These Rules set operational requirements for entities using the Australian Government Digital ID System: who may participate, fit-and-proper checks, application and approval conditions, incident‑reporting deadlines and content, an individual redress framework, rules for using the Digital ID trustmark, and record‑keeping obligations. They affect accredited entities, participating relying parties and certain government bodies who must adopt procedures, report cyber/fraud incidents promptly and provide support to affected individuals, creating identifiable compliance costs and enforcement points for regulators.
These rules, the Digital ID Rules 2024, implement procedural, governance, notification, redress and record-keeping requirements under the Digital ID Act 2024 (the Act) for entities that seek accreditation or approval to participate in the Australian Government Digital ID System, and for entities that are participating, suspended or revoked participants. The Rules operate by prescribing: definitions and scope (rule 1.4); what a streamlined application is (rule 1.5); fit and proper person considerations for accreditation and approvals (Chapter 2); application and approval requirements for participation, including mandatory written procedures, risk assessments and governance approvals for relying parties (Chapter 3, notably rules 3.2-3.4); a compulsory incident notification regime for cyber security and digital ID fraud incidents (Chapter 4, especially rule 4.2), plus notification obligations for other material changes (rule 4.3) and for use of other digital ID systems (rule 4.4); the System Administrator’s powers to share notified information where appropriate (rule 4.5); a redress and individual-support framework for affected individuals, including notification, assistance and referral of unresolved technical issues to the System Administrator (Chapter 4A, rules 4A.1-4A.8); a digital ID trustmark and the conditions for its use by accredited and authorised entities (Chapter 5, rules 5.1-5.4); and record-keeping obligations for participating entities (Chapter 6, rules 6.1-6.2). The Rules also include transitional timing for amendments introduced by a subsequent instrument (rule 7.1).
The instrument specifies mandatory content and timeframes. For major incident notification, an entity must notify the System Administrator as soon as practicable and no later than 1 business day after becoming aware or reasonably suspecting an incident (rule 4.2(4)). The notification content is exhaustively listed (rule 4.2(3)), and interim and follow‑up procedures for missing information are prescribed (rule 4.2(6)). For other incidents or material changes, notification to the Digital ID Regulator is required no later than 5 business days (rule 4.3(5)). Participating relying parties must retain pairwise identifiers to enable incident reporting (3.4(3) and 4.2(3)(k)). Entities (other than relying parties) must keep prescribed records for at least three years (rule 6.2). The digital ID trustmark may be used only in the circumstances and subject to conditions set out in Chapter 5 (notably 5.2-5.4), and an entity must cease use within seven days of suspension or revocation of accreditation (5.3(4)).
Current sections
Direct links to the current provisions in Digital ID Rules 2024.
36
1.1
Name
1.1 Name
These rules are the Digital ID Rules 2024.
1.3
Authority
1.3 Authority
These rules are made under section 168 of the Digital ID Act 2024 for the purposes of the provisions in the Act in which the term ‘Digital ID Rules’ occurs.
1.4
Definitions
1.4 Definitions
Note 1: A number of expressions used in these rules are defined in section 9 of the Act, including the following:
(a) accredited entity;
(b) accredited service;
(c) cyber security incident;
(d) digital ID;
(e) digital ID fraud incident;
(f) participating relying party.
Note 2: A number of expressions used in these rules are defined in rule 1.4 of the Accreditation Rules, including the following:
(a) DI data environment;
(b) identity proofing level;
(c) public-facing accredited services;
(d) public-facing information related to accredited services.
(1) Unless otherwise specified, expressions defined in the Accreditation Rules have the same meaning in these rules.
(2) In these rules:
Accreditation Data Standards means the Digital ID (Accreditation) Data Standards 2024.
Accreditation Rules means the Digital ID (Accreditation) Rules 2024.
Act means the Digital ID Act 2024.
