Australian Security Intelligence Organisation Regulations 2025

The regulations introduce several key concepts, most of which are defined by reference to the ASIO Act 1979 rather than independently in the instrument. “Affected person” is defined in section 5 by cross-reference to three distinct definitions in the Act: for internally reviewable decisions the meaning is given by section 82H; for externally reviewable decisions by section 83; and for independently reviewable decisions by section 83EA. This means a single term covers three different classes of individual, depending on the type of decision at issue, which can cause confusion if the definitions differ. The regulations do not set out those definitions; a reader must jump to the primary Act to know who qualifies.

“Externally reviewable decision”, “independently reviewable decision”, “independent reviewer”, “internal reviewer” and “internally reviewable decision” are all given the same meaning as in the specified sections of the Act. The “internal reviewer” means the person holding that role under subsection 82L(1). The “independent reviewer” is a person engaged under section 83EF. The regulations do not create any criteria for who those reviewers are or how they operate; those details are left to the Act and presumably to administrative arrangements.

“Security information” is not defined in the regulations, but section 7 uses the phrase “information (security information), that is otherwise controlled or limited on security grounds” in connection with questioning warrant proceedings. This is a functional description rather than a precise statutory definition, potentially leaving scope for the Secretary to determine what counts.

“Security clearance” is referenced in section 7(2)(a) and the note says clearances are given in accordance with the Australian Government’s Protective Security Policy Framework. That framework is not incorporated into the regulations, so the substantive criteria for obtaining a clearance are extraneous. The Secretary effectively holds an unfettered discretion: even if a lawyer holds a clearance at the “appropriate level”, the Secretary can still refuse access under section 7(4).

“Conclusive certificate” appears in section 11(4) as a certificate issued by the Minister under subsection 83E(1) of the Act. Its effect, as reflected in the prescribed notice, is that the Administrative Review Tribunal “must not review, or continue to review” the externally reviewable decision. This is a powerful mechanism that blocks merits review entirely, and the regulations merely require that the affected person be told of that fact.

The concept of “prescribed information” itself is central: the regulations specify what must be in notices, but they allow the use of electronic links rather than full text explanations. A notice that includes a link to a website for review procedures may satisfy the regulation, but it places the burden on the affected person to access that link and understand the procedures, which may be difficult for individuals without reliable internet, literacy, or legal assistance. The note in sections 9, 11 and 12 says that whether it is appropriate to include a link “will depend on the circumstances”, suggesting that ASIO has some discretion, but the regulations do not impose any duty to consider the recipient’s circumstances before using a link.

The regulations directly affect several distinct groups. First, ASIO itself is the primary regulated entity: it must ensure its notices to affected persons contain the prescribed information, and it must manage the access of lawyers to security information in questioning warrant proceedings in accordance with section 7. The instrument also imposes obligations on the Secretary of the Department (the Home Affairs Secretary) to assess security clearances and decide whether to grant access to security information. That official bears the decision-making burden and the legal risk of getting the balance wrong between legal professional rights and security.

Second, lawyers who act for persons the subject of questioning warrants are directly affected. They must satisfy the Secretary that they hold an appropriate security clearance or that their access would not be prejudicial to security. Even then, they have no entitlement to access; the Secretary can still refuse. This creates significant uncertainty for lawyers: they cannot confidently advise their clients about what information might be available, and they may be unable to challenge ASIO’s actions effectively without access to the security material that forms the basis of the warrant. The secrecy limitation in section 8 further restricts what information the lawyer can communicate to others, including potentially the client or other legal representatives. This may impair the lawyer’s ability to take instructions or obtain expert advice.

Third, “affected persons” are individuals who receive security assessments (adverse or qualified) or who are subject to certain reviewable decisions under Part IVA of the Act. They are entitled to receive prescribed information about review rights, but the quality of that information depends on whether ASIO uses electronic links or full text. The FOI exemption means they cannot use freedom of information laws to access ASIO documents about their case, so the prescribed notice is effectively their only source of information about the decision and how to challenge it. Their ability to exercise review rights is contingent on understanding the notice.

