The regulation introduces or defines several concepts critical to understanding its operation.

Authorised person and classifiable person are defined only for Part 3 (ss 1418). Authorised person means a person authorised by the responsible person under section 92(2) of the Act. Classifiable person means a serious indictable offender on whom a forensic procedure has been carried out under Part 7 of the Act. NSW Forensic and Analytical Science Service means the administrative arm of NSW Health Pathology within the Health Administration Corporation.

The DNA database system is the central repository referenced throughout. The regulation refers to several indexes within that system: the volunteers (limited purposes) index, volunteers (unlimited purposes) index, missing persons index, unknown deceased persons index, and offenders index. The distinction between limited and unlimited purposes for volunteers is important: limited purposes likely restrict matching to identification of missing persons or unknown deceased persons, while unlimited purposes allow broader law enforcement matching. The regulation does not define the substance of these purposes; that is left to the Act.

Corresponding laws are listed in section 6. Declaring a law as corresponding enables interstate matching of DNA profiles. The list covers every Australian jurisdiction and is specific to named provisions, not entire Acts (except for ACT, SA, Tas, and WA where all provisions are declared). This means a DNA profile from NSW can be matched against profiles held under those specific provisions, but not against all databases in that jurisdiction.

The categories of persons who can give consent under the regulation are defined by the Act but the regulation prescribes the form of that consent. Serious indictable offender: a person convicted of a serious indictable offence (as defined in the Act). Untested former offender: a person who was a serious indictable offender before certain provisions commenced and who has not been the subject of a relevant forensic procedure. Untested registrable person: a person required to be on a child protection register under the Child Protection (Offenders Registration) Act 2000 but who has not been tested. Volunteer: a person who gives consent voluntarily (not because of a court order or mandatory demand). Child under 10: a special class for whom a parent or guardian gives consent, with more restricted placement of the resulting DNA profile.

Informed consent for volunteers requires the police officer to tell the person, before consent is given, about the indexes and the restrictions on placement. The regulation prescribes these as matters that must be communicated (s 10). For a child under 10, the parent or guardian must be told that the child's DNA profile can only go on three indexes and matching is limited to the purpose for which it was placed (s 13(f)).

Placement of volunteer's information is a key concept under section 12. The rule is: if the police officer informs the volunteer that the officer intends to place the information on specified indexes, then the information must only go on those indexes and not on another. If the officer says the officer does not intend to place it on a specified index, it must not go there. If the officer says nothing about intentions, the information cannot be placed on any index at all. This is a significant restriction. A police officer who fails to disclose intentions effectively blocks the database from receiving the volunteer's DNA profile. The practical incentive: if a police officer wants a volunteer's profile on the database, the officer must explicitly state which indexes, and the consent form must reflect that (s 11(f)). If the officer changes their mind later, or if the form is incomplete, the information is effectively unusable for law enforcement purposes.

The regulation affects a wide range of actors within the criminal justice and forensic systems, imposing differential obligations on each.

Police officers bear the most immediate compliance burden. They must use the prescribed consent forms for each category of person (ss 7, 8, 9, 11, 13). They must inform offenders and former offenders of the matters listed in the Act (ss 69, 75H, 75X) and record whether that information was given (ss 7(d), 8(d), 9(d)). They must inform volunteers and parents of children under 10 about the indexes and restrictions (ss 10, 13(e)). For volunteers, they must specify which indexes they intend to place the information on and record that on the form (s 11(f)). A failure to do so carries the consequence that the information cannot be placed on any index (s 12(2)). Police officers must also ensure an independent person is present when volunteers or parents give consent (s 11(d), s 13(d)). For access and disclosure under Part 3, police officers are potential authorised persons who may access database information for wrongful conviction claims (s 16) or checking suspect profiles (s 17). The regulation does not create new powers for police; rather, it controls how existing powers to request consent are exercised.

Serious indictable offenders, untested former offenders, and untested registrable persons are the subjects of consent-based forensic procedures under Part 2. Their primary right is to be informed of the matters in the Act before giving consent. The prescribed form records that this information was given, but does not itself guarantee understanding. The practical effect: consent can be challenged in court if the form is incomplete or if the information was not actually conveyed. The regulation also benefits these persons: an offender claiming wrongful conviction can have their DNA profile accessed and disclosed for assessment (ss 16(1)(a), 17(1)(a)).

