Australian Prudential Regulation Authority (confidentiality) determination No.12 of 2015

The determination operates within APRA’s statutory confidentiality/disclosure architecture. Four core legal-conceptual elements structure the instrument.

1. Delegated determination power and scope

   • The instrument is made by “Ian Laughlin, delegate of APRA” under s57 of the APRA Act and in reliance on the Acts Interpretation Act 1901, s33(3). The instrument therefore exercises delegated statutory power to declare the confidentiality status of particular reporting information (paragraph 57(2)(b) is cited). The instrument is an administrative, prospective determination about confidentiality status, not a legislative amendment to reporting standards.

2. “Does not contain confidential information”

   • The operative legal change is to declare that specified reporting documents, or parts of them, “does not and do not contain confidential information”. That phrase is the legal trigger that permits APRA to treat the specified material as non-confidential under APRA’s disclosure powers (the Note links this to s56(5C)). The instrument does not restate the statutory definition of confidential information; rather it designates the particular material as falling outside confidentiality protection.

3. Temporal trigger (14 days)

   • The determination applies only after a 14-day period has elapsed from the date the information was required to be provided under Reporting Standard LRS 001, paragraph 5. The 14-day window is a built-in delay between the date the reporting obligation arises and the time at which APRA may regard the reported items as non-confidential for publication purposes. The instrument therefore creates a timing rule that governs when the non-confidential status bites.

4. Scope by document and by field

   • The Schedule sets the substantive scope. Part 1 lists Reporting Standards (LRS 112.0, LRS 114.2, LRS 114.3, LRS 300.0, LRS 310.0, LRS 340.0 effective 1 January 2013) and a broad set of superseded Reporting Standards from earlier periods (2008-2009 and 2009-2012), indicating those reporting forms are covered. Part 2 specifies particular LRF reporting forms and, for each form, whether all data items are non-confidential or only certain totals or sections (for example, LRF 110.1 Section 1 items (i)-(ix) and Section 2: “all data items”; LRF 112.3 items (i)-(vii) as “total amount only”; many LRFs are marked “all data items”). The instrument therefore distinguishes between aggregate-level disclosure (total amounts) and granular disclosure (all data items), depending on the form and line item.

Relationship to other statutory instruments and statutes

• The instrument explicitly interacts with the Financial Sector (Collection of Data) Act 2001 by using the statutory term “reporting document” as defined in section 13 of that Act. It also references the Privacy Act 1988 to exclude personal information from the non-confidential category. The mechanism for publication is subsection 56(5C) of the APRA Act, which the instrument cites in its Note as the statutory publication power.

Incentives and informational design

• The instrument creates a clear disclosure incentive for APRA to publish selected prudential data about life insurers and friendly societies after a short lag. On the information-provider side, life insurers and friendly societies remain required to provide the underlying data under their reporting obligations (the instrument does not alter reporting obligations), but they face a changed confidentiality landscape that affects the afterlife of submitted data. The Schedule’s mix of “all data items” and “total amount only” shows APRA calibrating disclosure granularities: some aggregate figures are singled out for possible publication, while other items remain protected by omission from the Schedule.

Boundaries and exclusions

• The instrument does not deal with personal information, which is explicitly excluded from the non-confidential class by reference to the Privacy Act 1988. The instrument also does not itself publish anything nor prescribe APRA’s use of subsection 56(5C) , it only declares the confidentiality status. Practically, that leaves APRA discretion as to whether and how to publish. The statutory operation is therefore two-stage: the determination changes confidentiality status; publication remains subject to APRA’s separate statutory provisions and administrative choices.

Primary affected entities

• Life insurers and friendly societies are directly affected. The Schedule repeatedly and exclusively describes reporting forms “given to APRA by a life insurer or friendly society under” the listed Reporting Standards. Those entities provide the reporting documents that the determination addresses. The instrument does not purport to apply to other classes of APRA-regulated entities, such as ADIs or general insurers, because the Schedule is confined to life insurer/friendly society LRS/LRF reporting.

Secondary affected parties

• APRA itself is an affected decision-maker. The determination authorises APRA to treat the listed reporting items as non-confidential and therefore to publish them under s56(5C) of the APRA Act. The instrument records this enabling function. The delegate making the determination (Ian Laughlin) is explicitly identified, reflecting delegated administrative decision-making inside APRA.