Fourth, the Defence Department and the Defence Force are prescribed as authorities with which ASIO must cooperate under paragraph 19A(1)(e). This imposes a duty on those bodies to cooperate, but the regulation does not specify the scope of cooperation or any limits. It may require them to share information or resources, which could impose compliance costs and divert resources from their primary functions. The regulation does not provide for any compensation or cost recovery.

Fifth, the Administrative Review Tribunal is affected because the regulations prescribe information about its review processes; the Tribunal may need to handle applications from affected persons who were given notices with electronic links that may not have been clear. Also, the conclusive certificate provision means the Tribunal must cease review in certain cases, which could create administrative inefficiency if matters are commenced and then terminated.

Finally, external bodies such as the Inspector-General of Intelligence and Security or the courts are not directly mentioned in the regulations, but they may be indirectly affected if disputes arise about the adequacy of notices or the refusal of lawyer access. Private parties, such as employers or visa applicants who might be indirectly impacted by a security assessment, are not given any direct right or notice under these regulations; the instrument focuses only on the individual assessed or decisioned.

The central duty imposed by the regulations is on the Secretary of the Department: under section 7(2), the Secretary must either have given the lawyer a security clearance at the level considered appropriate or be satisfied that access would not be prejudicial to security before permitting access to security information in questioning warrant proceedings. The Secretary also has the power to impose conditions under section 7(3) and, importantly, holds the right to refuse access even to a cleared lawyer under section 7(4). This means there is no positive duty to grant access; the Secretary’s decision is discretionary and unreviewable on its face within the regulations themselves (though possibly reviewable under administrative law). The regulation does not impose any time limit for the Secretary to make these decisions, creating a risk of delay that could impinge on the lawyer’s ability to prepare for proceedings.

Under section 8, a prescribed authority (which is a person authorised under the Act to give secrecy directions) has a duty not to permit the lawyer to communicate information about intelligence sources, holdings, or ASIO’s methods of operation. This is a negative duty: the authority cannot include that category of information in any direction that otherwise allows disclosure. It also implicitly limits the lawyer’s rights to communicate with their client or others about such matters.

For ASIO itself, the key duty is to include prescribed information in notices given to affected persons. Sections 9, 10, 11 and 12 set out the content requirements. These are mandatory: if a notice omits the prescribed information, it may not comply with the Act’s requirement to give notice. However, the regulations permit the use of electronic links instead of full explanations, such that the duty can be satisfied by providing a URL. This potentially reduces the practical utility of the notice if the link is broken, the website is not user-friendly, or the affected person lacks internet access. There is no duty on ASIO to verify that the recipient actually accessed or understood the information.

The regulations also confer rights on affected persons. They have a right to receive a notice containing the prescribed information, which in turn gives them a right to know that FOI is unavailable, how to seek review, time limits, fees, and procedures. For externally reviewable decisions where a conclusive certificate exists, they have a right to be told that the certificate blocks Tribunal review. These are informational rights; the regulations do not themselves create a right to substantive review,that comes from the Act.

Lawyers have a right to apply for access to security information, but no right to be granted it. The regulations do not provide any mechanism for a lawyer to challenge the Secretary’s refusal or conditions, nor do they require reasons. This asymmetry of rights is notable: the state holds all the cards, and the lawyer’s ability to represent their client depends entirely on executive discretion.

The regulations themselves do not create any penalties, offences, or civil penalty provisions. They are entirely procedural and informational in nature. Enforcement of any breach must rely on the primary Act or general law. For example, if ASIO gives a notice that fails to include the prescribed information, that might mean the notice is not valid under the Act, and an affected person could argue that the underlying decision (e.g., a security assessment) cannot be relied upon or that review time limits have not started. The regulations do not specify the consequences of non-compliance; it is left to the courts or tribunals to decide on a case-by-case basis.