Volunteers and their parents or guardians are given strong protections. The regulation requires informed consent that explicitly covers which indexes the DNA profile will go on. If the police officer is silent on the matter, no placement occurs. This is a deliberate constraint on law enforcement's ability to collect and retain volunteer DNA. The volunteer also has the right to know about the different indexes under section 10. For children under 10, the parent or guardian must be told about the limited indexes and matching restrictions. The independent person requirement adds a layer of oversight.

The responsible person (Secretary of the Ministry of Health) and their delegates (authorised persons) manage access to the DNA database system. The regulation specifies additional purposes for which they may authorise access (s 16) and for which disclosure is permitted (s 17). These purposes go beyond the basic law enforcement and identification purposes in the Act. The responsible person must process written applications from individuals seeking their own information (s 15), requiring reasonable proof of identity and, if the applicant is not the data subject, evidence of authority.

NSW Forensic and Analytical Science Service staff gain a new function: checking whether persons suspected of being untested former offenders or untested registrable persons are on the offenders index (s 16(1)(b), s 17(1)(b)). This allows proactive identification of individuals who should have been tested but were missed. The check may involve accessing profiles of other persons (s 16(3)). The cost: the Service must have authorised persons and procedures in place to comply with the restrictions.

Correctional authorities are affected by the disclosure of information for security classification, placement and management of classifiable persons under the Crimes (Administration of Sentences) Act 1999 (s 17(1)(c), s 18(2)). This means a prisoner's DNA profile or related forensic information can be used in decisions about their custody level and placement. This could have consequences for the prisoner's conditions and liberty, although the regulation provides no procedural safeguards beyond the general provision in the Act.

Interstate law enforcement agencies are indirectly affected because the corresponding laws list (s 6) enables matching across borders. This expands the pool of profiles that can be compared, reducing the chance of a missed match but also increasing the scope of surveillance.

Duties on police officers. Before requesting consent from a serious indictable offender, untested former offender, or untested registrable person, the officer must inform the person of the matters set out in sections 69, 75H, or 75X of the Act respectively. The regulation does not restate those matters, but they are likely to include the purpose of the procedure, the fact that consent can be withheld, and the consequences of refusing. The officer must record on the consent form whether that information was given and whether the person had the opportunity to communicate with a legal practitioner (ss 7, 8, 9). For volunteers and parents of children, the officer must inform them of the indexes and restrictions (ss 10, 13(e)). The officer must also specify on the form which indexes they intend to use (s 11(f)). If they do not specify, the profile cannot be placed on any index (s 12(2)). The officer must ensure an independent person is present when consent is given for a volunteer (s 11(d)) or a child under 10 (s 13(d)). The independent person's name must be recorded on the form.

Duties on the responsible person. The Secretary of the Ministry of Health must maintain the DNA database system and authorise access to it. Under section 15, the responsible person must make information available to the person to whom it relates if a written application is received with satisfactory proof of identity and evidence of authority. There is no discretion to refuse if the requirements are met; the duty is to make the information available. The regulation does not set a time limit, but the Act may do so.

Rights of data subjects. Persons whose DNA profile or other forensic information is stored on the database have a right to access that information via the application process in section 15. This is consistent with privacy principles, though the regulation does not provide for correction or deletion rights (those are in the Act). Offenders claiming wrongful conviction can have their own information (and information relating to other persons) accessed and disclosed for assessment (s 16(1)(a), s 17(1)(a)). This is a potentially powerful tool for exoneration, though it depends on the responsible person and authorised persons cooperating. Suspected untested former offenders and registrable persons have a right to have their profiles checked against the offenders index (s 16(1)(b), s 17(1)(b)). This could be seen as a benefit to those individuals if it confirms they are not in the database, or as a risk if it reveals a match.

Restrictions on use of volunteer information. The strongest restriction is in section 12: if a police officer does not inform the volunteer or parent of their placement intentions, the information cannot be placed on any index. This effectively means no law enforcement use of that DNA sample. Even if the officer does specify an index, the information cannot be placed on any other index. This is a rigid rule that prevents afterthefact repurposing of volunteer samples for broader law enforcement matching. The restriction is a significant limit on police discretion. For children under 10, the placement is even more restricted: only the volunteers (limited purposes) index, missing persons index, or unknown deceased persons index, and matching is only for the purpose for which the profile was placed (s 13(f)(ii)). This effectively prevents a child's DNA from being used for general crime solving; it is confined to missing persons and identification of unknown deceased persons.

