Part 1
//
© 2026 Zoe. All rights reserved.
Zoe is a legal information platform. Always consult the Federal Register of Legislation for authoritative text.
Commonwealth act
The Digital ID Act 2024 establishes Australia’s official, voluntary digital identity system: a government-backed way to prove who you are online. Accredited providers and government/business relying parties must meet strict privacy, accessibility and security rules, with the ACCC acting as regulator and the Information Commissioner handling privacy enforcement. Strong protections (including limits on sensitive and biometric data), breach reporting, deactivation rights and hefty penalties aim to make online identity verification safer and more private while keeping use optional.
Want the full deep dive?
Zoe can write the in-depth analysis on top of the summary above: how it works, who it affects and what each part actually does.
Direct links to the current provisions in Digital ID Act 2024.
This Act is the Digital ID Act 2024.
(1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.
<table cellspacing="0" cellpadding="0" style="width:355.55pt; border-collapse:collapse"><thead><tr><td colspan="3" style="width:344.85pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Commencement information</span></p></td></tr><tr><td style="width:74.35pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Column 1</span></p></td><td style="width:180.7pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Column 2</span></p></td><td style="width:68.4pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Column 3</span></p></td></tr><tr><td style="width:74.35pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Provisions</span></p></td><td style="width:180.7pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Commencement</span></p></td><td style="width:68.4pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Date/Details</span></p></td></tr></thead><tbody><tr><td style="width:74.35pt; border-top:1.5pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="Tabletext"><span>1.</span><span> </span><span>The whole of the Act</span></p></td><td style="width:180.7pt; border-top:1.5pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="Tabletext"><span>A single day to be fixed by Proclamation.</span></p><p class="Tabletext"><span>However, if the provisions do not commence within the period of 6 months beginning on the day this Act receives the Royal Assent, they commence on the day after the end of that period.</span></p></td><td style="width:68.4pt; border-top:1.5pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="Tabletext"><span>30</span><span> </span><span>November 2024</span></p></td></tr></tbody></table>
Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.
(2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.
(1) The objects of this Act are as follows: (a) to provide individuals with secure, convenient, voluntary and inclusive ways to verify their identity in online transactions with government and businesses; (aa) to facilitate the inclusion of individuals in digital society by supporting the provision of digital ID services that are accessible for individuals who experience barriers in using such services; (b) to promote privacy and the security of personal information used to verify the identity or attributes of individuals; (c) to facilitate economic benefits for, and reduce burdens on, the Australian economy by encouraging the use of digital IDs and online services; (d) to promote trust in digital ID services amongst the Australian community. (2) These objects are to be achieved by: (a) establishing an accreditation scheme for entities providing digital ID services; and (b) providing additional privacy safeguards for the provision of accredited digital ID services; and (c) establishing an Australian Government Digital ID System that is secure, easy to use, voluntary, accessible, inclusive and reliable; and (d) strengthening the oversight and regulation of: (i) accredited digital ID service providers; and (ii) entities participating in the Australian Government Digital ID System; and (iii) the integrity and performance of the Australian Government Digital ID System.
This Act establishes an accreditation scheme for entities providing digital ID services. The Digital ID Regulator (which is the Australian Competition and Consumer Commission) may, on application, accredit certain kinds of entities as accredited attribute service providers, accredited identity exchange providers, accredited identity service providers or entities that provide, or propose to provide, services of a kind prescribed by the Accreditation Rules.
When providing accredited services, accredited entities must comply with certain privacy safeguards. These safeguards are in addition to, and build on, the safeguards contained in the Privacy Act 1988. An accredited entity may be liable to a civil penalty if certain privacy safeguards are breached.
The Digital ID Regulator oversees and maintains the Australian Government Digital ID System. Certain kinds of accredited entities can apply to the Digital ID Regulator to participate in the system. Certain kinds of relying parties can also apply for approval to participate in the system. If a relying party holds an approval, it is known as a participating relying party.
There is a System Administrator whose functions include providing assistance to entities participating in the Australian Government Digital ID System and managing the availability of the Australian Government Digital ID System.
