{"id":"nsw:act-2025-045","name":"Identity Protection and Recovery Act 2025","slug":"identity-protection-and-recovery-act-2025","collection":"act","jurisdiction":"nsw","status":"in_force","isInForce":true,"actNumber":"45 of 2025","makingDate":null,"administeringDepartment":null,"currentVersion":{"id":28809,"registerId":"nsw-act-2025-045-current","compilationNumber":null,"startDate":"2026-04-01","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Part 1","sectionType":"part","heading":"Preliminary","content":"# Part 1 Preliminary\n\nPart 1 Preliminary","sortOrder":0},{"sectionNumber":"1","sectionType":"section","heading":"Name of Act","content":"#### 1 Name of Act\n\n1 Name of Act\n\n> This Act is the [Identity Protection and Recovery Act 2025](/view/html/inforce/current/act-2025-045).","sortOrder":1},{"sectionNumber":"2","sectionType":"section","heading":"Commencement","content":"#### 2 Commencement\n\n2 Commencement\n\n> This Act commences on the date of assent to this Act.","sortOrder":2},{"sectionNumber":"3","sectionType":"section","heading":"Objects of Act","content":"#### 3 Objects of Act\n\n3 Objects of Act\n\n> The objects of this Act are as follows—\n> \n> > (a) to enable the Secretary to—\n> > \n> > > (i) carry out and facilitate the protection and recovery of personal information of individuals from personal data compromises, and\n> > \n> > > (ii) facilitate the remediation of compromised personal information of individuals, and\n> > \n> > > (iii) carry out and facilitate the protection of organisations from personal data compromises, and\n> > \n> > > (iv) adopt and recommend best practice standards in the protection and recovery of personal information,\n> \n> > (b) to permit the collection, holding, use and disclosure of information for the purpose of protecting organisations and the personal information of individuals from personal data compromises.","sortOrder":3},{"sectionNumber":"4","sectionType":"section","heading":"Definitions","content":"#### 4 Definitions\n\n4 Definitions\n\n> The dictionary in Schedule 4 defines words used in this Act.\n> \n> Note—\n> \n> The [Interpretation Act 1987](/view/html/inforce/current/act-1987-015) contains definitions and other provisions that affect the interpretation and application of this Act.","sortOrder":4},{"sectionNumber":"5","sectionType":"section","heading":"Meaning of “compromised” personal information","content":"#### 5 Meaning of “compromised” personal information\n\n5 Meaning of “compromised” personal information\n\n> In this Act, compromised, in relation to personal information, means personal information known or suspected to have been—\n> \n> > (a) used, accessed, disclosed or lost unlawfully or without authorisation, or\n> \n> > (b) lost or disclosed unintentionally.","sortOrder":5},{"sectionNumber":"6","sectionType":"section","heading":"Meaning of “identity document”","content":"#### 6 Meaning of “identity document”\n\n6 Meaning of “identity document”\n\n> > (1) In this Act, identity document means the following—\n> > \n> > > (a) a document specified in Schedule 1,\n> > > \n> > > Examples—\n> > > \n> > > driver licence\n> > > \n> > > birth certificate\n> > > \n> > > medicare card\n> > \n> > > (b) a DVS document within the meaning of the [Identity Verification Services Act 2023](http://www.legislation.gov.au/) of the Commonwealth that is not otherwise specified in Schedule 1,\n> > \n> > > (c) another document that is—\n> > > \n> > > > (i) issued by a government to an individual containing personal information relating to the individual, and\n> > > \n> > > > (ii) prescribed by the regulations.\n> \n> > (2) A reference in this Act to an identity document includes information in relation to an individual—\n> > \n> > > (a) contained in an identity document related to the individual, or\n> > \n> > > (b) associated, or reasonably expected to be associated, with an identity document related to the individual.","sortOrder":6},{"sectionNumber":"7","sectionType":"section","heading":"Meaning of “personal data compromise”","content":"#### 7 Meaning of “personal data compromise”\n\n7 Meaning of “personal data compromise”\n\n> In this Act, a personal data compromise means a known or suspected—\n> \n> > (a) unauthorised or unlawful use, access, disclosure or loss of personal information, or\n> \n> > (b) unintentional disclosure or loss of personal information.","sortOrder":7},{"sectionNumber":"8","sectionType":"section","heading":"Act to bind Crown","content":"#### 8 Act to bind Crown\n\n8 Act to bind Crown\n\n> This Act binds the Crown in right of New South Wales and, to the extent the legislative power of the Parliament of New South Wales permits, the Crown in all its other capacities.","sortOrder":8},{"sectionNumber":"Part 2","sectionType":"part","heading":"Identity protection and recovery functions","content":"# Part 2 Identity protection and recovery functions\n\nPart 2 Identity protection and recovery functions","sortOrder":9},{"sectionNumber":"9","sectionType":"section","heading":"Functions of Secretary","content":"#### 9 Functions of Secretary\n\n9 Functions of Secretary\n\n> > (1) The Secretary has the following functions (identity protection functions)—\n> > \n> > > (a) identity protection and recovery functions,\n> > \n> > > (b) identity fraud control functions,\n> > \n> > > (c) another function specified to be an identity protection function by this Act or another Act.