Right to have an independent person present. Volunteers and parents of children under 10 must give consent in the presence of an independent person. The regulation does not define who can act as an independent person; the Act may do so. The officer must record the person's name on the consent form. This requirement adds a cost: it may delay procedures if an independent person is not immediately available. It also provides a safeguard against coercion or misunderstanding.

Duties regarding disclosure. Persons who disclose DNA database information for the purposes in section 17 must ensure the disclosure is for one of the listed purposes only. Those purposes include wrongful conviction claims, checking suspect profiles, and security classification management. Disclosing for any other purpose is likely an offence under the Act. The regulation does not create new rights to receive disclosures; it merely permits them.

The regulation itself does not prescribe penalties. Offences for unauthorised access to or disclosure of DNA database information are found in the Crimes (Forensic Procedures) Act 2000, particularly sections 92 and 109. The regulation defines what constitutes permitted access and disclosure. If an authorised person accesses information for a purpose not listed in section 16, or a person discloses information for a purpose not listed in section 17, that may be an offence under the Act. The regulation thus shapes the boundaries of lawful behaviour.

Consequences of noncompliance with consent forms. If a police officer uses a consent form that does not contain all the prescribed elements (e.g. missing the name of the independent person for a volunteer, or omitting the statement about indexes for a child under 10), the consent may be invalid. Under the Act, a forensic procedure carried out without valid consent is unlawful. Evidence obtained from such a procedure is likely inadmissible under section 138 of the Evidence Act 1995 (NSW) (improperly obtained evidence). In serious cases, the police officer may face disciplinary action or criminal liability if the procedure involved a bodily sample taken without lawful authority. The risk is particularly acute for volunteers and children, where the regulation imposes detailed requirements: for a child under 10, the parent must be informed about the limited indexes and matching restrictions (s 13(f)). If that statement is omitted, the entire consent may be void.

Placement restrictions on volunteer information. Section 12 imposes a strict rule. If a police officer tells a volunteer that the officer intends to place the information on a specified index, the information must only go on that index. Placing it on a different index could constitute unauthorised use and lead to criminal penalties under the Act. If the officer says nothing, the information cannot go on any index. A forensic analyst who places the information on an index contrary to these rules may commit an offence. The regulation provides no gradation: any breach is absolute.

Access and disclosure. The regulation expands the list of permitted purposes. An authorised person who accesses information for a purpose not in section 16, or a person who discloses information for a purpose not in section 17, acts outside the regulation. The Act likely makes such conduct an offence with maximum penalties (which the regulation does not specify). The savings provision (s 19) ensures that acts done under the old regulation are not retrospectively invalidated, but does not protect new breaches.

Enforcement mechanisms. The regulation does not create its own enforcement machinery. Prosecution would be by the Director of Public Prosecutions. The responsible person (Secretary of Health) may revoke authorisations if an authorised person breaches conditions. The regulation also gives the responsible person a gatekeeping role in section 15: they must be satisfied with proof of identity before releasing information. This is a procedural safeguard, not a penalty.

Civil consequences. Noncompliance with consent requirements can lead to civil actions for trespass to the person or battery if a forensic procedure was carried out without valid consent. The regulation does not create a private right of action, but the requirements it sets may be used as evidence of the standard of care. A failure to comply with section 12 could lead to an action for breach of statutory duty, though such actions are rare.

Economic incentives. The compliance burden on police and forensic services is real. Each consent form must be tailored to the specific category of person. General forms will not suffice. The requirement for an independent person for volunteers and children under 10 imposes a staffing cost. The restriction on volunteer information placement reduces the pool of DNA profiles available for law enforcement matching, potentially slowing investigations. These costs are justified by the drafters as protecting individual rights, but they also reduce the efficiency of the DNA database. The regulation creates incentives for police to prefer compulsory procedures (court orders) over voluntary consent, because compulsory procedures may not require the same rigour of consent forms. This could shift the balance away from cooperation and toward coercion.