The Digital ID Standards Chair may make Digital ID Data Standards about various matters, including technical integration requirements for entities to participate in the Australian Government Digital ID System and, if required to do so by the Accreditation Rules or the Digital ID Rules, technical, data or design standards relating to accreditation.
The Digital ID Rules may set out marks, symbols, logos or designs (called digital ID trustmarks) that may or must be used by accredited entities and participating relying parties.
The Digital ID Regulator must establish and maintain the Digital ID Accredited Entities Register and the AGDIS Register.
The Digital ID Regulator and the Information Commissioner may take enforcement action against accredited entities and other entities. The Digital ID Regulator can give directions regarding accreditation and participation in the Australian Government Digital ID System or require entities to undergo compliance assessments or produce information or documents. The System Administrator can also give directions to entities regarding participation in the Australian Government Digital ID System and require entities to produce information or documents.
Accredited entities that hold or held an approval to participate in the Australian Government Digital ID System have certain record‑keeping responsibilities and are required to destroy or de‑identify certain information in the possession or control of the entity.
Entities can apply for merits review of certain decisions made under this Act.
This Act also deals with other administrative matters such as annual reports and delegations.
This Act binds the Crown in each of its capacities.
This Act extends to every external Territory.
(1) This Act extends to acts, omissions, matters and things outside Australia.
Note: Geographical jurisdiction for civil penalty provisions is dealt with in section 160.
(2) This Act has effect in relation to acts, omissions, matters and things outside Australia subject to: (a) the obligations of Australia under international law, including obligations under any international agreement binding on Australia; and (b) any law of the Commonwealth giving effect to such an agreement.
This Act is not intended to exclude or limit the operation of a law of a State or Territory that is capable of operating concurrently with this Act.
In this Act:
Accreditation Rules means rules made under section 168 for the purposes of the provisions in which the term occurs.
accredited attribute service provider means an attribute service provider that is accredited under section 15 as an accredited attribute service provider.
accredited entity: each of the following is an accredited entity:
(a) an accredited attribute service provider;
(b) an accredited identity exchange provider;
(c) an accredited identity service provider;
(d) if Accreditation Rules are made for the purposes of paragraph 14(1)(d)—an entity that is accredited to provide services of a kind prescribed by the Accreditation Rules for the purposes of that paragraph.
accredited identity exchange provider means an identity exchange provider that is accredited under section 15 as an accredited identity exchange provider.
accredited identity service provider means an identity service provider that is accredited under section 15 as an accredited identity service provider.
accredited service, of an accredited entity, means the services provided, or proposed to be provided, by the entity in the entity’s capacity as a particular kind of accredited entity.
Note: Conditions may be imposed on an entity’s accredited services, including specifying the manner in which such services must be provided or excluding specific services from the entity’s accreditation altogether (see section 17).
Note: Example: Acme Co is an accredited identity service provider. Under its conditions of accreditation, its accredited service is generating, managing, maintaining and verifying information relating to the identity of an individual. Its conditions exclude from its accreditation the provision of the following services:
(a) generating, binding, managing and distributing authenticators to an individual;
(b) binding, managing and distributing authenticators generated by an individual.
adverse or qualified security assessment means an adverse security assessment, or a qualified security assessment, within the meaning of Part IV of the Australian Security Intelligence Organisation Act 1979.
affected entity: see section 137.
AFP Minister means the Minister administering the Australian Federal Police Act 1979.
AGDIS Register means the register kept under section 121.
APP entity has the same meaning as in the Privacy Act 1988.
APP‑equivalent agreement: see section 34.
attribute of an individual: see section 10.
attribute service provider means an entity that provides, or proposes to provide, a service that verifies and manages an attribute of an individual.
Australia when used in a geographical sense, includes the external Territories.
Australian entity means any of the following:
(a) an Australian citizen or a permanent resident of Australia;
(b) a body corporate incorporated by or under a law of the Commonwealth or a State or Territory;
(c) a Commonwealth entity, or a Commonwealth company, within the meaning of the Public Governance, Performance and Accountability Act 2013;
(d) a person or body that is an agency within the meaning of the Freedom of Information Act 1982;
(e) a body specified, or the person holding an office specified, in Part I of Schedule 2 to the Freedom of Information Act 1982;
(f) a department or authority of a State;
(g) a department or authority of a Territory;
(h) a partnership formed in Australia;
(i) a trust created in Australia;
(j) an unincorporated association that:
(i) has a governing body; and
(ii) has its central management or control in Australia.