\n> \n> > (2) The Secretary must not exercise an identity protection function unless—\n> > \n> > > (a) in accordance with this Act, and\n> > \n> > > (b) consistent with the objects of this Act.","sortOrder":10},{"sectionNumber":"10","sectionType":"section","heading":"Identity protection and recovery functions","content":"#### 10 Identity protection and recovery functions\n\n10 Identity protection and recovery functions\n\n> The identity protection and recovery functions are as follows—\n> \n> > (a) to advise on and recommend actions—\n> > \n> > > (i) to detect, prevent and mitigate the likelihood of personal data compromises, and\n> > \n> > > (ii) to mitigate the risk of harm to individuals and impacted individuals in relation to personal data compromises,\n> \n> > (b) to increase resilience and protection of persons from personal data compromises, including by advising on the appropriate kind and use of information technology,\n> \n> > (c) in response to a personal data compromise—\n> > \n> > > (i) to advise on and recommend actions to take, including to replace or reissue identity documents and other actions to protect and recover personal information, and\n> > \n> > > (ii) to advise on and assess the risk of harm to impacted individuals, and\n> > \n> > > (iii) to notify and disclose information to impacted individuals and other persons, including to assist persons in notifying impacted individuals,\n> \n> > (d) other functions prescribed by the regulations.","sortOrder":11},{"sectionNumber":"11","sectionType":"section","heading":"Identity fraud control functions","content":"#### 11 Identity fraud control functions\n\n11 Identity fraud control functions\n\n> The identity fraud control functions are as follows—\n> \n> > (a) to advise on and recommend actions for the detection, prevention and mitigation of the likelihood of identity fraud,\n> \n> > (b) to establish and keep the compromised ID register,\n> \n> > (c) to disclose information on the compromised ID register to certain persons,\n> \n> > (d) to determine and disclose information about the life status of individuals to certain persons,\n> \n> > (e) other functions prescribed by the regulations.","sortOrder":12},{"sectionNumber":"12","sectionType":"section","heading":"Exercise of functions","content":"#### 12 Exercise of functions\n\n12 Exercise of functions\n\n> The Secretary must not exercise an identity protection function unless the exercise of the function is—\n> \n> > (a) at the request of the following—\n> > \n> > > (i) a person who the Secretary is satisfied is, or may be, affected by a personal data compromise,\n> > \n> > > (ii) a law enforcement agency,\n> > \n> > > (iii) a fraud check user, or\n> \n> > (b) in response to the following—\n> > \n> > > (i) a personal data compromise for which the source of the personal data cannot reasonably be determined,\n> > \n> > > (ii) compromised personal data made available on the internet, whether on the clear or dark web, or\n> \n> > (c) to establish, keep and disclose information on and in relation to the compromised ID register, or\n> \n> > (d) to determine and disclose information about the life status of an individual, or\n> \n> > (e) to advise on and recommend actions for the detection, prevention and mitigation of the likelihood of personal data compromises, or\n> \n> > (f) in other circumstances prescribed by the regulations.","sortOrder":13},{"sectionNumber":"13","sectionType":"section","heading":"Coordination with privacy and other similar authorities","content":"#### 13 Coordination with privacy and other similar authorities\n\n13 Coordination with privacy and other similar authorities\n\n> > (1) The Secretary may exercise an identity protection function to coordinate with the following authorities (partner authorities) in response to a personal data compromise—\n> > \n> > > (a) the Privacy Commissioner,\n> > \n> > > (b) an authority with functions to protect the privacy of individuals under an Act or law of another jurisdiction within Australia,\n> > \n> > > (c) an authority of another jurisdiction within Australia with functions that are the same as or similar to the identity protection functions,\n> > \n> > > (d) an authority of the Commonwealth, prescribed by the regulations, with functions under an Act of the Commonwealth to manage cyber security incidents.\n> \n> > (2) The Secretary, in exercising an identity protection function, must act consistently with guidance and advice given by the following in relation to a notifiable data breach—\n> > \n> > > (a) the Privacy Commissioner,\n> > \n> > > (b) an authority, prescribed by the regulations, with functions under an Act of the Commonwealth to protect the privacy of individuals.\n> \n> > (3) The Secretary must not act for or on behalf of a person for the purpose of discharging the person’s duties in relation to a notifiable data breach.\n> \n> > (4) In this section—\n> > \n> > notifiable data breach means a breach required to be notified under an Act or law of the State or another jurisdiction prescribed by the regulations.","sortOrder":14},{"sectionNumber":"14","sectionType":"section","heading":"Contracts for identity protection functions","content":"#### 14 Contracts for identity protection functions\n\n14 Contracts for identity protection functions\n\n> > (1) The Secretary may make and enter into contracts or other agreements in connection with the exercise of an identity protection function.