The regulation operates entirely under the umbrella of the Crimes (Forensic Procedures) Act 2000 (NSW). It does not amend or override any other legislation. Its interaction with other laws is primarily through crossreferences and the concept of corresponding laws.

Crimes (Forensic Procedures) Act 2000. The regulation is a creature of this Act. Every section in the regulation cites a provision of the Act as its source. For example, sections 7, 8, 9, 11, and 13 each begin with For the Act, section .... To understand the effect of any duty or right in the regulation, one must read it together with the Act. The Act defines the categories of persons, the matters to be communicated, the powers to carry out forensic procedures, and the penalties for misuse. The regulation fills in the details that the Act left to regulation. The Act also contains the overarching purpose and principles, such as respect for individual rights and the need for proportionality. The regulation does not replicate those principles; it assumes them.

Interpretation Act 1987 (NSW). Section 3 of the regulation notes that the Interpretation Act contains definitions and other provisions affecting interpretation. This includes standard rules on gender, number, and time. The note is advisory; the Interpretation Act applies automatically.

Subordinate Legislation Act 1989 (NSW). The regulation's commencement and repeal of the 2014 regulation are governed by this Act. Section 10(2) of that Act causes the automatic repeal of the old regulation. The savings provision (s 19) ensures continuity.

Corresponding laws (s 6). This section lists laws from all other Australian jurisdictions that are declared corresponding laws for the purposes of section 95 of the Act. The effect is to enable the DNA database system to match profiles across state and territory borders. Each listed law has its own definitions, procedures, and protections. A match between a NSW profile and a profile from Queensland under the Police Powers and Responsibilities Act 2000 is permissible because that law is declared corresponding. The regulation does not control how other jurisdictions use the profiles once matched; that is a matter for interstate agreements. The list includes specific provisions from some jurisdictions (e.g. Commonwealth Crimes Act 1914 Part ID, Victoria Crimes Act 1958 Part III Division 1 Subdivision (30A)) and entire Acts for others (ACT, SA, Tas, WA). This inconsistency may create confusion about which specific sections are covered. The regulation does not explain why some are entire Acts and others are not.

Crimes (Administration of Sentences) Act 1999 (NSW). Sections 17(1)(c) and 18(2) explicitly refer to this Act. They allow disclosure of DNA database information for the security classification, placement or management of a classifiable person. This links the forensic database to the prison classification system. Information about a prisoner's DNA (potentially including genetic markers beyond identification profiles) could be used in decisions such as whether to place a prisoner in a maximumsecurity unit. The Crimes (Administration of Sentences) Act would govern the procedural fairness of such decisions, but the regulation provides no check on whether the DNA information is relevant or proportionate. This interaction could raise concerns about using healthrelated genetic data for custodial management.

Evidence Act 1995 (NSW). Although not mentioned in the regulation, the Evidence Act is the primary mechanism for challenging evidence obtained through noncompliant forensic procedures. If a consent form fails to include a prescribed element, the resulting evidence may be excluded under section 138 (unfairly or improperly obtained evidence). The regulation thus indirectly affects criminal trial procedure.

Privacy and health records legislation. The regulation does not refer to the Privacy and Personal Information Protection Act 1998 (NSW) or the Health Records and Information Privacy Act 2002 (NSW). However, the DNA database system almost certainly holds personal information and health information. Any disclosure or access must comply with those Acts. The regulation's expanded purposes (wrongful conviction claims, checking suspect profiles) may need to be consistent with privacy principles. The regulation does not harmonise these regimes; it simply adds to the Act's exceptions.

Child protection laws. The category untested registrable person refers to persons required to be on the child protection register under the Child Protection (Offenders Registration) Act 2000. The regulation's consent form for this category (s 9) applies. This interaction means that individuals whose names are on the register may be compelled (through the Act) to provide a forensic sample; the regulation only governs the form of consent if they consent voluntarily.

Interstate cooperation. The corresponding laws list enables the NSW DNA database to receive and send profiles to other jurisdictions. This interacts with each jurisdiction's own forensic procedures legislation and with the National Criminal Investigation DNA Database (NCIDD). The regulation does not address the governance of crossborder matching, leaving that to intergovernmental agreements.