Australian Government Digital ID System: see subsection 58(2).
authenticator means the technology for authenticating an individual’s digital ID.
Note: Passwords and cryptographic keys are examples of authenticators.
biometric information of an individual:
(a) means information about any measurable biological characteristic relating to an individual that could be used to identify the individual or verify the individual’s identity; and
(b) includes biometric templates.
civil penalty provision has the same meaning as in the Regulatory Powers Act.
compliance assessment: see section 131.
cyber security incident means one or more acts, events or circumstances that involve:
(a) unauthorised access to, modification of or interference with a system, service or network; or
(b) an unauthorised attempt to gain access to, modify or interfere with a system, service or network; or
(c) unauthorised impairment of the availability, reliability, security or operation of a system, service or network; or
(d) an unauthorised attempt to impair the availability, reliability, security or operation of a system, service or network.
decision‑maker for a reviewable decision means:
(a) for a decision under section 27 or 73—the Minister; or
(b) for a decision under section 130—the System Administrator; or
(c) otherwise—the Digital ID Regulator.
digital ID of an individual means a distinct electronic representation of the individual that enables the individual to be sufficiently distinguished when interacting online with services.
Digital ID Accredited Entities Register means the register kept under section 120.
Digital ID Data Standards means the standards made under section 99.
Digital ID Data Standards Chair means:
(a) if a person holds an appointment under section 105—that person; or
(b) otherwise—the Minister.
digital ID fraud incident means an act, event or circumstance that:
(a) occurs in connection with:
(i) an accredited service of an accredited entity; or
(ii) a service that a participating relying party is approved to provide, or provide access to, within the Australian Government Digital ID System; and
(b) results in any of the following being, or suspected of being, compromised or rendered unreliable:
(i) a digital ID of an individual;
(ii) an attribute of an individual;
(iii) an authenticator relating to an individual;
(iv) a representation relating to an attribute of an individual;
(v) a representation relating to a digital ID of an individual.
Digital ID Regulator: see section 90.
Digital ID Rules means the rules made under section 168 for the purposes of the provisions in which the term occurs.
digital ID system means a federation of entities that facilitates, manages or relies on services that provide for either or both of the following in an online environment:
(a) the verification of the identity of individuals;
(b) the authentication of a digital ID of, or information associated with, individuals.
Note: Entities in the federation may include one or more relying parties, identity exchanges, identity service providers, attribute service providers and other kinds of service providers.
digital ID trustmark: see subsection 117(2).
enforcement body has the same meaning as in the Privacy Act 1988.
enforcement related activity has the same meaning as in the Privacy Act 1988.
entity means any of the following:
(a) an individual;
(b) a body corporate;
(c) a Commonwealth entity, or a Commonwealth company, within the meaning of the Public Governance, Performance and Accountability Act 2013;
(d) a person or body that is an agency within the meaning of the Freedom of Information Act 1982;
(e) a body specified, or the person holding an office specified, in Part I of Schedule 2 to the Freedom of Information Act 1982;
(f) a department or authority of a State;
(g) a department or authority of a Territory;
(h) a partnership;
(i) an unincorporated association that has a governing body;
(j) a trust.
entrusted person: see subsection 151(2).
identity exchange provider means an entity that provides, or proposes to provide, a service that conveys, manages and coordinates the flow of data or other information between participants in a digital ID system.
identity service provider means an entity that provides, or proposes to provide, a service that:
(a) generates, manages, maintains or verifies information relating to the identity of an individual; and
(b) generates, binds, manages or distributes authenticators to an individual; and
(c) binds, manages or distributes authenticators generated by an individual.
law enforcement agency has the same meaning as in the Australian Crime Commission Act 2002.
one‑to‑many matching: see subsection 48(4).
