{"id":"F2017L00941","name":"Telecommunications (Integrated Public Number Database Scheme – Conditions for Authorisations) Determination 2017","slug":"f2017l00941","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":439277,"registerId":"F2017L00941-fast-fetch-1775955365986","compilationNumber":null,"startDate":"2026-04-12","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Telecommunications (Integrated Public Number Database Scheme – Conditions for Authorisations) Determination 2017","content":"---\nmeta-content-style-type: text/css\nmeta-content-type: application/xhtml+xml; charset=utf-8\n---\n\n?xml version=\"1.0\" encoding=\"utf-8\" standalone=\"no\"?>\n\n![](image.001.jpeg)\n\n \n\nTelecommunications (Integrated Public Number Database Scheme – Conditions for Authorisations) Determination 2017\n\n \n\n \n\n \n\nI, MITCH FIFIELD, Minister for Communications, make the following instrument.\n\nDated 18 July 2017    \n\nMITCH  FIFIELD\n\nMinister for Communications\n\n \n\n \n\n \n\nContents\n\n1  Name\n\n2  Commencement\n\n3  Authority\n\n4  Definitions\n\n5  Schedules\n\n6  Cross-border disclosure of protected information\n\n7  Safeguarding protected information\n\n8  Addressing breaches of security\n\n9  Notification of breaches by others\n\n10  Secure disposal of protected information after use\n\n11 Public number directory publishers\n\n12  Researchers\n\nSchedule 1—Repeals\n\nTelecommunications (Integrated Public Number Database Scheme – Conditions for Authorisations) Determination 2007 (No. 1)\n\n \n\n \n\n1  Name\n\n  This instrument is the Telecommunications (Integrated Public Number Database Scheme – Conditions for Authorisations) Determination 2017.\n\n2  Commencement\n\n  This instrument commences on the day after this instrument is registered.\n\n3  Authority\n\n  This instrument is made under section 295P of the Telecommunications Act 1997.\n\n4  Definitions\n\n  In this instrument:\n\nAct means the Telecommunications Act 1997.\n\ncontractor means a person who performs services for and on behalf of the holder of a public number directory authorisation or a research authorisation but does not include a person who performs such services in the capacity of an employee of the holder.\n\ncustomer means a person who is supplied with a carriage service by a carriage service provider.\n\ncustomer data has the same meaning as in the Telecommunications Integrated Public Number Database Scheme 2017.\n\ndirectory address means the information contained in the designated directory address fields in the integrated public number database.\n\ndirectory finding name means the information contained in the designated finding name fields in the integrated public number database.\n\nintegrated public number database has the meaning given by subsection 285(2) of the Act.\n\nintegrated public number database scheme means the scheme in force under section 295A of the Act.\n\nIPND Manager means the person who maintains the integrated public number database from time to time.\n\nAustralian Privacy Principles has the same meaning as in the Privacy Act 1988.\n\nprotected information means information or a document disclosed under subsection 285(1A) of the Act for a purpose covered by:  \n\n (a) subparagraph 285(1A)(c)(ii) of the Act; or\n\n (b) subparagraph 285(1A)(c)(iv) of the Act.\n\npublic number has the meaning given by subsection 285(2) of the Act.\n\npublic number directory has the meaning given by subsection 285(2) of the Act.\n\npublic number directory authorisation means an authorisation under the integrated public number database scheme that permits the person to whom it is granted to use and disclose protected information for a purpose covered by subparagraph 285(1A)(c)(ii) of the Act.\n\nresearch authorisation means an authorisation under the integrated public number database scheme that permits the person to whom it is granted to use and disclose protected information for a purpose covered by subparagraph 285(1A)(c)(iv) of the Act.\n\nNote: A number of expressions used in this instrument are defined in section 7 of the Act, including the following:\n\n(a) ACMA;\n\n(b) carriage service;\n\n(c) carriage service providers.\n\n (2) For the purposes of this instrument, protected information is taken to be transferred to someone who is in a foreign country when it becomes accessible to the intended recipient of the information in the foreign country.\n\nNote: Section 6 of this instrument deals with transborder data flows. It is not intended to capture temporary offshoring of data such as when a document is emailed between two points within Australia but because of Internet routing it travels overseas on the way to its destination.\n\n5  Schedules\n\n  Each instrument that is specified in Schedule 1 to this instrument is repealed as set out in the Schedule.\n\n6  Cross-border disclosure of protected information\n\n (1) An authorisation under the integrated public number database scheme is subject to a condition prohibiting the holder of an authorisation from transferring protected information to someone who is in a foreign country (the recipient) unless:\n\n (a) the holder reasonably believes that the recipient is subject to a law or binding scheme that has the effect of protecting the information in a way that, overall, is at least substantially similar to the way in which the Australian Privacy Principles protect the information; or\n\n (b) the holder has made contractual arrangements with the recipient to ensure that the information which it has transferred will not be held, used or disclosed by the recipient inconsistently with the Australian Privacy Principles.