AGDIS Data Standards means the Digital ID (AGDIS) Data Standards 2024.
associated person, of an entity, means any of the following:
(a) a person who makes, or participates in making, decisions that affect:
(i) the entity’s management of its DI data environment; or
(ii) for a participating relying party—the performance of the entity’s functions when operating in the Australian Government Digital ID System; or
(b) a person who has the capacity to significantly affect:
(i) the entity’s management of its DI data environment; or
(ii) for a participating relying party—the performance of the entity’s functions when operating in the Australian Government Digital ID System; or
(c) a person who would be a person mentioned in paragraphs (a) or (b) if the entity was an accredited entity or a participating relying party; or
(d) if the entity is a body corporate—a person who:
(i) is an associate (within the meaning of the Corporations Act) of the entity; or
(ii) is an associated entity (within the meaning of the Corporations Act) of the entity.
authentication level has the same meaning as in the Accreditation Data Standards.
Corporations Act means the Corporations Act 2001.
IXP means an accredited identity exchange provider.
material change has its ordinary meaning.
Note: The definition of ‘material change’ in these rules is different to the definition of the same expression in the Accreditation Rules.
material effect, in relation to the operation of the Australian Government Digital ID System, includes:
(a) any degradation or loss of functionality within the Australian Government Digital ID System; and
(b) any detrimental effect on the ability of an entity that participates in the Australian Government Digital ID System to access the System.
pairwise identifier, in relation to an individual, means an identifier that:
(a) identifies the individual to an accredited entity or a participating relying party; and
(b) cannot be correlated with:
(i) the individual’s identifier used by a different accredited entity or participating relying party; or
(ii) another individual’s identifier.
participating entity means an entity that holds an approval to participate in the Australian Government Digital ID System.
Privacy Act means the Privacy Act 1988.
receiving entity: see rule 1.5.
reportable incident requirement means a requirement in these rules in respect of an incident specified in Chapter 4.
streamlined application: see rule 1.5.
transferring entity: see rule 1.5.
1.5
Meaning of streamlined application
1.5 Meaning of streamlined application
In these rules, streamlined application means an application under section 61 of the Act made by an entity (the receiving entity) where:
(a) the receiving entity is of a kind mentioned in paragraph (c), (d), (e), (f) or (g) of the definition of entity in the Act; and
(b) a participating relying party (the transferring entity) that is an entity of a kind mentioned in one of those paragraphs is approved to provide, or to provide access to, one or more services within the Australian Government Digital ID System (the approved services); and
(c) a function of the transferring entity that includes the provision of the approved services is, or is reasonably expected to be, transferred to the receiving entity as a result of a machinery of government change; and
(d) the application is for an approval to provide, or to provide access to, one or more of the approved services.
Chapter 2—Fit and proper person considerations
2.1
Application of this Chapter
2.1 Application of this Chapter
(1) For the purposes of paragraph 12(a) of the Act, this Chapter specifies the matters to which the Digital ID Regulator must have regard when considering whether the person is a fit and proper person for the purposes of the Act, these rules, the Accreditation Rules, the Accreditation Data Standards and the AGDIS Data Standards.
Note: In deciding whether to accredit an entity, suspend or revoke the accreditation of an entity, approve an entity to participate in the Australian Government Digital ID System, or suspend or revoke the approval of an entity to participate in the Australian Government Digital ID System, the Digital ID Regulator may have regard to whether the entity is a fit and proper person (see subsections 15(5), 25(4), 26(3), 62(2), 71(3) and 72(3) of the Act).
(2) For the avoidance of doubt, this Chapter does not limit the matters to which the Digital ID Regulator may have regard when considering whether the person is a fit and proper person for the purposes of the Act, these rules, the Accreditation Rules, the Accreditation Data Standards and the AGDIS Data Standards.
2.2
Mandatory relevant matters
2.2 Mandatory relevant matters
(1A) This rule does not apply in relation to a streamlined application.