paid work means work for financial gain or reward (whether as an employee, a self‑employed person or otherwise).
participate: an entity participates in the Australian Government Digital ID System at a particular time if, at that time:
(a) the entity holds an approval under section 62 to participate in the system; and
(b) either:
(i) the entity is directly connected to an accredited entity that is participating in the Australian Government Digital ID System; or
(ii) the entity is an accredited entity that is directly connected to a participating relying party.
participating relying party: a relying party is a participating relying party if:
(a) the relying party holds an approval under section 62 to participate in the Australian Government Digital ID System; and
(b) the participation start day for the relying party has arrived or passed.
participation start day for an entity means the day notified to the entity by the Digital ID Regulator for the purposes of paragraph 62(6)(d) as the day on which the entity must begin to participate in the Australian Government Digital ID System.
personal information:
(a) means information or an opinion about an identified individual, or an individual who is reasonably identifiable:
(i) whether the information or opinion is true or not; and
(ii) whether the information or opinion is recorded in a material form or not; and
(b) to the extent not already covered by paragraph (a), includes an attribute of an individual.
privacy impact assessment has the meaning given by subsection 33D(3) of the Privacy Act 1988.
protected information: see subsection 151(4).
Regulatory Powers Act means the Regulatory Powers (Standard Provisions) Act 2014.
relying party means an entity that relies, or seeks to rely, on an attribute of an individual that is provided by an accredited entity to:
(a) provide a service to the individual; or
(b) enable the individual to access a service.
restricted attribute of an individual: see section 11.
reviewable decision: see section 137.
Secretary means the Secretary of the Department.
security, other than in the following provisions, has its ordinary meaning:
(a) subsection 27(1);
(b) subsection 73(1);
(c) subsection 137(3).
shielded person means a person to whom one or more of the following paragraphs apply:
(a) the person has acquired or used an assumed identity under Part IAC of the Crimes Act 1914 or a corresponding assumed identity law within the meaning of that Part;
(b) an authority for the person to acquire or use an assumed identity has been granted under that Part or such a law;
(c) a witness identity protection certificate has been given for the person under Part IACA of the Crimes Act 1914;
(d) a corresponding witness identity protection certificate has been given for the person under a corresponding witness identity protection law within the meaning of Part IACA of the Crimes Act 1914;
(e) the person is a participant as defined in the Witness Protection Act 1994;
(f) the person is or was on a witness protection program conducted by a State or Territory in which a complementary witness protection law (as defined in the Witness Protection Act 1994) is in force;
(g) the person is involved in administering such a program under such a law and the person has acquired an identity under that law.
State or Territory privacy authority means a State or Territory authority (within the meaning of the Privacy Act 1988) that has functions to protect the privacy of individuals (whether or not the authority has other functions).
System Administrator: see section 94.
this Act includes:
(a) the Accreditation Rules; and
(b) the Digital ID Data Standards; and
(c) the Digital ID Rules; and
(d) the service levels determined under section 80; and
(e) the Regulatory Powers Act as it applies in relation to this Act.
verifiable credential means a tamper‑evident credential with authorship that can be cryptographically verified.
(1) An attribute of an individual means information that is associated with the individual, and includes information that is derived from another attribute. (2) Without limiting subsection (1), an attribute of an individual includes the following: (a) the individual’s current or former name; (b) the individual’s current or former address; (c) the individual’s date of birth; (d) information about whether the individual is alive or dead; (e) the individual’s phone number; (f) the individual’s email address; (g) if the individual has a digital ID—the time and date the digital ID was created; (h) biometric information of the individual; (i) a restricted attribute of the individual; (j) information or an opinion about the individual’s: (i) racial or ethnic origin; or (ii) political opinions; or (iii) membership of a political association; or (iv) religious beliefs or affiliations; or (v) philosophical beliefs; or (vi) sexual orientation or practices.