\n\n (2) An authorisation under the integrated public number database scheme is subject to a condition requiring the holder of an authorisation to remain legally responsible for any use or disclosure of protected information by the recipient that is inconsistent with the Australian Privacy Principles.\n\n7  Safeguarding protected information\n\n  An authorisation under the integrated public number database scheme is subject to a condition requiring the holder of the authorisation to take reasonable steps to protect and secure the protected information, and any personal information related to the protected information, that it holds from:\n\n (a) misuse or loss; and\n\n (b) unauthorised access, modification, use or disclosure.\n\n8  Addressing breaches of security\n\n  An authorisation under the integrated public number database scheme is subject to a condition requiring the holder of the authorisation, as soon as practicable after the holder becomes aware of a substantive or systemic breach of security that could reasonably be regarded as having an adverse impact on the integrity and confidentiality of the protected information, to:\n\n (a) notify the ACMA and the IPND Manager; and\n\n (b) take reasonable steps to minimise the effects of the breach.\n\n9  Notification of breaches by others\n\n  An authorisation under the integrated public number database scheme is subject to a condition requiring the holder of the authorisation, as soon as practicable after becoming aware that a person to whom the holder has disclosed protected information has contravened any legal restrictions governing the person’s ability to use or disclose protected information, to notify ACMA and the IPND Manager.\n\n10  Secure disposal of protected information after use\n\n  An authorisation under the integrated public number database scheme is subject to a condition requiring the holder of the authorisation to securely destroy protected information within 10 business days of:\n\n (a) the protected information no longer being required for the purpose for which it was disclosed to the holder; or\n\n (b) the authorisation ceasing or being revoked.\n\n11 Public number directory publishers\n\n (1) A public number directory authorisation is subject to a condition requiring the holder of the authorisation to make contractual arrangements to ensure that any contractor to whom the holder discloses protected information neither uses nor discloses that information except for a purpose covered by subparagraph 285(1A)(c)(ii) of the Act.\n\n (2) A public number directory authorisation is subject to a condition that the only customer data from the integrated public number database that may be included in a public number directory published and maintained by the holder of the authorisation is the directory finding name, directory address and public number.\n\n (3) A public number directory authorisation is subject to a condition requiring the holder of the authorisation to ensure that any public number directory that the holder or a contractor publishes using protected information contains the name and contact details of the holder as the copyright owner and a statement concerning the holder’s copyright in the directory.\n\n12  Researchers\n\n (1) A research authorisation is subject to a condition requiring the holder of the authorisation to make contractual arrangements to ensure that any contractor to whom the holder discloses protected information neither uses nor discloses the information except for a purpose covered by subparagraph 285(1A)(c)(iv) of the Act.\n\n (2) A research authorisation is subject to a condition requiring the holder of the authorisation to ensure that any database that the holder produces using protected information:\n\n (a) does not enable a person who only knows the public number of an end-user of a carriage service to readily identify the end-user’s name and/or address; and\n\n (b) subject to subsection (3), does not enable a person who only knows the whole or a part of the address of an end-user of a carriage service to readily identify the end-user’s name and/or public number.\n\n (3) The holder of a research authorisation may produce a database of a kind mentioned in subsection (2) that enables a person to search by postcode to find a list of public numbers, and the customer data associated with those numbers, from within the postcode.\n\n (4) A research authorisation is subject to a condition requiring the holder of the authorisation to use only the directory finding name, directory address and public number fields of the integrated public number database to contact customers.\n\n (5) A research authorisation is subject to a condition prohibiting the holder of the authorisation from selling or providing customer data to any person for any purpose unless this is authorised or required by or under law.\n\n \n\n \n\n \n\n \n\n \n\n \n\nSchedule 1—Repeals\n\nTelecommunications (Integrated Public Number Database Scheme – Conditions for Authorisations) Determination 2007 (No. 1)\n\n1  The whole of the instrument\n\nRepeal the instrument.