The Crimes (Forensic Procedures) Regulation 2024 is a new instrument. It was made under the Act and commenced on 1 September 2024. It replaces the Crimes (Forensic Procedures) Regulation 2014, which is repealed on the same date by operation of the Subordinate Legislation Act 1989, section 10(2). The 2014 regulation was itself a remake of earlier regulations. The new regulation is not an amendment of the old one; it is a standalone instrument.

There have been no amendments to the 2024 regulation as of the date of this analysis. The regulation is recent, and any future amendments would be published on the NSW legislation website. The savings provision (s 19) preserves the effect of any act, matter or thing done under the old regulation. This means consent forms validly made under the 2014 regulation remain valid. Authorisations issued under the old regulation also continue. This avoids a wholesale redoing of administrative actions on the commencement date.

The content of the 2024 regulation is largely similar to the 2014 regulation, but there are changes. The most notable is the new Part 3: the 2014 regulation did not contain equivalent provisions on access to information for wrongful conviction claims and checking suspect profiles. Sections 15, 16, 17, and 18 are new. This represents a policy expansion: the government has decided to allow DNA database access for postconviction review and for proactive identification of untested persons. The definitions in section 14 (authorised person, classifiable person, NSW Forensic and Analytical Science Service) are also new. These additions respond to recommendations or operational needs that arose after 2014.

Other sections are largely reenactments of the 2014 equivalents. The consent forms (ss 7, 8, 9, 11, 13) follow the same pattern. The volunteer information placement rules (s 12) were present in the 2014 regulation. The list of corresponding laws (s 6) has been updated: the 2014 regulation did not include some Northern Territory provisions or the Western Australian act in the same form. The current list reflects legislative changes in other jurisdictions.

The regulation does not have an official explanatory note or statement of reasons in the provided text. The absence of an explanatory memorandum makes it harder to understand why certain changes were made. However, the practical effect is that the regulation expands the uses of DNA database information while tightening the requirements for volunteer consent. This creates a mixed picture for privacy: volunteers get stronger protections, but convicted persons and suspects face broader data sharing.

The regulation is subject to the usual parliamentary review processes. It may be disallowed by either House of the NSW Parliament within a specified period after tabling. No disallowance motions have been recorded. The regulation will remain in force until it is repealed or replaced by a later regulation, typically every five years under the Subordinate Legislation Act 1989 cycle.

The regulation itself has no litigation history, being a 2024 instrument. However, the Crimes (Forensic Procedures) Regulation 2014, which it replaced, was the subject of occasional procedural challenges. The prescribed forms were sometimes scrutinised in the context of admissibility hearings. The High Court and NSW Court of Criminal Appeal have considered the underlying Act in cases such as R v Marsh [2006] NSWCCA 128 (on the meaning of serious indictable offender) and Lee v The Queen [2014] HCA 20 (on procedural fairness and forensic procedures). But those cases turned on the Act, not the regulation.

The new provisions in Part 3 are untested. The expansion of access for wrongful conviction claims may generate litigation if a claim is denied on the basis that the regulation does not go far enough, or if disclosure is challenged as exceeding the permitted purpose. The checking of suspect profiles under sections 16(1)(b) and 17(1)(b) raises questions about privacy and the scope of suspected of being an untested former offender. What level of suspicion is required? The regulation does not define it. This ambiguity could lead to judicial review if the power is used arbitrarily.

The volunteer information placement restriction in section 12 is a strict rule. Litigation could arise if a volunteer's DNA profile is placed on an index not specified in the consent form, or if the police officer failed to inform the volunteer of intentions and the profile was placed on any index. The NSW Civil and Administrative Tribunal may have jurisdiction over complaints about misuse of DNA information under privacy legislation.

The corresponding laws list (s 6) could be challenged if a person argues that a law listed is not truly corresponding, or that the match should not be allowed. But such challenges would likely be rare because the regulation is determinative: the Minister declares the laws, and the regulation gives them effect.

The savings provision (s 19) may be litigated if there is a dispute about whether a particular act done under the old regulation continues to have effect. For example, if an authorisation under the old regulation is challenged as invalid because it did not comply with the old regulation, the savings provision may be invoked to argue validity.