(1) A restricted attribute of an individual means: (a) health information (within the meaning of the Privacy Act 1988) about the individual; or (b) an identifier of the individual that has been issued or assigned by or on behalf of: (i) the Commonwealth, a State or a Territory; or (ii) an authority or agency of the Commonwealth, a State or a Territory; or (iii) a government of a foreign country; or (c) information or an opinion about the individual’s criminal record; or (d) information or an opinion about the individual’s membership of a professional or trade association; or (e) information or an opinion about the individual’s membership of a trade union; or (f) other information or opinion that is associated with an individual and is prescribed by the Accreditation Rules. (2) Without limiting paragraph (1)(b), an identifier of an individual includes the following: (a) the individual’s tax file number (within the meaning of section 202A of the Income Tax Assessment Act 1936); (b) the individual’s medicare number (within the meaning of Part VII of the National Health Act 1953); (c) the individual’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010); (d) if the person holds a driver’s licence issued under the law of a State or Territory—the number of that driver’s licence.
In having regard to whether an entity is a fit and proper person for the purposes of this Act, the Digital ID Regulator: (a) must have regard to the matters (if any) specified in the Digital ID Rules; and (b) may have regard to any other matters the Digital ID Regulator considers relevant.
Chapter 2—Accreditation
The Digital ID Regulator may, on application, accredit certain kinds of entities as accredited attribute service providers, accredited identity exchange providers, accredited identity service providers or entities that provide, or propose to provide, services of a kind prescribed by the Accreditation Rules.
An entity’s accreditation is subject to conditions. Some conditions are imposed by the Act and others may be imposed by the Digital ID Regulator or the Accreditation Rules. Conditions may include restrictions relating to the services an entity is accredited to provide, the manner in which those services must be provided and the kinds of restricted attributes of individuals an entity is authorised to collect or disclose.
The conditions imposed by the Digital ID Regulator on an entity’s accreditation, and the entity’s accreditation itself, can be varied or revoked. Accreditation can also be suspended.
The Minister may give directions to the Digital ID Regulator regarding the accreditation of an entity if, for reasons of security, the Minister considers it appropriate to do so. The Digital ID Regulator must comply with such directions.
An accredited entity must deactivate a digital ID of an individual if requested to do so, and must comply with requirements relating to the accessibility and useability of accredited services.
Sourced from the Federal Register of Legislation (legislation.gov.au), CC BY 4.0.
This Act is the Digital ID Act 2024.
(1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.
<table cellspacing="0" cellpadding="0" style="width:355.55pt; border-collapse:collapse"><thead><tr><td colspan="3" style="width:344.85pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Commencement information</span></p></td></tr><tr><td style="width:74.35pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Column 1</span></p></td><td style="width:180.7pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Column 2</span></p></td><td style="width:68.4pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Column 3</span></p></td></tr><tr><td style="width:74.35pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Provisions</span></p></td><td style="width:180.7pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Commencement</span></p></td><td style="width:68.4pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Date/Details</span></p></td></tr></thead><tbody><tr><td style="width:74.35pt; border-top:1.5pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="Tabletext"><span>1.</span><span> </span><span>The whole of the Act</span></p></td><td style="width:180.7pt; border-top:1.5pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="Tabletext"><span>A single day to be fixed by Proclamation.</span></p><p class="Tabletext"><span>However, if the provisions do not commence within the period of 6 months beginning on the day this Act receives the Royal Assent, they commence on the day after the end of that period.</span></p></td><td style="width:68.4pt; border-top:1.5pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="Tabletext"><span>30</span><span> </span><span>November 2024</span></p></td></tr></tbody></table>
Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.
(2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.
(1) The objects of this Act are as follows: (a) to provide individuals with secure, convenient, voluntary and inclusive ways to verify their identity in online transactions with government and businesses; (aa) to facilitate the inclusion of individuals in digital society by supporting the provision of digital ID services that are accessible for individuals who experience barriers in using such services; (b) to promote privacy and the security of personal information used to verify the identity or attributes of individuals; (c) to facilitate economic benefits for, and reduce burdens on, the Australian economy by encouraging the use of digital IDs and online services; (d) to promote trust in digital ID services amongst the Australian community. (2) These objects are to be achieved by: (a) establishing an accreditation scheme for entities providing digital ID services; and (b) providing additional privacy safeguards for the provision of accredited digital ID services; and (c) establishing an Australian Government Digital ID System that is secure, easy to use, voluntary, accessible, inclusive and reliable; and (d) strengthening the oversight and regulation of: (i) accredited digital ID service providers; and (ii) entities participating in the Australian Government Digital ID System; and (iii) the integrity and performance of the Australian Government Digital ID System.