\n\n \n","sortOrder":0}],"analysis":{"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"kimi_summary":{"content_quality":"ok","complexity_score":3,"scope_assessment":{"changed":false,"description":"The legislation remains tightly focused on its original purpose: setting privacy and security conditions for access to the Integrated Public Number Database. It replaces the 2007 Determination without expanding into new areas. The scope covers exactly two types of authorisations (directory publishers and researchers) and imposes conditions directly related to data protection, consistent with the enabling provision in section 295P of the Telecommunications Act 1997."},"complexity_factors":["Short instrument: only 12 substantive sections plus a repeal schedule","Limited defined terms: 12 definitions in section 4, mostly referencing external legislation (Telecommunications Act 1997, Privacy Act 1988)","Clear structure: follows a logical sequence from definitions to general conditions (sections 6-10) to specific conditions for each authorisation type (sections 11-12)","Minimal cross-referencing: primarily references subsections 285(1A)(c)(ii) and (iv) of the Telecommunications Act 1997 to define 'protected information' and permitted purposes","Simple conditional logic: conditions are straightforward prohibitions and requirements ('must not', 'must take reasonable steps') rather than nested exceptions","No delegated legislative powers or complex machinery provisions"],"plain_english_summary":"This law tightly restricts who may access Australia’s Integrated Public Number Database (IPND)—principally directory publishers and approved researchers—and imposes strong privacy and security controls, limits on overseas disclosure, breach-reporting and data deletion rules, plus extra constraints on researchers. \n\nIt matters because it keeps Australians’ names, addresses and phone numbers out of abusive use, resale, or transfer to weak‑privacy jurisdictions."},"flash_summary":{"complexity_score":5,"scope_assessment":{"changed":true,"description":"Yes. Schedule 1 expressly repeals the Telecommunications (IPND Scheme – Conditions for Authorisations) Determination 2007, replacing it with the 2017 conditions (Schedule 1). The 2017 instrument imposes new/explicit cross-border transfer tests and ongoing liability for recipients (s 6), enhanced safeguarding and breach-notification duties (ss 7–9), a 10-business-day secure disposal requirement (s 10), and tighter field- and use‑limits for public directories and research plus an express ban on selling customer data except as law permits (ss 11–12)."},"complexity_factors":["Multiple authorisation types with distinct conditions for public number directory authorisations and research authorisations (ss 11–12)","Cross-border transfer test requiring either a foreign law/binding scheme ‘substantially similar’ to the Australian Privacy Principles or specific contractual safeguards (s 6(1)(a)–(b))","Ongoing legal responsibility on the holder for recipients' inconsistent use or disclosure (s 6(2))","General obligation to take ‘reasonable steps’ to protect information from misuse, loss, unauthorised access, modification, use or disclosure (s 7) — introduces judgment calls on adequacy","Mandatory breach-response duties: notify ACMA and the IPND Manager and take steps to minimise effects for substantive/systemic breaches (s 8) and report third‑party contraventions (s 9)","Time-bound secure disposal requirement: destroy protected information within 10 business days after no longer needed or on authorisation cessation/revocation (s 10)","Field-specific restrictions for directories and research databases limiting which IPND fields may be used and search capabilities (ss 11(2), 12(2)–(3))","Contractual constraints on contractors to use data only for authorised purposes (ss 11(1), 12(1))","Absolute prohibition on selling or providing customer data except where authorised or required by law (s 12(5))","Dependence on defined terms and interaction with the Telecommunications Act 1997 and the Privacy Act 1988 for scope and standards (s 4 and notes), increasing interpretive complexity","Repeal of the 2007 Determination (Schedule 1), which may require holders to transition practices to the updated conditions"],"plain_english_summary":"This instrument sets mandatory conditions for holders of authorisations under the Integrated Public Number Database (IPND) scheme. It limits cross-border transfers, requires contractual or legal safeguards, makes holders legally responsible for recipients' misuse, mandates security measures, breach notifications, and timely secure destruction of protected information.\n\nIt also restricts which customer fields publishers and researchers may use, controls contractor use, and forbids sale of customer data except where law authorises it. It affects authorisation holders, their contractors, recipients overseas, ACMA and the IPND Manager."}},"importantCases":[],"_links":{"self":"/api/acts/f2017l00941","history":"/api/acts/f2017l00941/history","analysis":"/api/acts/f2017l00941/analysis","conflicts":"/api/acts/f2017l00941/conflicts","importantCases":"/api/acts/f2017l00941/important-cases","documents":"/api/acts/f2017l00941/documents"}}