Overall, litigation risk is moderate. The regulation is detailed and prescriptive, which reduces ambiguity but increases the risk of technical noncompliance. The greatest exposure is in criminal trials where the admissibility of DNA evidence relies on strict compliance with the consent form requirements. Defence lawyers will carefully scrutinise consent forms to see if all prescribed elements are present. Any omission could be fatal to the prosecution's case. This incentivises police to be meticulous, but also creates a cottage industry of form analysis.

The regulation does not create a direct private right of action, so civil litigation is less likely unless a breach also amounts to a tort or breach of statutory duty. The lack of case law on the 2024 regulation means there are no precedents yet interpreting key phrases like classifiable person or security classification, placement or management.

Several provisions in the regulation contain traps for the unwary that can trip up police, analysts, and even lawyers.

1. The volunteer placement trap. Section 12 is the most dangerous provision for police. If a police officer requests a volunteer's consent and does not inform the volunteer of which indexes the profile will go on, the profile cannot be placed on any index at all. This means the entire DNA sample taken from the volunteer is useless for database matching. A police officer who assumes the profile will automatically go on the volunteers (unlimited purposes) index will be wrong if the officer did not say so. The consent form must record the intended indexes (s 11(f)). If the officer leaves that field blank, the profile is effectively dead. The trap is that a wellmeaning officer might think they are being flexible by not specifying, but the regulation penalises that flexibility.

2. The independent person requirement for volunteers. Section 11(d) requires that the consent form include the name of the independent person in whose presence the consent is given. This applies to all volunteers (including adult volunteers). If the independent person is not present, or if the form does not record their name, the consent may be invalid. Police officers who collect volunteer DNA at crime scenes or during community events may not have an independent person readily available. This creates a practical barrier to collecting voluntary samples.

3. The child under 10 matching restriction. Section 13(f)(ii) states that if the DNA profile of a child is placed on an index, it may only be matched with another profile if the matching is for a purpose for which the child's profile was placed. This is a severe limitation. If the parent consented to the profile being placed on the missing persons index, it can only be matched for missing persons purposes, not for general crime solving. A forensic analyst who runs a match against the offenders index will breach the regulation. This restriction is absolute; there is no override for public safety or serious crime.

4. The classifiable person definition. Classifiable person is defined only for Part 3 (s 14). It means a serious indictable offender on whom a forensic procedure has been carried out under Part 7 of the Act. This definition does not apply to Part 2 (consent). So when reading sections 16, 17, and 18, one must use this narrow definition. It excludes volunteers, suspects, and former offenders who are not serious indictable offenders. Disclosure for security classification is limited to classifiable persons. If an analyst tries to use the security classification purpose for a volunteer, it is not permitted.

5. The consent form for children under 10 must include a statement about matching restrictions. Section 13(f) requires the form to contain a statement that the parent or guardian was informed of the limited indexes and matching restrictions. This is not just a matter of informing; the statement must appear on the form itself. If the form does not contain that specific language, the form is noncompliant. A form that merely has a tick box for informed may be insufficient.

6. The difference between authorised person in Part 3 and the Act. The regulation defines authorised person for Part 3 as someone authorised by the responsible person under section 92(2) of the Act. This is narrower than a person authorised under other provisions of the Act. A person who is authorised for other purposes (e.g. to carry out a forensic procedure) may not be authorised to access the database under Part 3. They need a separate authorisation.

**7. The application process for access to one's own information (s 15) requires reasonable proof of identity and evidence the applicant is acting for the person if not the person themselves. The regulation does not define reasonable proof of identity. This leaves discretion with the responsible person. A person who cannot provide photo identification may be refused. The responsible person could impose bureaucratic requirements that delay access. There is no timeframe for the responsible person to act.

**8. The savings provision (s 19) only applies to things done under the old regulation before its repeal. It does not validate things done under the new regulation that are invalid. Also, it only covers acts, matters, or things that had effect under the old regulation. If an authorisation was invalid under the old regulation, the savings provision does not make it valid.

**9. The corresponding laws list (s 6) is based on the Minister's declaration. The list must be kept up to date. If a jurisdiction amends its law, the list may become outdated. A match based on a law that is no longer corresponding could be unlawful. The regulation does not provide a mechanism for automatic update; it relies on amendment by regulation.

**10. The wrongful conviction claim purpose (ss 16(1)(a), 17(1)(a)) allows accessing and disclosing information relating to the offender or another person. This is broad. It could potentially allow accessing the DNA profiles of victims or witnesses if relevant to the claim. The regulation does not require the consent of those other persons. This could raise privacy concerns, though the Act may provide safeguards.