This Act establishes an accreditation scheme for entities providing digital ID services. The Digital ID Regulator (which is the Australian Competition and Consumer Commission) may, on application, accredit certain kinds of entities as accredited attribute service providers, accredited identity exchange providers, accredited identity service providers or entities that provide, or propose to provide, services of a kind prescribed by the Accreditation Rules.
When providing accredited services, accredited entities must comply with certain privacy safeguards. These safeguards are in addition to, and build on, the safeguards contained in the Privacy Act 1988. An accredited entity may be liable to a civil penalty if certain privacy safeguards are breached.
The Digital ID Regulator oversees and maintains the Australian Government Digital ID System. Certain kinds of accredited entities can apply to the Digital ID Regulator to participate in the system. Certain kinds of relying parties can also apply for approval to participate in the system. If a relying party holds an approval, it is known as a participating relying party.
There is a System Administrator whose functions include providing assistance to entities participating in the Australian Government Digital ID System and managing the availability of the Australian Government Digital ID System.
The Digital ID Standards Chair may make Digital ID Data Standards about various matters, including technical integration requirements for entities to participate in the Australian Government Digital ID System and, if required to do so by the Accreditation Rules or the Digital ID Rules, technical, data or design standards relating to accreditation.
The Digital ID Rules may set out marks, symbols, logos or designs (called digital ID trustmarks) that may or must be used by accredited entities and participating relying parties.
The Digital ID Regulator must establish and maintain the Digital ID Accredited Entities Register and the AGDIS Register.
The Digital ID Regulator and the Information Commissioner may take enforcement action against accredited entities and other entities. The Digital ID Regulator can give directions regarding accreditation and participation in the Australian Government Digital ID System or require entities to undergo compliance assessments or produce information or documents. The System Administrator can also give directions to entities regarding participation in the Australian Government Digital ID System and require entities to produce information or documents.
Accredited entities that hold or held an approval to participate in the Australian Government Digital ID System have certain record‑keeping responsibilities and are required to destroy or de‑identify certain information in the possession or control of the entity.
Entities can apply for merits review of certain decisions made under this Act.
This Act also deals with other administrative matters such as annual reports and delegations.
This Act binds the Crown in each of its capacities.
This Act extends to every external Territory.
(1) This Act extends to acts, omissions, matters and things outside Australia.
Note: Geographical jurisdiction for civil penalty provisions is dealt with in section 160.
(2) This Act has effect in relation to acts, omissions, matters and things outside Australia subject to: (a) the obligations of Australia under international law, including obligations under any international agreement binding on Australia; and (b) any law of the Commonwealth giving effect to such an agreement.
This Act is not intended to exclude or limit the operation of a law of a State or Territory that is capable of operating concurrently with this Act.
In this Act:
Accreditation Rules means rules made under section 168 for the purposes of the provisions in which the term occurs.
accredited attribute service provider means an attribute service provider that is accredited under section 15 as an accredited attribute service provider.
accredited entity: each of the following is an accredited entity:
(a) an accredited attribute service provider;
(b) an accredited identity exchange provider;
(c) an accredited identity service provider;
(d) if Accreditation Rules are made for the purposes of paragraph 14(1)(d)—an entity that is accredited to provide services of a kind prescribed by the Accreditation Rules for the purposes of that paragraph.
accredited identity exchange provider means an identity exchange provider that is accredited under section 15 as an accredited identity exchange provider.
accredited identity service provider means an identity service provider that is accredited under section 15 as an accredited identity service provider.
accredited service, of an accredited entity, means the services provided, or proposed to be provided, by the entity in the entity’s capacity as a particular kind of accredited entity.
Note: Conditions may be imposed on an entity’s accredited services, including specifying the manner in which such services must be provided or excluding specific services from the entity’s accreditation altogether (see section 17).