\n> \n> > (2) The regulations may provide for the form and content of the contracts or agreements.","sortOrder":15},{"sectionNumber":"15","sectionType":"section","heading":"Functions outside New South Wales","content":"#### 15 Functions outside New South Wales\n\n15 Functions outside New South Wales\n\n> The Secretary may exercise an identity protection function for or in relation to—\n> \n> > (a) a person who resides or is located within another State or Territory, or\n> \n> > (b) a department or agency of the Commonwealth or another State or Territory.","sortOrder":16},{"sectionNumber":"16","sectionType":"section","heading":"Fees","content":"#### 16 Fees\n\n16 Fees\n\n> > (1) The Secretary may charge fees under this Act or the regulations for or in relation to the exercise of a function under this Act or the regulations, including for—\n> > \n> > > (a) an approval or other permission, or\n> > \n> > > (b) late payment of fees.\n> \n> > (2) A fee or other charge payable to the Secretary may be recovered by the Secretary as a debt in a court of competent jurisdiction.\n> \n> > (3) The regulations may—\n> > \n> > > (a) prescribe the fees or the way in which the fees may be calculated, and\n> > \n> > > (b) provide for the exemption from or waiver or refund of fees under this Act or in relation to this Act, and\n> > \n> > > (c) provide for payment of a deposit or prepayment in relation to a fee.","sortOrder":17},{"sectionNumber":"17","sectionType":"section","heading":"Delegation","content":"#### 17 Delegation\n\n17 Delegation\n\n> The Secretary may delegate the exercise of a function of the Secretary under this Act, other than this power of delegation, to a member of staff of the Department.","sortOrder":18},{"sectionNumber":"Part 3","sectionType":"part","heading":"Identity fraud control","content":"# Part 3 Identity fraud control\n\nPart 3 Identity fraud control","sortOrder":19},{"sectionNumber":"Division 1","sectionType":"division","heading":"Compromised ID register","content":"## Division 1 Compromised ID register\n\nDivision 1 Compromised ID register","sortOrder":20},{"sectionNumber":"18","sectionType":"section","heading":"Secretary to keep register","content":"#### 18 Secretary to keep register\n\n18 Secretary to keep register\n\n> The Secretary must keep a register (the compromised ID register) for compromised identity documents in a way prescribed by the regulations.","sortOrder":21},{"sectionNumber":"19","sectionType":"section","heading":"Secretary to record compromised identity documents","content":"#### 19 Secretary to record compromised identity documents\n\n19 Secretary to record compromised identity documents\n\n> The Secretary may record an identity document in the compromised ID register if, in the Secretary’s opinion, the identity document has or may have been compromised.","sortOrder":22},{"sectionNumber":"20","sectionType":"section","heading":"Removal of records from register at request","content":"#### 20 Removal of records from register at request\n\n20 Removal of records from register at request\n\n> > (1) The Secretary must remove records about an individual from the compromised ID register if—\n> > \n> > > (a) requested by the individual in the approved way, and\n> > \n> > > (b) the Secretary is satisfied the request is for a purpose prescribed by the regulations.\n> \n> > (2) The Secretary may remove records about an individual from the compromised ID register if—\n> > \n> > > (a) requested by the issuer of an identity document or member of the NSW Police Force, and\n> > \n> > > (b) the Secretary is satisfied the request is for a purpose prescribed by the regulations.\n> \n> > (3) This section does not limit the exercise of the Secretary’s function to remove records from the compromised ID register for the purposes of maintaining the register.","sortOrder":23},{"sectionNumber":"Division 2","sectionType":"division","heading":"Disclosure of information on register","content":"## Division 2 Disclosure of information on register\n\nDivision 2 Disclosure of information on register","sortOrder":24},{"sectionNumber":"21","sectionType":"section","heading":"Disclosure of information on register","content":"#### 21 Disclosure of information on register\n\n21 Disclosure of information on register\n\n> The Secretary must not disclose information on the compromised ID register unless provided for by this part or required by another Act or law.","sortOrder":25},{"sectionNumber":"22","sectionType":"section","heading":"Disclosure to impacted individuals","content":"#### 22 Disclosure to impacted individuals\n\n22 Disclosure to impacted individuals\n\n> > (1) The Secretary must, as soon as reasonably practicable, disclose to an individual when the individual’s identity document has been recorded on the compromised ID register.\n> \n> > (2) The Secretary may disclose information on the compromised ID register to an individual to whom the information relates at any time.","sortOrder":26},{"sectionNumber":"23","sectionType":"section","heading":"Disclosure to issuers of identity documents","content":"#### 23 Disclosure to issuers of identity documents\n\n23 Disclosure to issuers of identity documents\n\n> > (1) The Secretary must, as soon as reasonably practicable, disclose to the issuer of an identity document when the identity document is recorded on the compromised ID register.\n> \n> > (2) The Secretary must make the disclosure to the issuer by written notice.\n> \n> > (3) The Secretary may—\n> > \n> > > (a) give the issuer information that the Secretary considers relevant to the disclosure, and\n> > \n> > > (b) recommend the issuer take certain steps in response to the identity document being recorded on the register.