(1) In having regard to whether an entity is a fit and proper person, the Digital ID Regulator must have regard to the following matters:
(a) whether the entity, or an associated person of the entity, has, within the previous 10 years, been convicted or found guilty of:
(i) a serious criminal offence; or
(ii) an offence of dishonesty;
against any law of the Commonwealth or of a State or Territory, or a law of a foreign jurisdiction;
(b) whether the entity, or an associated person of the entity, has been found to have contravened:
(i) a law relevant to the management of its DI data environment; or
(ii) a similar law of a foreign jurisdiction;
(c) whether the entity, or an associated person of the entity, has been the subject of:
(i) a determination under paragraph 52(1)(b), or any of paragraphs 52(1A)(a) to (d), of the Privacy Act; or
(ii) a finding or determination of a similar nature under a similar law of a State or Territory or a foreign jurisdiction;
(d) if the entity is a body corporate—whether any of the directors of the entity, or of an associated person of the entity:
(i) has been disqualified from managing corporations; or
(ii) is subject to a banning order;
(e) whether the entity, or an associated person of the entity, has a history of insolvency or bankruptcy;
(f) whether the entity, or an associated person of the entity, has been the subject of a determination made under an external dispute resolution scheme that:
(i) included a requirement to pay compensation; and
(ii) was, at the time the determination was made:
(A) recognised under section 35A of the Privacy Act; or
(B) recognised under section 56DA of the Competition and Consumer Act 2010;
(g) if the entity has made an application under section 14 of the Act for accreditation as an accredited entity—whether the entity’s application was refused;
(h) if the entity has made an application under section 61 of the Act for approval to participate in the Australian Government Digital ID System—whether the entity’s application was refused;
(i) if the entity is or has been an accredited entity—whether the entity’s accreditation is or has been suspended or revoked;
(j) if the entity is or has been approved to participate in the Australian Government Digital ID System—whether the entity’s approval is or has been suspended or revoked.
(2) Subrule (1) does not affect the operation of Part VIIC of the Crimes Act 1914 or a corresponding provision of an Australian or a law of a foreign country.
Note: Part VIIC of the Crimes Act 1914 includes provisions that, in certain circumstances, relieve persons from the requirement to disclose spent convictions and require persons aware of such convictions to disregard them.
(3) In this rule:
banning order has the same meaning as in the Corporations Act.
director has the same meaning as in the Corporations Act.
serious criminal offence means an offence for which, if the act or omission had taken place in the Jervis Bay Territory, a person would have been liable, on first conviction, to imprisonment for a period of not less than 5 years.
Note: The Jervis Bay Territory is mentioned because it is a jurisdiction in which the Commonwealth has control over the criminal law.
2.3
Mandatory relevant matters—government entities affected by a machinery of government change
2.3 Mandatory relevant matters—government entities affected by a machinery of government change
(1) This rule applies in relation to a streamlined application.
(2) In considering whether the receiving entity is a fit and proper person, the Digital ID Regulator must have regard to whether the approval of the corresponding transferring entity to provide, or to provide access to, services within the Australian Government Digital ID System, has ever been suspended or revoked.
Chapter 3—Participation in the Australian Government Digital ID System
Part 1
Applications for approval to participate
Part 1—Applications for approval to participate
3.1
Application of this Part
3.1 Application of this Part
(1) This Part does not apply in relation to a streamlined application.
(2) For the purposes of paragraph 62(1)(f) of the Act, this Part prescribes additional requirements that must be met before the Digital ID Regulator may approve an entity to participate in the Australian Government Digital ID System.
Note: An application for approval to participate in the Australian Government Digital ID System made under section 61 of the Act must be accompanied by any information or documents required by this Part (see paragraph 141(1)(c) of the Act). The Digital ID Regulator is not required to make a decision on the application until the information or documents are provided (see subsection 143(2) of the Act).
3.2
Applications for approval to participate—all entities
3.2 Applications for approval to participate—all entities
Before approving an application for approval to participate in the Australian Government Digital ID System, the Digital ID Regulator must be satisfied that the entity has in place effective written procedures to notify the System Administrator as soon as practicable of:
(a) any proposed change to the entity’s information technology system that interacts with the Australian Government Digital ID System, if the change will, or could reasonably be expected to, have a material effect on the operation of the Australian Government Digital ID System; and
(b) any planned or unplanned outage or downtime affecting the entity’s information technology system, if the outage or downtime will, or could reasonably be expected to, have a material effect on the operation of the Australian Government Digital ID System.
3.3
Applications for approval to participate—relying parties
3.3 Applications for approval to participate—relying parties
(1) Before a relying party applies for approval to participate in the Australian Government Digital ID System, the entity must conduct a risk assessment to identify, evaluate and manage the risks of:
(a) a cyber security incident; and
(b) a digital ID fraud incident;
occurring in connection with a service that the entity intends to provide, or provide access to, within the Australian Government Digital ID System.