• Market participants who consume APRA-published data will be affected indirectly. This includes analysts, investors, competitors, reinsurers, rating agencies, journalists and researchers, because the determination authorises APRA to disclose precise items of prudential reporting after the 14-day delay. The Schedule indicates which data elements are subject to disclosure (for example, prescribed capital amounts, asset risk charges, insurance risk charges, totals by class of business, assets backing policy liabilities and sources of profit data, sometimes at “all data items” granularity).

• Individuals whose personal information appears in reporting forms have an express exclusion. The Note states that non-confidential information, “other than personal information within the meaning of the Privacy Act 1988,” may be published. Therefore personally identifiable information is carved out and remains within the protection of the Privacy Act, not declared non-confidential by this instrument.

Who pays and who decides

• The reporting cost (preparing and submitting the reporting forms) is borne by life insurers and friendly societies under their existing reporting obligations (the instrument assumes those obligations exist under the Financial Sector (Collection of Data) Act 2001 and the LRS reporting regime). APRA, acting through its delegate, decides that the specified items are not confidential. APRA retains discretion how to publish under s56(5C); the instrument does not force APRA to publish any particular item, only removes confidentiality protection.

Behavioural changes likely to follow

• Reporting entities may recalibrate internal confidentiality practices, contracts with third parties, and public communications, because certain reported items are potentially publishable. Where the Schedule exposes granular data (for example, where a field is marked “all data items”), insurers will face a higher likelihood of competitive or market disclosure than where only totals are exposed. The 14-day waiting period creates a short time window during which the data is still confidential, so entities might adjust timing of internal reports or market communications to reflect the post-14-day status.

Geographic and temporal limits

• The determination applies to reporting forms given to APRA where the reporting standards listed were in force for particular periods (the Schedule differentiates current standards effective from 1 January 2013 and earlier superseded standards effective 2008-2009 and 2009-2012). Practitioners need to map a specific report to the appropriate standard and reporting period to determine whether the instrument’s non-confidential declaration applies.

What the determination imposes and what it changes

• The determination itself does not create new reporting duties. It alters the confidentiality classification of specified reporting documents and parts. The primary legal effect is to strip confidentiality from those specified items so APRA may publish them under its publication power (s56(5C)). In operational terms, the right-to-publish accrues to APRA, while the reporting entities lose the ability to treat the specified items as confidential vis-à-vis APRA.

Reporting duty remains unchanged

• The instrument presumes reporting duties continue under the Financial Sector (Collection of Data) Act 2001 and the relevant LRS reporting standards. The interpretation section defines “reporting document” by reference to s13 of the Financial Sector (Collection of Data) Act 2001, implying that the duty to provide those reporting documents remains governed by that Act and the reporting standards. The instrument does not displace or alter the content or frequency of those reporting standards.

APRA’s right to publish

• The Note explicitly links the determination to subsection 56(5C) of the APRA Act, stating that non-confidential information (other than personal information) may be published under that subsection. Thus APRA gains a statutory pathway to disclose the designated items. The instrument does not itself exercise that publishing power; it only removes confidentiality constraints that would otherwise block publication.

Limits and carve-outs

• Personal information remains excluded. The Note specifically says “other than personal information within the meaning of the Privacy Act 1988.” Therefore, any data in the reporting documents that is personal information remains protected by privacy law and is not within the non-confidential class declared by the determination.

• The Schedule’s granularity matters: some fields are declared non-confidential only as “total amount only” while others are declared as “all data items” or specific sections. Where an item is declared non-confidential only in an aggregate form (total amount), the right to publish does not extend, on the face of the instrument, to line-level product data for that field (unless that product-level data is separately listed in Part 2 as non-confidential). Thus the instrument itself creates different levels of disclosure rights across different fields.

Time-limited operation and practical rights

• The 14-day lapse rule means the relevant right to treat the item as non-confidential does not arise until 14 days after the date the insurer was required to provide the information under paragraph 5 of Reporting Standard LRS 001. During that initial 14-day period, the reporting material remains confidential for the purposes of the determination. After the 14 days, the right to publish the listed items crystallises, subject to the Privacy Act exclusion.

No penalties in the instrument

• The instrument does not create a sanction regime for improper assertions of confidentiality by a reporting entity. It is declaratory; it changes confidentiality classification rather than prescribing penalties. Enforcement of any statutory reporting requirement or handling of wrong disclosures would instead proceed under other provisions of the APRA Act or the Financial Sector (Collection of Data) Act, none of which are changed in this instrument.