\n> \n> > (4) The Secretary may disclose to the issuer when the identity document is removed from the compromised ID register.","sortOrder":27},{"sectionNumber":"Division 3","sectionType":"division","heading":"Identity fraud checks","content":"## Division 3 Identity fraud checks\n\nDivision 3 Identity fraud checks","sortOrder":28},{"sectionNumber":"24","sectionType":"section","heading":"Definition","content":"#### 24 Definition\n\n24 Definition\n\n> In this division—\n> \n> relevant purpose, in relation to a life status check—see section 27.","sortOrder":29},{"sectionNumber":"25","sectionType":"section","heading":"Fraud check users","content":"#### 25 Fraud check users\n\n25 Fraud check users\n\n> > (1) A person who wishes to be eligible to request one or both of the following disclosures may apply to the Secretary for eligibility—\n> > \n> > > (a) the disclosure of information about whether an identity document is on the compromised ID register under section 26,\n> > \n> > > (b) the disclosure of information to verify the life status of an individual under section 28.\n> \n> > (2) The application must be—\n> > \n> > > (a) made in the approved way, and\n> > \n> > > (b) accompanied by the fee prescribed by the regulations, if any.\n> \n> > (3) The Secretary may, by written notice to the applicant—\n> > \n> > > (a) approve the application with or without conditions, or\n> > \n> > > (b) refuse the application.\n> \n> > (4) The Secretary must not grant the approval unless the Secretary is satisfied the person meets the criteria prescribed by the regulations.\n> \n> > (5) The Secretary may, by written notice to the approval holder, cancel or suspend the approval with or without conditions.\n> \n> > (6) The regulations may—\n> > \n> > > (a) make further provision about an approval, including the grant of an approval, under this section, or\n> > \n> > > (b) prescribe persons or classes of persons who may be taken to hold an approval under this section.","sortOrder":30},{"sectionNumber":"26","sectionType":"section","heading":"Compromised ID register checks","content":"#### 26 Compromised ID register checks\n\n26 Compromised ID register checks\n\n> > (1) An eligible fraud check user may apply to the Secretary for a disclosure of information about whether an identity document is recorded on the compromised ID register.\n> \n> > (2) The application must be—\n> > \n> > > (a) made in the approved way, and\n> > \n> > > (b) accompanied by the prescribed fee, if any.\n> \n> > (3) After receiving the application, the Secretary may disclose, or refuse to disclose, the information to the fraud check user.\n> \n> > (4) Despite subsection (3), the Secretary must not disclose the information to the fraud check user unless the Secretary is reasonably satisfied that—\n> > \n> > > (a) the individual whose identity document or purported identity document is the subject of the disclosure has consented to the disclosure, and\n> > \n> > > (b) the fraud check user will only use the information for one or more of the following purposes—\n> > > \n> > > > (i) to reduce the risk of fraudulent use of the individual’s identity, or\n> > > \n> > > > (ii) another purpose prescribed by the regulations.\n> \n> > (5) Despite subsections (3) and (4), the Secretary—\n> > \n> > > (a) must not disclose the information to the fraud check user in circumstances prescribed by the regulations, and\n> > \n> > > (b) must only disclose information of a kind prescribed by the regulations.","sortOrder":31},{"sectionNumber":"27","sectionType":"section","heading":"Relevant purpose for life status checks","content":"#### 27 Relevant purpose for life status checks\n\n27 Relevant purpose for life status checks\n\n> The Secretary must not use information about, or determine, the life status of an individual unless for one or more of the following purposes (a relevant purpose)—\n> \n> > (a) for an individual whose personal information has or may have been compromised—\n> > \n> > > (i) to assess the risk of harm to the individual or another person caused by the compromise, or\n> > \n> > > (ii) to identify and notify the individual in relation to the compromise,\n> \n> > (b) to reduce the risk of fraudulent use of the individual’s identity if the individual is deceased.","sortOrder":32},{"sectionNumber":"28","sectionType":"section","heading":"Life status checks for fraud check users","content":"#### 28 Life status checks for fraud check users\n\n28 Life status checks for fraud check users\n\n> > (1) An eligible fraud check user may apply to the Secretary for a disclosure of information about the life status of an individual.\n> \n> > (2) The application must be—\n> > \n> > > (a) made in the approved way, and\n> > \n> > > (b) accompanied by the prescribed fee, if any.\n> \n> > (3) After receiving the application, the Secretary may disclose, or refuse to disclose, the information to the fraud check user.\n> \n> > (4) Despite subsection (3), the Secretary—\n> > \n> > > (a) must not disclose the information unless the Secretary is satisfied the fraud check user will only use the information for a relevant purpose, and\n> > \n> > > (b) must only disclose information of a kind prescribed by the regulations.","sortOrder":33},{"sectionNumber":"Part 4","sectionType":"part","heading":"Exemptions from privacy and other laws","content":"# Part 4 Exemptions from privacy and other laws\n\nPart 4 Exemptions from privacy and other laws","sortOrder":34},{"sectionNumber":"29","sectionType":"section","heading":"Definition","content":"#### 29 Definition\n\n29 Definition\n\n> In this part—\n> \n> public sector agency has the same meaning as in the [Privacy and Personal Information Protection Act 1998](/view/html/inforce/current/act-1998-133).","sortOrder":36},{"sectionNumber":"30","sectionType":"section","heading":"Application of division","content":"#### 30 Application of division\n\n30 Application of division\n\n> > (1) This division has effect despite any Act or law, including the following—\n> > \n> > > (a) the [Privacy and Personal Information Protection Act 1998](/view/html/inforce/current/act-1998-133), sections 9–11 and 15–19,\n> > \n> > > (b) the [Health Records and Information Privacy Act 2002](/view/html/inforce/current/act-2002-071), Schedule 1, clauses 1–4 and 6–11.