Section 8 of the regulations operates by limiting what a prescribed authority can include in a direction under subsection 34GF(6) of the Act. If a direction purportedly permits communication of information about intelligence sources or methods, that direction would be ultra vires the regulations. The note to section 8 says that a disclosure in contravention of such a direction may not be a “permitted disclosure” for the purposes of section 34GF of the Act. This has implications for criminal liability: if a lawyer discloses information in reliance on an invalid direction, they may risk prosecution under the Act’s secrecy offences. The regulations therefore create a trap for the unwary lawyer: they must independently verify whether the direction they receive respects the limitations in section 8. If the prescribed authority issues a direction that violates section 8, the lawyer might not know it is invalid and could be exposed to penalty.

The Secretary’s decisions under section 7 are not subject to any explicit enforcement mechanism in the regulations. A lawyer who is denied access or given onerous conditions might seek judicial review under the Administrative Decisions (Judicial Review) Act 1977 or constitutional review, but the regulations do not provide any internal merits review. The costs of such litigation are likely to be high relative to the benefit, especially given the secrecy surrounding the underlying information.

The repeal of the 2016 Regulation by Schedule 1 is effective from commencement. No transitional provisions are included in the 2025 regulations, which could create uncertainty if any act or omission under the old regulation straddles the commencement date. For example, if a notice was given under the 2016 regulation before 16 December 2025 but was incomplete under the new requirements, it is unclear whether the old notice remains valid.

The regulations are made under the Australian Security Intelligence Organisation Act 1979 and must be read as part of that Act. They fill in details left open by the Act, such as what “prescribed” authorities and “prescribed information” mean. The regulations also explicitly reference other Commonwealth laws. The most important interaction is with the Freedom of Information Act 1982: each notice must inform the affected person that ASIO is an exempt agency under subsection 7(1) of that Act and that the person cannot obtain documents about the assessment or decision under FOI. This effectively closes off one avenue for affected persons to obtain information about the case against them, reinforcing the centrality of the ASIO review processes.

The regulations also interact with the Administrative Review Tribunal Act 1975 (now presumably the Administrative Review Tribunal Act 2024 or similar, but the regulation uses “Administrative Review Tribunal”). The prescribed notices include information about how to apply to the Tribunal, any time limits, fees, and whether the Tribunal is required to conduct the review within a particular period. The regulation does not itself set those time limits or fees; it merely requires that the notice include them. For externally reviewable decisions where a conclusive certificate has been issued, the regulation mandates that the notice state that the Tribunal must not review the decision. This effectively ousts the Tribunal’s jurisdiction, and the regulation is the mechanism by which the affected person is notified of that ouster.

The Protective Security Policy Framework is referenced in the note to section 7, but it is not incorporated into the regulations. This means the criteria for security clearances are not legally binding under the regulations; they are merely administrative policy. The Secretary could, in theory, adopt different criteria for the purposes of section 7, though in practice would likely follow the Framework. This creates a soft law interaction: the Framework informs but does not compel the Secretary’s decision.

Part 2 of the regulations prescribes the Defence Department and Defence Force for purposes of paragraph 19A(1)(e) of the Act. That paragraph deals with ASIO’s cooperation with intelligence and law enforcement agencies. The Defence Department and Defence Force are now explicitly included, which means they are subject to whatever cooperation obligations the Act imposes. This may interact with the Defence Act 1903 and other defence-related legislation, potentially requiring those agencies to prioritise ASIO requests over other tasks.

The regulations repeal the 2016 Regulation but do not amend any other instrument. The 2016 Regulation presumably contained provisions that are now superseded, but the new regulations have a different structure and content (e.g., Part 4 now includes provisions for independently reviewable decisions that were not in the 2016 Regulation). Practitioners should not rely on the old regulation for any current matters.

The interaction with the Privacy Act 1988 is not addressed in the regulations, but the question of how ASIO handles personal information in notices is governed by the Australian Privacy Principles only to a limited extent, as ASIO is largely exempt. The regulations do not impose any additional privacy obligations.