Administrative rights

• The instrument implicitly affords APRA a procedural right: APRA may exercise its discretion to publish non-confidential data under s56(5C). It does not give third parties a private right to compel APRA to publish. The determination is an enabling step that alters APRA’s operational choices but does not itself create a right in third parties to obtain copies from APRA; whether and how APRA publishes remains an administrative decision.

Practical compliance implications for reporting entities

• From a duties-and-rights perspective, reporting entities must continue to provide required LRS/LRF reports, and they must manage confidentiality expectations internally and in contracts, recognising that some reported items are declared non-confidential and may be published by APRA after the 14-day period. They retain the right to rely on privacy protections for personal information.

Direct penalties: none in the determination

• The determination itself does not impose penalties, fines or criminal sanctions. It is an administrative determination that changes the confidentiality status of specified reporting data. It does not specify enforcement mechanisms or sanctions for breaches because its operation is to authorise APRA to publish non-confidential items; it does not prescribe penalties for failing to report or for misclassification of data by reporting entities.

Enforcement channels remain statutory and separate

• The instrument sits in APRA’s broader statutory framework. Enforcement of reporting obligations, or other compliance failures by life insurers and friendly societies, would continue to be governed by the APRA Act and the Financial Sector (Collection of Data) Act 2001 (and attendant regulations), but this determination does not itself modify those enforcement regimes. The determination refers to subsection 56(5C) as the publication power for APRA; it does not create enforcement steps for improper claims of confidentiality by reporting entities.

Administration of publication and disclosure

• The practical enforcement-related mechanism created by the instrument is administrative: once an item is declared non-confidential (after the 14-day window), APRA may, at its discretion, publish that information. The “enforcement” here is the removal of a legal barrier to publication; APRA’s discretion governs whether publication occurs. If APRA publishes material that a reporting entity regards as sensitive, the entity’s remedy would be governed by other statutory or administrative review procedures (judicial review of the delegate’s exercise of power, merits review if applicable, or complaint mechanisms), but none of those remedies are created or described in this instrument.

Possible administrative consequences for mis-handling personal information

• The determination expressly excludes personal information from the non-confidential class by reference to the Privacy Act 1988. If APRA (or a reporting entity acting in some capacity) published personal information inconsistent with the Privacy Act, that matter would raise privacy compliance and potential regulatory consequences under the Privacy Act rather than consequences created by the determination. The instrument does not itself alter privacy law or its enforcement.

Audit trail and accountability

• The instrument is publicly registered and dated (17 June 2015) and replaces a prior determination that it expressly revokes. That revocation and replacement create a clear administrative record of APRA’s approach to confidentiality for the listed items. The recording of the delegate’s name, the statutory provisions invoked (s57 and s33(3)), and the Schedule’s detail facilitate external scrutiny and, where necessary, legal challenge to the administrative exercise, but the instrument contains no separate enforcement provisions.

Practical enforcement risk for reporting entities

• The principal enforcement-related risk to reporting entities arises indirectly: because specified items may be published by APRA after the 14-day delay, entities face commercial exposure from disclosure. That exposure is not a statutory penalty but is an operational risk (market reaction, commercial competitiveness) flowing from the instrument’s effect.

Statutory cross-references made in the instrument

• APRA Act 1998: The determination is made under section 57 of the APRA Act and specifically references paragraph 57(2)(b). It links to subsection 56(5C) in the Note as the statutory mechanism under which APRA may publish non-confidential information. The instrument therefore sits within the APRA Act’s confidentiality/disclosure framework, changing which reported items are considered confidential for the purposes of APRA’s statutory disclosure powers.
• Acts Interpretation Act 1901: The instrument invokes subsection 33(3) of the Acts Interpretation Act 1901 to support the delegate’s action, likely as an interpretative or delegation mechanism. The instrument explicitly states the use of that subsection in the opening paragraph.
• Financial Sector (Collection of Data) Act 2001: The definition of “reporting document” used in the instrument is taken from section 13 of that Act. The reporting obligations that generate the reporting documents come from that Act together with Reporting Standards (the LRS series). The instrument therefore applies to documents created under the collection-of-data regime.
• Privacy Act 1988: The instrument excludes “personal information within the meaning of the Privacy Act 1988” from the class of non-confidential information. That cross-reference preserves privacy protections and ensures that even after a declaration of non-confidentiality under APRA’s regime, privacy law continues to constrain publication of personal information.

Interaction with reporting standards and reporting requirements

• The instrument specifically ties its temporal condition to paragraph 5 of Reporting Standard LRS 001 Reporting Requirements. The 14-day clock commences from the date the insurer was required to provide the information under LRS 001 paragraph 5, not necessarily from the date of actual lodgement. Practitioners must therefore read LRS 001 to know the triggering date; the determination itself does not restate LRS 001’s content.