\n> \n> > (2) This division does not limit the application of section 33.","sortOrder":38},{"sectionNumber":"31","sectionType":"section","heading":"Collection, holding, use and disclosure of personal information for identity protection functions","content":"#### 31 Collection, holding, use and disclosure of personal information for identity protection functions\n\n31 Collection, holding, use and disclosure of personal information for identity protection functions\n\n> > (1) The Secretary may collect, hold, use and disclose personal information when exercising an identity protection function.\n> \n> > (2) A partner authority may collect, hold, use or disclose personal information to coordinate with the Secretary in response to a personal data compromise.\n> \n> > (3) A public sector agency may collect, hold, use or disclose personal information—\n> > \n> > > (a) for the purpose of the public sector agency requesting the Secretary to exercise an identity protection function, or\n> > \n> > > (b) for the purpose of the Secretary exercising an identity protection function, or\n> > \n> > > (c) for another reason in connection with the Secretary exercising an identity protection function.\n> \n> > (4) Without limiting subsections (1)–(3), a person may disclose personal information to the Secretary for the purpose of the Secretary exercising an identity protection function.","sortOrder":39},{"sectionNumber":"32","sectionType":"section","heading":"Unlawful conduct not exempt","content":"#### 32 Unlawful conduct not exempt\n\n32 Unlawful conduct not exempt\n\n> > (1) This division does not apply to a person if the person engages in unlawful conduct when collecting, holding, using or disclosing personal information in connection with the exercise of an identity protection function.\n> \n> > (2) Without limiting subsection (1), this division does not apply to a person who—\n> > \n> > > (a) is party to a contract or agreement with the Secretary that relates to the exercise of an identity protection function, and\n> > \n> > > (b) breaches a specified provision of the contract or agreement when collecting, holding, using or disclosing personal information in connection to the exercise of the identity protection function.\n> \n> > (3) Subsection (2) does not have effect unless, before the breach, the Secretary has given written notice to the person specifying a provision or provisions for the purpose of subsection (2)(b).","sortOrder":40},{"sectionNumber":"33","sectionType":"section","heading":"Exclusion of liability for disclosures otherwise prohibited","content":"#### 33 Exclusion of liability for disclosures otherwise prohibited\n\n33 Exclusion of liability for disclosures otherwise prohibited\n\n> > (1) The disclosure of information between the following persons is a protected disclosure if the disclosure is for the exercise of an identity protection function—\n> > \n> > > (a) a public sector agency and the Secretary,\n> > \n> > > (b) a law enforcement agency and the Secretary,\n> > \n> > > (c) another person and the Secretary.\n> \n> > (2) The following applies to a person referred to in subsection (1) who makes or is involved in a protected disclosure—\n> > \n> > > (a) the person does not incur civil liability, including liability—\n> > > \n> > > > (i) for an action for defamation, or\n> > > \n> > > > (ii) for breaching a duty of secrecy or confidentiality, or\n> > > \n> > > > (iii) for breaching another restriction on disclosure applicable to the person, whether or not imposed by this Act or another law, and\n> > \n> > > (b) the person does not incur criminal liability, including liability for breaching—\n> > > \n> > > > (i) a law or code of conduct imposing a duty of secrecy or confidentiality, or\n> > > \n> > > > (ii) another restriction in relation to the disclosure of information, and\n> > \n> > > (c) the person is not liable to disciplinary action.\n> \n> > (3) Subsection (2) does not apply to a person if the liability arises in relation to the person—\n> > \n> > > (a) contravening a provision of this Act, or\n> > \n> > > (b) breaching a contract or agreement that relates to the exercise of an identity protection function to which the Secretary is a party.","sortOrder":42},{"sectionNumber":"Part 5","sectionType":"part","heading":"Identity Protection and Recovery Fund","content":"# Part 5 Identity Protection and Recovery Fund\n\nPart 5 Identity Protection and Recovery Fund","sortOrder":43},{"sectionNumber":"34","sectionType":"section","heading":"Establishment of Fund","content":"#### 34 Establishment of Fund\n\n34 Establishment of Fund\n\n> > (1) A fund is established in the Special Deposits Account called the Identity Protection and Recovery Fund (the Fund).