The Australian Security Intelligence Organisation Regulations 2025 are a new instrument, registered on 11 December 2025 and commencing the day after registration (16 December 2025). They replace the Australian Security Intelligence Organisation Regulation 2016, which is repealed in its entirety by Schedule 1. The 2025 regulations therefore represent a complete re-making of the delegated legislation under the ASIO Act. No amendments have been made to the 2025 regulations as at the time of writing. The commencement table at section 2 shows that the whole instrument commenced on 16 December 2025.

The change from the 2016 to 2025 regulations appears to be a clean repeal and replacement, rather than a series of incremental amendments. The 2025 regulations include new provisions: in particular, the inclusion of independent reviewer review procedures (section 12) and more detailed information requirements for externally reviewable decisions when a conclusive certificate has been issued (section 11(4)). The 2016 Regulation may have had analogous provisions, but the user did not provide that text, so comparison is not possible from the source alone. The regulations state their authority as the ASIO Act 1979, and they are signed by the Governor-General and Minister for Home Affairs.

The short period between registration (11 December) and commencement (16 December) means that affected persons and ASIO had only five days to adjust to the new requirements. This quick commencement may cause transitional issues, especially if ASIO had already prepared notices under the old regulation for matters pending after 16 December. Since the old regulation is repealed outright, those notices would need to comply with the new information requirements immediately. However, the regulations do not contain any transitional or savings provisions, leaving the status of pre-commencement notices uncertain.

The regulations themselves have not been the subject of any litigation, as they are brand new and only just commenced. However, the underlying provisions of the ASIO Act have been the subject of considerable litigation over the years, particularly concerning questioning warrants, secrecy directions, and review of security assessments. The regulations do not cite any cases, and we cannot invent any. It is reasonable to expect that future litigation may challenge the adequacy of notices given under Part 4, or the reasonableness of the Secretary’s decisions on lawyer access under section 7.

Key areas of potential challenge include whether a notice that uses an electronic link without providing a full text explanation adequately informs the affected person, especially if that person does not have access to the internet or the link is broken. The regulations do not require ASIO to consider the recipient’s circumstances, so a generic reference to a website might be challenged as not satisfying the Act’s requirement to “give” information. The courts may need to interpret what “prescribed information” means in that context.

Another potential litigation risk involves the Secretary’s refusal to grant a lawyer access to security information even after a clearance has been given. The intersection of section 7(4) (no entitlement) with the implied constitutional right to a fair trial or common law procedural fairness could be tested. If a lawyer cannot access material needed to challenge a questioning warrant, the proceedings might be found to be unfair. However, the regulations explicitly preserve the Secretary’s discretion, so any challenge would need to be on administrative law grounds such as jurisdictional error or unreasonableness.

The conclusive certificate provisions in section 11(4) effectively remove merits review entirely. While that is a feature of the Act (section 83E), the regulations merely prescribe the notice. Litigation might test whether the notice itself is sufficient, or whether the Minister’s decision to issue a certificate is reviewable. The regulations do not speak to that.

Overall, the litigation history directly on these regulations is nil, but the substantive areas they touch are active.

Several details in the regulations could catch out both practitioners and affected persons. First, section 7(4) is a classic “gotcha”: a lawyer who has gone to the trouble and expense of obtaining a security clearance at the level the Secretary considers appropriate still has no entitlement to access security information. The Secretary can simply refuse. This creates a disincentive for lawyers to invest in clearances, since the outcome is uncertain. It also means that even if a lawyer is cleared, they may be left without access, potentially forcing the client to find alternative representation or proceed without effective legal assistance.

Second, the Secretary’s power to impose conditions under section 7(3) is broad and does not require the conditions to be reasonable or proportionate. Conditions could, for example, prohibit the lawyer from taking notes or discussing the information with the client, effectively neutering the value of access. There is no review or appeal mechanism within the regulations.