Effect on contractual confidentiality and other private law instruments

• The instrument alters the public-law confidentiality status of the specified reporting items but does not (and cannot) extinguish private contractual promises between reporting entities and third parties. However, where a reporting entity has contractual confidentiality obligations, the public-law declaration that particular data items “does not contain confidential information” could create tension: APRA’s capacity to publish is increased, and APRA might publish data that a reporting entity would prefer kept private. The instrument does not purport to vitiate private contracts; it changes only what APRA may lawfully publish. Reporting entities will need to reconcile contractual confidentiality undertakings with the new non-confidential status for the specified items.

No express interaction with Freedom of Information or other disclosure regimes

• The instrument does not mention the Freedom of Information Act or FOI processes. It is a targeted confidentiality determination under the APRA Act. The instrument’s effect is to make certain items non-confidential for APRA’s purposes; whether that status affects FOI access, discovery processes, or other statutory disclosure channels depends on the intersection of the APRA Act and those other statutes, but those interactions are not stated in the instrument.

Boundaries created by the Schedule

• The Schedule’s fine-grained listing of LRS standards and LRF form parts creates positive legal boundaries about which data can be treated as non-confidential. That means the instrument interacts with the content of the LRS/LRF reporting standards: where the reporting standard requires certain product-level data but the determination marks that field as “total amount only” or excludes it, the instrument limits APRA’s publication competence to the scope expressed in the Schedule. Conversely, where the Schedule marks “all data items”, APRA may treat granular data as non-confidential.

This instrument’s recorded amendment and replacement activity

• The determination commences on registration and is dated 17 June 2015. It expressly revokes the Australian Prudential Regulation Authority (confidentiality) determination No. 26 of 2013. The instrument is numbered No.12 of 2015, indicating its place in APRA’s 2015 confidentiality determinations.

Replacement structure

• By revoking Determination No.26 of 2013, the instrument replaces the earlier administrative approach to confidentiality for the specified life insurer/friendly society reporting items. The instrument itself contains the operative list of reporting forms and parts that are declared non-confidential, replacing the prior list or approach in the 2013 determination.

Scope of the revision

• The Schedule covers reporting standards effective from 1 January 2013 and superseded standards from earlier periods (1 January 2008 to 30 September 2009; 1 October 2009 to 31 December 2012). That scope suggests the instrument harmonises confidentiality status across both current and earlier reporting standards for the targeted reporting classes. The instrument does not, however, indicate any subsequent amendments beyond the revocation; it stands as a single administrative instrument replacing the 2013 instrument for the listed items.

Commencement and registration

• The instrument states the determination “commences upon registration on the Federal Register of Legislative Instruments.” Its date stamp is 17 June 2015 and the delegate’s signature is recorded. There is no later amendment recorded in the text provided. Practitioners should check the FRLI entry for subsequent amendments or revocations after the date shown; the instrument itself contains no later amendment entries.

No retroactive amendment of reporting obligations

• The instrument does not purport to change past reporting obligations or to amend the content of historical reports. It declares the confidentiality status of reports given to APRA under the listed standards and within the timing condition. The instrument does not comment on whether APRA will treat data that was previously published differently; it simply declares the legal non-confidentiality going forward from its commencement for the listed items.

Administrative continuity

• The revocation of Determination No.26 of 2013 suggests an administrative update to APRA’s approach to disclosure of life insurer reporting data. The Schedule’s explicit lists and the 14-day timing rule formalise the terms of disclosure. There is no further amendment history recorded within the instrument.

No litigation is recorded in the instrument

• The determination does not refer to any court decisions, litigation, or disputes arising from prior confidentiality determinations. It contains no references to judicial review proceedings or court orders. The text simply records an administrative revocation and a new confidentiality determination. Consequently, the instrument itself does not present a litigation history.

Implications for potential judicial review

• The instrument is an administrative act made under statutory powers. As such, it would be susceptible to judicial review on ordinary public law grounds (for example, jurisdictional error, error of law, procedural fairness) if an affected party sought to challenge it. The instrument does not discuss or preclude review. The presence of a named delegate and the use of specified statutory powers (s57 of the APRA Act, s33(3) of the Acts Interpretation Act) provide an administrative record that would be relevant in a review application, but the instrument does not record any litigation.