Note: Example: Acme Co is an accredited identity service provider. Under its conditions of accreditation, its accredited service is generating, managing, maintaining and verifying information relating to the identity of an individual. Its conditions exclude from its accreditation the provision of the following services:
(a) generating, binding, managing and distributing authenticators to an individual;
(b) binding, managing and distributing authenticators generated by an individual.
adverse or qualified security assessment means an adverse security assessment, or a qualified security assessment, within the meaning of Part IV of the Australian Security Intelligence Organisation Act 1979.
affected entity: see section 137.
AFP Minister means the Minister administering the Australian Federal Police Act 1979.
AGDIS Register means the register kept under section 121.
APP entity has the same meaning as in the Privacy Act 1988.
APP‑equivalent agreement: see section 34.
attribute of an individual: see section 10.
attribute service provider means an entity that provides, or proposes to provide, a service that verifies and manages an attribute of an individual.
Australia when used in a geographical sense, includes the external Territories.
Australian entity means any of the following:
(a) an Australian citizen or a permanent resident of Australia;
(b) a body corporate incorporated by or under a law of the Commonwealth or a State or Territory;
(c) a Commonwealth entity, or a Commonwealth company, within the meaning of the Public Governance, Performance and Accountability Act 2013;
(d) a person or body that is an agency within the meaning of the Freedom of Information Act 1982;
(e) a body specified, or the person holding an office specified, in Part I of Schedule 2 to the Freedom of Information Act 1982;
(f) a department or authority of a State;
(g) a department or authority of a Territory;
(h) a partnership formed in Australia;
(i) a trust created in Australia;
(j) an unincorporated association that:
(i) has a governing body; and
(ii) has its central management or control in Australia.
Australian Government Digital ID System: see subsection 58(2).
authenticator means the technology for authenticating an individual’s digital ID.
Note: Passwords and cryptographic keys are examples of authenticators.
biometric information of an individual:
(a) means information about any measurable biological characteristic relating to an individual that could be used to identify the individual or verify the individual’s identity; and
(b) includes biometric templates.
civil penalty provision has the same meaning as in the Regulatory Powers Act.
compliance assessment: see section 131.
cyber security incident means one or more acts, events or circumstances that involve:
(a) unauthorised access to, modification of or interference with a system, service or network; or
(b) an unauthorised attempt to gain access to, modify or interfere with a system, service or network; or
(c) unauthorised impairment of the availability, reliability, security or operation of a system, service or network; or
(d) an unauthorised attempt to impair the availability, reliability, security or operation of a system, service or network.
decision‑maker for a reviewable decision means:
(a) for a decision under section 27 or 73—the Minister; or
(b) for a decision under section 130—the System Administrator; or
(c) otherwise—the Digital ID Regulator.
digital ID of an individual means a distinct electronic representation of the individual that enables the individual to be sufficiently distinguished when interacting online with services.
Digital ID Accredited Entities Register means the register kept under section 120.
Digital ID Data Standards means the standards made under section 99.
Digital ID Data Standards Chair means:
(a) if a person holds an appointment under section 105—that person; or
(b) otherwise—the Minister.
digital ID fraud incident means an act, event or circumstance that:
(a) occurs in connection with:
(i) an accredited service of an accredited entity; or
(ii) a service that a participating relying party is approved to provide, or provide access to, within the Australian Government Digital ID System; and
(b) results in any of the following being, or suspected of being, compromised or rendered unreliable:
(i) a digital ID of an individual;
(ii) an attribute of an individual;
(iii) an authenticator relating to an individual;
(iv) a representation relating to an attribute of an individual;
(v) a representation relating to a digital ID of an individual.
Digital ID Regulator: see section 90.
Digital ID Rules means the rules made under section 168 for the purposes of the provisions in which the term occurs.
digital ID system means a federation of entities that facilitates, manages or relies on services that provide for either or both of the following in an online environment:
(a) the verification of the identity of individuals;
(b) the authentication of a digital ID of, or information associated with, individuals.
Note: Entities in the federation may include one or more relying parties, identity exchanges, identity service providers, attribute service providers and other ki
This is an opening excerpt, not the complete document.