\n> \n> > (2) The Fund is administered by the Secretary.","sortOrder":44},{"sectionNumber":"35","sectionType":"section","heading":"Payments into Fund","content":"#### 35 Payments into Fund\n\n35 Payments into Fund\n\n> The following must be paid into the Fund—\n> \n> > (a) money appropriated by Parliament for the Fund,\n> \n> > (b) money authorised by the Treasurer for the Fund,\n> \n> > (c) money directed or authorised to be paid into the Fund under this Act or another Act or law,\n> \n> > (d) money paid to the Secretary under a contract or agreement in connection with an identity protection function,\n> \n> > (e) fees or other charges payable to the Secretary under this Act,\n> \n> > (f) the proceeds of the investment of money in the Fund.","sortOrder":45},{"sectionNumber":"36","sectionType":"section","heading":"Payments out of Fund","content":"#### 36 Payments out of Fund\n\n36 Payments out of Fund\n\n> Money may be paid out of the Fund—\n> \n> > (a) to meet expenses for the Secretary’s functions under this Act,\n> \n> > (b) to meet expenses in relation to the administration of the Fund and this Act,\n> \n> > (c) to meet expenses incurred by a NSW Government agency in assisting the Secretary in the exercise of an identity protection function,\n> \n> > (d) for payments authorised or required under another Act or law consistent with the objects of this Act.","sortOrder":46},{"sectionNumber":"Part 6","sectionType":"part","heading":"Miscellaneous","content":"# Part 6 Miscellaneous\n\nPart 6 Miscellaneous","sortOrder":47},{"sectionNumber":"37","sectionType":"section","heading":"Personal liability","content":"#### 37 Personal liability\n\n37 Personal liability\n\n> > (1) A protected person is not personally subject to liability for anything done—\n> > \n> > > (a) in good faith, and\n> > \n> > > (b) for the purpose of exercising a function under this Act.\n> \n> > (2) The liability instead attaches to the Crown.\n> \n> > (3) In this section—\n> > \n> > done includes omitted to be done.\n> > \n> > liability means civil liability and includes action, claim or demand.\n> > \n> > protected person means the following—\n> > \n> > > (a) the Minister,\n> > \n> > > (b) the Secretary,\n> > \n> > > (c) a person acting under the direction of the following—\n> > > \n> > > > (i) the Minister,\n> > > \n> > > > (ii) the Secretary,\n> > > \n> > > > (iii) a NSW Government agency or statutory body representing the Crown.","sortOrder":48},{"sectionNumber":"38","sectionType":"section","heading":"Regulations","content":"#### 38 Regulations\n\n38 Regulations\n\n> > (1) The Governor may make regulations about a matter that is—\n> > \n> > > (a) required or permitted by this Act to be prescribed, or\n> > \n> > > (b) necessary or convenient to be prescribed for carrying out or giving effect to this Act.\n> \n> > (2) The regulations may apply, adopt or incorporate, wholly or in part and with or without modification, a publication in force at a particular time or from time to time.\n> \n> > (3) The Minister must consult with the Privacy Commissioner on regulations proposed to be made under the following sections before the regulations are recommended to the Governor—\n> > \n> > > (a) section 10,\n> > \n> > > (b) section 11,\n> > \n> > > (c) section 26(5)(b),\n> > \n> > > (d) section 28(4)(b).","sortOrder":49},{"sectionNumber":"39","sectionType":"section","heading":"Review of Act","content":"#### 39 Review of Act\n\n39 Review of Act\n\n> > (1) The Minister must review the operation of this Act to determine whether—\n> > \n> > > (a) the policy objectives of the Act remain valid, and\n> > \n> > > (b) the terms of the Act remain appropriate for achieving the policy objectives.\n> \n> > (2) The review must be undertaken as soon as practicable after the period of 2 years from the commencement of this Act.","sortOrder":50},{"sectionNumber":"Schedule 1","sectionType":"schedule","heading":"Identity documents","content":"# Schedule 1 Identity documents\n\nSchedule 1 Identity documents\n\nsection 6(1)(a)\n\n| 1 | a birth certificate issued by or on behalf of an authority of the State or another State or Territory |\n| 2 | a death certificate issued by or on behalf of an authority of the State or another State or Territory |\n| 3 | a concession card within the meaning of the Social Security Act 1991 of the Commonwealth |\n| 4 | a notice given under the Australian Citizenship Act 2007 of the Commonwealth, section 37, stating that a person is an Australian citizen at a particular time |\n| 5 | a certificate issued by an authority of the State or another State or Territory indicating that an individual has changed the individual’s name |\n| 6 | a driver licence, however described, issued by or on behalf of an authority of the State or another State or Territory |\n| 7 | a document issued by or on behalf of an authority of the State or another State or Territory to assist an individual to prove the individual’s age or identity |\n| 8 | a document issued to an individual, as a person who is not an Australian citizen, by an authority of the Commonwealth in which the Migration Act 1958 of the Commonwealth is administered to assist the individual to prove the individual’s identity |\n| 9 | a certificate of marriage issued by or on behalf of an authority of the State or another State or Territory whose function is to register marriages |\n| 10 | a document issued by a court setting out a divorce order made under the Family Law Act 1975 of the Commonwealth |\n| 11 | an Australian travel document within the meaning of the Australian Passports Act 2005 of the Commonwealth |\n| 12 | a certificate signed by an officer within the meaning of the Migration Act 1958 of the Commonwealth stating that, at a specified time or during a specified period, a specified person was the holder of a visa that was in effect |\n| 13 | an entry in a Roll within the meaning of the Commonwealth Electoral Act 1918 of the Commonwealth relating to a particular individual |\n| 14 | an aviation security identification card issued under the Aviation Transport Security Act 2004 of the Commonwealth |\n| 15 | an MSIC issued under the Maritime Transport and Offshore Facilities Security Act 2003 of the Commonwealth |\n| 16 | a medicare card within the meaning of the National Health Act 1953 of the Commonwealth, section 84(1) |","sortOrder":51},{"sectionNumber":"Schedule 2","sectionType":"schedule","heading":"Savings, transitional and other provisions","content":"# Schedule 2 Savings, transitional and other provisions\n\nSchedule 2 Savings, transitional and other provisions","sortOrder":52},{"sectionNumber":"Schedule 3","sectionType":"schedule","heading":null,"content":"# Schedule 3\n\nSchedule 3 (Repealed)\n\n**sch 3:** Rep 1987 No 15, sec 30C.","sortOrder":54},{"sectionNumber":"Schedule 4","sectionType":"schedule","heading":"Dictionary","content":"# Schedule 4 Dictionary\n\nSchedule 4 Dictionary\n\nsection 4\n\napproved way means in a way approved by the Secretary.