Practical note on disputes over publication

• Although no litigation is recorded, disputes could arise in practice if a reporting entity contends that APRA has published material that is nonetheless personal information or that the Schedule was misapplied in a particular instance. Any such dispute would proceed under the usual judicial review or statutory complaint mechanisms; this instrument does not itself set out a dispute-resolution pathway.

Absence of case law references

• The instrument names no cases and refers only to statutes and reporting standards. It therefore supplies no judicial guidance on interpretation of the non-confidential declaration; the legal boundaries and procedural steps would be interpreted against the APRA Act and administrative law principles by any court called upon to decide.

Timing trap: 14-day trigger is from the date required, not necessarily submission date

• The Schedule’s operation depends on “a period of at least 14 days has elapsed from the date the life insurer or friendly society was required to provide the information required under the reporting standards in accordance with paragraph 5 of Reporting Standard LRS 001 Reporting Requirements.” The trigger is the date the reporting obligation arises under LRS 001(5). That may differ from the actual lodgement date or the date APRA receives the data. Practitioners must therefore ascertain the precise triggering date in LRS 001 paragraph 5 to determine when non-confidential status arises. Misreading the trigger as the lodgement date is a practical pitfall.

Granularity differences matter

• Part 2’s line-by-line specification contains a mix of “all data items” and “total amount only.” These distinctions materially affect what APRA can lawfully publish. If a reporting form item is marked “total amount only,” APRA’s authority to publish does not, on the face of the determination, extend to product-level line data for that item. Confusion about which fields are aggregate versus granular will cause compliance errors, mis-statements to market, or incorrect internal disclosures.

Personal information carve-out

• The instrument explicitly excludes personal information from the non-confidential class. Reporting entities must therefore identify and segregate personal information from other report fields. Assuming that all data in an LRF is non-confidential because it appears in the Schedule would be a mistake if any of those fields contain personal data as defined by the Privacy Act 1988.

Implicit but not explicit: APRA may publish, but is not obliged to

• The instrument authorises APRA to publish specified items but does not oblige APRA to do so. Stakeholders should not assume that a field declared non-confidential will be published on a set timetable. The absence of any commitment to publication frequency, format, or aggregation leaves APRA with discretion. Expecting systematic publication or relying on specific disclosure timing could cause mistaken business decisions.

Interaction with private confidentiality obligations

• Declaring an item non-confidential for APRA’s purposes does not automatically void contractual confidentiality obligations between reporting entities and third parties. Reporting entities that have contractual confidentiality undertakings must consider whether APRA’s potential publication would place them in breach of private agreements. The instrument does not address or vary contractual obligations.

Historical reporting standard mapping

• The Schedule covers both current standards effective from 1 January 2013 and superseded standards from earlier periods (2008-2009; 2009-2012). Practitioners must map specific historical reports to the correct standard in those windows to determine applicability. A failure to correctly identify which standard applied to a particular submission could lead to incorrect assumptions about whether an item is non-confidential.

No penalties in this instrument

• Because the instrument contains no sanctions, assuming it creates a penalty regime for disclosure-related missteps would be incorrect. The instrument changes confidentiality classification and thus affects disclosure risk, but regulatory consequences for wrongdoing remain governed by other statutory provisions.

Precision of language in Schedule

• The Schedule uses specific phrases such as “all data items,” “total amount only,” and enumerated sections (for example, LRF 110.1 Section 1 items (i)-(ix)). Small differences in phrasing are legally meaningful. Relying on a summary or paraphrase of the Schedule without cross-checking the exact Schedule wording risks misidentifying which data elements are non-confidential.

APRA’s internal discretion and future changes

• The revocation of the prior determination and issuance of this instrument indicates APRA periodically revisits confidentiality settings. Practitioners should not treat this determination as immutable. Expect potential future adjustments in scope or timing; failure to monitor subsequent APRA determinations is a practical risk.

Practical steps for reporting entities (life insurers and friendly societies)

1. Map your reports precisely against the Schedule

   • Identify each LRF form you lodge with APRA and map line-by-line which fields are listed in Part 2 as “all data items” versus “total amount only” or specifically enumerated sections. Do not rely on shorthand; the Schedule’s exact phrasing determines whether APRA may treat an item as non-confidential.

2. Establish the LRS 001 paragraph 5 trigger date

   • Determine, for each reporting obligation, the date on which the reporting requirement was “required to provide” under paragraph 5 of Reporting Standard LRS 001. The 14-day non-confidentiality clock runs from that date. Document the trigger date and monitor the 14-day lapses for each submission.

