It does not expand beyond the security framework contemplated by section 126 of the parent Act, which specifically authorises the National Data Commissioner to make codes about data sharing agreements and the 'people principle' (ensuring appropriate personnel handle data)."},"complexity_factors":["Short instrument (7 sections, approximately 3 pages)","Heavy reliance on defined terms from the parent Act (Data Availability and Transparency Act 2022) rather than defining them locally—only 2 new definitions ('foreign entity' and 'permanent resident') plus references to 5 Act-defined terms","Nested conditional logic: Section 6 applies only when (a) AND (b) conditions are met, then triggers further conditions in subsections (2) and (3)","Cross-references to external documents: 'Guidelines to counter foreign interference in the Australian university sector' (not defined within the instrument)","Temporal condition: 14-day waiting period creates a procedural checkpoint","Dual pathway structure in section 5(1) with alternative compliance routes (paragraph a vs paragraph b)"],"plain_english_summary":"This Code adds national‑security safeguards to the Data Availability and Transparency Act, limiting who may be designated to handle shared government data (generally only Australian citizens or permanent residents) and imposing an ASIO notification and information‑sharing requirement at least 14 days before a foreign national may access data. It also requires Australian universities to conduct due diligence and provide foreign‑interference training. It affects accredited entities, universities, foreign nationals and ASIO, creating stricter controls where non‑Australians are involved."}},"importantCases":[],"_links":{"self":"/api/acts/data-availability-and-transparency-national-security-measures-code-2022","history":"/api/acts/data-availability-and-transparency-national-security-measures-code-2022/history","analysis":"/api/acts/data-availability-and-transparency-national-security-measures-code-2022/analysis","conflicts":"/api/acts/data-availability-and-transparency-national-security-measures-code-2022/conflicts","importantCases":"/api/acts/data-availability-and-transparency-national-security-measures-code-2022/important-cases","documents":"/api/acts/data-availability-and-transparency-national-security-measures-code-2022/documents"}}