\n\ncompromised, in relation to personal information—see section 5.\n\ncompromised ID register—section 18.\n\nDepartment means the Department of Customer Service.\n\nexercise, a function, includes perform a duty.\n\nfraud check user means a person approved under section 25.\n\nfunction includes a power, authority or duty.\n\nFund—see section 34(1).\n\nidentity document—see section 6.\n\nidentity fraud control functions—see section 11.\n\nidentity protection and recovery functions—see section 10.\n\nidentity protection functions—see section 9(1).\n\nimpacted individual means an individual whose personal information is the subject of a personal data compromise.\n\nlaw enforcement agency means—\n\n> (a) a law enforcement agency within the meaning of the [Privacy and Personal Information Protection Act 1998](/view/html/inforce/current/act-1998-133), or\n\n> (b) another person or body prescribed by the regulations.\n\nlife status means whether a person is alive or dead.\n\npartner authorities—see section 13(1).\n\npersonal data compromise—see section 7.\n\npersonal information includes—\n\n> (a) personal information within the meaning of the [Privacy and Personal Information Protection Act 1998](/view/html/inforce/current/act-1998-133), and\n\n> (b) health information within the meaning of the [Health Records and Information Privacy Act 2002](/view/html/inforce/current/act-2002-071), and\n\n> (c) an identity document.\n\npublic sector agency, for Part 4—see section 29.\n\nrelevant purpose, for Part 3, Division 3—see section 24.\n\nSecretary means the Secretary of the Department.","sortOrder":55}],"analysis":{"issue_detection":{"absurdities":[],"contradictions":[]},"kimi_summary":{"content_quality":"ok","complexity_score":5,"scope_assessment":{"changed":false,"description":"The legislation appears consistent with its stated objects in section 3. It establishes a comprehensive identity protection and recovery framework including the compromised ID register, fraud check systems, and privacy exemptions — all directly tied to the original purpose of protecting individuals and organisations from personal data compromises. No significant scope creep is evident; the mechanisms (register, life status checks, fund, coordination with privacy authorities) are all reasonably ancillary to the core identity protection mission."},"complexity_factors":["Moderate length (39 sections plus 4 schedules) with substantial delegated legislation references","18 defined terms in Schedule 4 dictionary, plus 5 section-specific definitions (sections 5, 6, 7, 24, 29)","Multiple cross-references to other NSW and Commonwealth legislation (Privacy and Personal Information Protection Act 1998, Health Records and Information Privacy Act 2002, Identity Verification Services Act 2023, Commonwealth Social Security Act 1991, etc.)","Conditional logic with nested exceptions: section 26 has 'despite' subsections creating layered prohibitions on disclosure (subsections 3, 4, and 5 interact complexly)","Extensive regulation-making powers (at least 10 sections delegate details to regulations including fees, approval criteria, document types, and operational procedures)","Protected disclosure scheme in Part 4 with specific liability exclusions and carve-outs (section 33)","Functional overlap between 'identity protection functions', 'identity protection and recovery functions', and 'identity fraud control functions' requiring careful parsing"],"plain_english_summary":"**What this law does:**\n\nThis Act creates a new government service in New South Wales to help people and organisations when personal information gets stolen, leaked, or lost in data breaches. It establishes a \"one-stop shop\" for identity protection and recovery.\n\n**Key things it sets up:**\n\n*   **The Secretary's role:** The head of the Department of Customer Service gets new powers to help victims of data breaches (called \"personal data compromises\"). This includes advising on how to protect yourself, helping replace stolen identity documents (like driver licences or Medicare cards), and assessing the risk of harm to affected people.\n\n*   **The Compromised ID Register:** A new register that records when identity documents (like passports, birth certificates, or driver licences) have been stolen or exposed in a breach. The Secretary must tell you if your document ends up on this register.\n\n*   **Fraud check system:** Approved businesses and organisations (called \"fraud check users\") can apply to check if an identity document has been compromised, or to verify if someone is alive or deceased — but only with consent and for specific anti-fraud purposes.\n\n*   **Privacy exemptions:** The Act overrides normal privacy laws to allow the Secretary, government agencies, and law enforcement to share personal information when dealing with data breaches. People who share information properly are protected from being sued or prosecuted.