3. Segregate and protect personal information

   • Identify any personal information within reporting forms and ensure it is handled under the Privacy Act 1988 protections. The determination explicitly excludes personal information from the non-confidential class. Where fields contain a mix of personal and non-personal data, ensure that APRA and internal publication procedures will not inadvertently disclose personal information.

4. Review and update contractual confidentiality clauses

   • Where you supply data to third parties under confidentiality undertakings (for example, auditors, contractors or reinsurers), review contracts to assess the risk that APRA publication of certain fields could conflict with contractual obligations. Consider adding carve-outs or notices about APRA’s statutory disclosure powers. Legal advice should be sought where contractual obligations appear inconsistent with the instrument’s practical effect.

5. Update internal disclosure and communication policies

   • Change internal protocols governing press releases, market disclosures, board reporting and investor communications to reflect that certain prudential numbers may become public via APRA after 14 days. Consider whether to align external messaging with APRA’s likely publication schedule or to pre-emptively provide context for figures likely to be published.

6. Implement a clearance process for data that may be published

   • Create an internal clearance workflow to identify and annotate data that falls within the Schedule. Ensure compliance, legal and risk teams sign off on any material flagged for possible publication. Maintain a record of the dates when the 14-day period ends for each relevant submission.

7. Liaise with APRA if necessary

   • If there is uncertainty about whether a particular field contains personal information or whether the Schedule applies to a particular historical report, seek clarification from APRA. The instrument names the statutory basis for the determination; direct administrative queries to APRA to obtain authoritative guidance.

Practical steps for APRA and other decision-makers

1. Exercise publication discretion transparently

   • If APRA intends to publish the declared non-confidential items, consider publishing a schedule or a disclosure policy that sets out timing, aggregation level, format and anonymisation rules to reduce market confusion. The determination authorises publication but leaves details to APRA’s discretion.

2. Maintain privacy safeguards

   • Before publication, conduct privacy impact assessments to ensure no personal information is disclosed in breach of the Privacy Act 1988, even where the Schedule marks items as non-confidential.

3. Consider redaction and aggregation policies

   • For fields marked “total amount only” but where raw data could be reconstructed from other published items, adopt redaction or aggregation heuristics to avoid inadvertent disclosure of commercially sensitive line-level data.

Steps for downstream users (analysts, journalists, researchers)

1. Verify APRA publication and the version of the reporting standard

   • Do not assume all items in an LRF are in the public domain. Check APRA’s published datasets and the FRLI entry for this determination to confirm which items have been published. Match published items against the Schedule to verify whether APRA’s publication is consistent with the determination.

2. Treat personal data carefully

   • If a published dataset appears to include personal information, exercise caution and consider reporting confidentiality obligations and privacy obligations. The determination excludes personal information from the non-confidential class.

3. Use published aggregates correctly

   • Where the Schedule restricts some items to “total amount only,” do not attempt to infer or reverse-engineer product-level exposure from a combination of published totals unless you have clear authority to do so. Be mindful that such inferences may be inaccurate and could mislead users.

Contingency and audit

1. Recordkeeping and audit trails

   • Maintain an auditable record of which reports were submitted, the trigger date under LRS 001 paragraph 5, the 14-day lapse date, and any communications with APRA concerning publication. This record will be important for internal governance and if disputes arise.

2. Review compliance processes periodically

   • Because APRA revoked a prior determination and issued this updated instrument, expect periodic review. Schedule periodic legal and compliance reviews to ensure practices remain aligned with APRA’s evolving confidentiality determinations.

3. Get legal advice where necessary

   • Where contractual obligations, market disclosures, or privacy concerns intersect with the Schedule’s scope, obtain legal advice tailored to the particular data fields and contractual context. The instrument’s text provides the legal basis for non-confidentiality but not answers to every operational question.

Summary checklist for immediate action

• Identify LRFs you lodge that are listed in Part 2 and mark which fields are “all data items” versus “total amount only”.
• Establish the LRS 001(5) trigger date for each reporting obligation and note the 14-day expiry.
• Segregate personal information and ensure Privacy Act protections remain in place.
• Review contractual confidentiality clauses and update where necessary.
• Adopt an internal clearance process for data likely to be published by APRA.
• Keep an audit trail of submissions, trigger dates and any APRA publications.

Following these steps will align a reporting entity’s internal processes with the legal change effected by the determination, manage disclosure risk, and prepare for APRA’s exercise of its publication discretion under subsection 56(5C) of the APRA Act.