Compliance with this regulation requires a systematic approach by all affected entities, particularly NSW Police, NSW Health Pathology, and the responsible person.

For police officers requesting consent.

1. Identify the correct category of person: serious indictable offender, untested former offender, untested registrable person, volunteer, or parent/guardian of child under 10. Each has a different consent form prescribed by the regulation. Using the wrong form may invalidate consent.

2. Use the prescribed form with all elements listed in the applicable section. For a serious indictable offender (s 7): include the offender's name, description of procedure, officer's name, statement of whether the officer informed the offender of the s 69 matters, and statement of whether the offender had the opportunity to communicate with a legal practitioner. For an untested former offender (s 8): same elements but referencing s 75H. For an untested registrable person (s 9): referencing s 75X. For a volunteer (s 11): include the person's name, description of procedure, officer's name, independent person's name, statement of whether the officer informed the person of s 77 matters, and the index or indexes the officer intends to use. For a child under 10 (s 13): include parent/guardian's name, procedure description, officer's name, independent person's name, statement of whether the officer informed the parent of s 81C(3) matters, and the specific statement about limited indexes and matching restrictions as set out in s 13(f).

3. For volunteers: before seeking consent, inform the person of the three indexes and the restrictions on placement (s 10). Record the intended indexes on the form. Do not leave the index field blank. If you do not want to specify, you must not place the profile on any index (s 12(2)). This likely defeats the purpose of taking the sample.

4. For children under 10: ensure the parent or guardian is informed that the child's profile can only go on the volunteers (limited purposes), missing persons, or unknown deceased persons indexes, and that matching is limited to the purpose of placement. Ensure the consent form contains that statement verbatim or in substance.

5. Ensure an independent person is present when a volunteer or parent gives consent. Their name must be on the form.

6. Store the completed forms securely. They may need to be produced in court to prove consent.

For the responsible person and authorised persons (Secretary of Health and delegates):

1. Process access requests under s 15 promptly. Upon receiving a written application with proof of identity (and evidence of authority if the applicant is not the data subject), provide the information. Maintain records of requests and responses.

2. Authorise persons to access the database for the purposes in s 16. Ensure authorisations are in writing and specify the purposes. Do not authorise access for purposes beyond those listed.

3. Permit disclosure only for the purposes in s 17. If a disclosure request does not match one of those purposes, refuse it. For security classification disclosures (s 17(1)(c), s 18(2)), verify that the person is a classifiable person as defined (serious indictable offender with a Part 7 procedure).

4. Restrict volunteer information placement under s 12. Ensure that forensic analysts check the consent form to see which indexes the officer specified. If none are specified, do not place the information on any index. If indexes are specified, place only on those. For children under 10, limit placement to the three allowed indexes and ensure matching restrictions are applied.

5. Update authorisations if purposes change. The regulation permits access for wrongful conviction claims and checking suspect profiles. Ensure authorised persons are trained on these new purposes.

For NSW Forensic and Analytical Science Service staff:

1. When checking whether a person suspected of being an untested former offender or untested registrable person is on the offenders index (s 16(1)(b), s 17(1)(b)), ensure the suspicion is documented. The regulation does not define suspected, so a reasonable basis should be recorded. Only access profiles for this purpose. Note that the access may relate to other persons (s 16(3)).

2. Do not use the suspect checking purpose for general fishing expeditions. It is limited to identifying persons who should have been tested.

For correctional authorities:

1. When requesting disclosure of DNA database information for security classification, placement or management of a classifiable person (s 17(1)(c), s 18(2)), verify that the individual is a classifiable person. The request should be in writing and specify the purpose. Ensure disclosure is limited to what is necessary for that purpose.

General compliance tips:

• Train staff on the differences between categories and the specific form requirements.
• Use checklists for each consent procedure.
• Conduct audits of consent forms to detect common errors.
• Keep up to date with any amendments to the regulation.
• If in doubt about the validity of a consent, seek legal advice before proceeding.
• Remember that noncompliance can lead to exclusion of evidence, criminal liability, or civil claims. The cost of compliance is far lower than the cost of a flawed prosecution.