\n\n*   **Funding:** Creates a dedicated fund to pay for these identity protection services.\n\n**Who it affects:**\n\n*   **Individuals:** Anyone whose personal information is exposed in a data breach can ask for help. You can also request removal of your records from the compromised ID register in certain circumstances.\n*   **Organisations:** Businesses and government agencies can request assistance when they suffer data breaches. Approved organisations can also access the fraud check system.\n*   **Government agencies:** NSW government bodies, law enforcement, and privacy regulators must coordinate with the Secretary during breaches.\n\n**Why it matters:**\n\nData breaches are increasingly common and can lead to identity theft and financial fraud. This Act creates a central authority to help people recover when their identity documents are compromised, and gives businesses tools to verify identities while preventing fraud — particularly using the \"life status\" check to stop criminals using dead people's identities."},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"summary":{"complexity_score":2,"scope_assessment":{"changed":false,"description":"Insufficient legislative content was provided to assess whether the Act's scope changed from its original intent. The document supplied contains only website navigation elements, status metadata, and administrative information — no substantive provisions, explanatory memoranda, or objects clauses are present to enable a meaningful scope comparison."},"complexity_factors":["The document provided contains virtually no substantive legislative text — only website navigation and metadata — making complexity assessment of the actual law impossible","The title suggests the Act may involve cross-agency coordination (identity recovery typically involves multiple departments), which would add complexity if the provisions were available","Identity-related legislation often interacts with Commonwealth privacy law (Privacy Act 1988) and criminal law, which can create layered complexity","Score of 2 reflects the near-total absence of analysable content, not a finding that the underlying law is simple"],"plain_english_summary":"The Identity Protection and Recovery Act 2025 (NSW) sets out a framework to protect personal identity information and to provide mechanisms for victims to recover from identity theft or fraud. It is administered by the Minister for Customer Service and Digital Government and commenced on 16 August 2025.\n\nIt potentially affects individuals whose identities are misused, businesses that hold personal data, and government agencies involved in identity verification; consult the full Act for precise rights and obligations."},"flash_summary":{"complexity_score":6,"scope_assessment":{"changed":false,"description":"The Act's operational scope aligns with its stated objects to enable protection and recovery of personal information (s 3). It both creates proactive functions (advice, remediation, register) and authorises data collection and disclosure for those functions (s 10; s 31). Notably, it expands operational powers by disapplying specified privacy provisions (s 30) and enabling interjurisdictional action (s 15), but these measures are within the Act’s declared purpose rather than altering that purpose."},"complexity_factors":["Broad discretionary powers vested in the Secretary to record, disclose and remove register entries (secs 19, 22–23) create case-by-case decision points.","Multiple permissions and approvals rely on unspecified regulatory criteria and the undefined \"approved way\", increasing reliance on delegated rule‑making (secs 25–26; Schedule 4).","The Act expressly overrides parts of existing privacy laws for identity protection functions, producing potential conflicts and interpretation questions (sec 30; sec 31).","Sensitive life‑status disclosures and constrained purposes require fact‑sensitive satisfaction by the Secretary (secs 27–28), raising compliance and evidentiary burdens.","Protected‑disclosure immunity and Crown assumption of liability shift legal risk and may affect incentives for private contractors and agencies (secs 33, 37).","Regulations can prescribe many operational details, fees, exemptions and classes of users, so practical scope depends heavily on future regulations (sec 38).","Cross‑jurisdictional operation and coordination with other authorities introduce coordination and information‑sharing complexity (secs 13, 15)."],"plain_english_summary":"This Act creates a Secretary‑led identity protection regime that can collect, hold, use and disclose personal information to detect, respond to and remediate personal data compromises. It establishes a compromised ID register, allows approved \"fraud check users\" limited access, sets up an Identity Protection and Recovery Fund and permits fees. It affects individuals whose identity documents are compromised, issuers and verifiers of identity documents, public sector agencies and private parties seeking fraud checks. It matters because it changes who may share and access sensitive identity data and when privacy laws do not apply."}},"importantCases":[],"_links":{"self":"/api/acts/identity-protection-and-recovery-act-2025","history":"/api/acts/identity-protection-and-recovery-act-2025/history","analysis":"/api/acts/identity-protection-and-recovery-act-2025/analysis","conflicts":"/api/acts/identity-protection-and-recovery-act-2025/conflicts","importantCases":"/api/acts/identity-protection-and-recovery-act-2025/important-cases","documents":"/api/acts/identity-protection-and-recovery-act-2025/documents"}}