Third, section 8 limits what a prescribed authority can permit a lawyer to communicate. However, the regulation does not say what happens if a direction is issued that contravenes this limitation. The note says such a disclosure “may not be a permitted disclosure”, which is ambiguous. It leaves the lawyer in a precarious position: if they receive a direction that on its face seems to allow communication about intelligence sources, and they rely on it, they may later be prosecuted. The wise lawyer would err on the side of non-disclosure, potentially overcomplying and withholding information that could be crucial to the client’s case.

Fourth, the notice provisions in Part 4 allow, but do not require, the use of electronic links. A notice that simply states “for review procedures see www.art.gov.au” may be held to be insufficient if the link is broken or the site is not accessible. The affected person bears the risk of accessing the information. Also, the same section applies to external review after a conclusive certificate: the notice must state that the Tribunal cannot review, but it does not require the notice to explain whether any other form of review (e.g., judicial review) is available. The affected person may be left believing there is no remedy at all.

Fifth, the definitions depend heavily on the Act. The term “affected person” is defined by reference to three different sections, and those sections may have different scopes. This means that the same phrase could cover a broader or narrower class depending on the decision. A person might be an “affected person” for an internally reviewable decision but not for an externally reviewable one, and the regulations do not help clarify this. Practitioners must cross-check the Act for each type of decision.

Sixth, the repeal of the 2016 Regulation without any transitional provisions means that any administrative arrangements that relied on the old regulation (e.g., existing standing directions or template notices) may be invalid unless updated immediately. ASIO and affected persons may face a period of uncertainty while practices catch up.

Compliance with the 2025 Regulations requires different actors to take specific steps. For ASIO itself, the main obligation is to ensure that every notice given to an affected person under Part IV or Part IVA of the Act contains the information prescribed by sections 9, 10, 11 or 12 as applicable. ASIO should update its template notices to include:

• a statement that ASIO is an FOI-exempt agency and that the recipient cannot obtain documents about the assessment or decision under the Freedom of Information Act;
• clear information about how to seek review (internal, external, or independent), including how to apply, any time limits (and what they are), any fees (and the amount and when payable), whether the reviewer or Tribunal is required to conduct the review within a particular period (and what that period is), and any procedures the Organisation considers the person should be aware of;
• for externally reviewable decisions where a conclusive certificate has been issued, a statement that the Minister has issued such a certificate and that the Administrative Review Tribunal must not review the decision.

ASIO can choose to include electronic links for some of this information, but given the potential for challenge, it should exercise discretion: a link may be appropriate for general procedural information, but the specific statement about the certificate and FOI exemption should be in full text. The organisation should also maintain and test any linked web pages before issuing notices.

For the Secretary of the Department, compliance with section 7 requires a process for handling lawyer requests for access to security information. The Secretary should have clear criteria for determining the appropriate level of security clearance and whether access would be prejudicial to security. Decisions should be documented, and reasons should be given (even if not required by the regulations, to forestall legal action). The Secretary should also ensure that any conditions imposed are proportionate and clearly communicated to the lawyer.

For lawyers acting for subjects of questioning warrants, compliance involves proactively seeking a security clearance or making representations to the Secretary that access would not be prejudicial. They should be aware that even with a clearance, they have no entitlement; they may need to be prepared to challenge a refusal in court if the client’s rights are at stake. Lawyers should also scrutinise any secrecy directions they receive to ensure they do not purport to permit communication about intelligence sources, holdings, or methods; if a direction appears to cross that line, they should refuse to rely on it and seek clarification from the prescribed authority.

For affected persons, compliance is largely passive: they receive the notice and must act within any stated time limits to seek review. They should not assume that an electronic link is sufficient; if they cannot access the link or understand the procedures, they should contact the Administrative Review Tribunal or an independent reviewer for guidance. If the notice states that a conclusive certificate has been issued, they should be aware that merits review is blocked, but they may still explore other avenues such as judicial review or complaint to the Inspector-General of Intelligence and Security.

Finally, the Defence Department and Defence Force should establish internal procedures to cooperate with ASIO as prescribed authorities, including designating points of contact and ensuring that cooperation does not breach other legal obligations.