(2) A relying party that has made an application for approval to participate in the Australian Government Digital ID System must, at the time it makes the application, have all of the following:
(a) a written cyber security plan approved by the entity’s governing body that addresses at least the following:
(i) management of any risks identified when conducting the risk assessment referred to at paragraph (1)(a);
(ii) prevention, identification, investigation and management of cyber security incidents, including incidents notified to the entity by the System Administrator, if the entity is approved to participate in the Australian Government Digital ID System; and
(iii) the frequency with which the entity will review the plan, being at least once per year; and
(b) a written digital ID fraud management plan approved by the entity’s governing body that addresses at least the following:
(i) management of any risks identified when conducting the risk assessment referred to at paragraph (1)(b);
(ii) prevention, identification, investigation and management of digital ID fraud incidents, including incidents notified to the entity by the System Administrator, if the entity is approved to participate in the Australian Government Digital ID System; and
(iii) the frequency with which the entity will review the plan, being at least once per year; and
(c) a written disaster recovery and business continuity plan approved by the entity’s governing body that addresses at least the following:
(i) disaster recovery procedures for critical functions of the entity’s information technology system within the Australian Government Digital ID System; and
(ii) the frequency with which the entity will review the plan, being at least once per year.
Part 2
Approval to participate
Part 2—Approval to participate
3.4
Conditions on approval to participate
3.4 Conditions on approval to participate
(1) For the purposes of subsection 64(5) of the Act, the approval of an entity described in column 1 of an item of the following table is subject to the conditions specified in column 2 of the item.
<table cellspacing="0" cellpadding="0" style="width:100%; border-collapse:collapse"><thead><tr><td colspan="3" style="border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Participation conditions</span></p></td></tr><tr><td style="width:12%; border-top:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Item</span></p></td><td style="width:30.64%; border-top:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 1</span></p></td><td style="width:57.36%; border-top:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 2</span></p></td></tr><tr><td style="width:12%; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span></span></p></td><td style="width:30.64%; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Entity</span></p></td><td style="width:57.36%; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Condition</span></p></td></tr></thead><tbody><tr><td style="width:12%; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>1</span></p></td><td style="width:30.64%; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Participating relying party</span></p></td><td style="width:57.36%; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>The entity must notify the Digital ID Regulator of a proposed change to its contact details no later than 7</span><span> </span><span>days after the change takes effect.</span></p></td></tr><tr><td style="width:12%; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>2</span></p></td><td style="width:30.64%; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Participating relying party</span></p></td><td style="width:57.36%; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="margin-left:18.45pt; text-indent:-18.45pt"><span>(a)</span><span style="width:7.35pt; text-indent:0pt; display:inline-block"> </span><span>The entity must notify the System Administrator, in accordance with subrule</span><span> </span><span>(2), of the following incidents that have occurred, or are reasonably suspected of having occurred:</span></p><p class="Tabletext" style="margin-left:36.9pt; text-indent:-18.45pt"><span>(i)</span><span style="width:9.01pt; text-indent:0pt; display:inline-block"> </span><span>any proposed change to the entity’s information technology system that interacts with the Australian Government Digital ID System, if the change will, or could reasonably be expected to, have a material effect on the operation of the Australian Government Digital ID System; and</span></p><p class="Tabletext" style="margin-left:36.9pt; text-indent:-18.45pt"><span>(ii)</span><span style="width:6.23pt; text-indent:0pt; display:inline-block"> </span><span>any planned or unplanned outage or downtime affecting the entity’s information technology system, if the outage or downtime will, or could reasonably be expected to, have a material effect on the operation of the Australian Government Digital ID System.</span></p><p class="Tabletext" style="margin-left:18.45pt; text-indent:-18.45pt"><span>(b)</span><span style="width:6.79pt; text-indent:0pt; display:inline-block"> </span><span>The notification must be made no later than 5</span><span> </span><span>business days after the earliest of the following:</span></p><p class="Tabletext" style="margin-left:36.9pt; text-indent:-18.45pt"><span>(i)</span><span style="width:9.01pt; text-indent:0pt; display:inline-block"> </span><span>the entity becomes aware that the incident has occurred; or</span></p><p class="Tabletext" style="margin-left:36.9pt; text-indent:-18.45pt"><span>(ii)</span><span style="width:6.23pt; text-indent:0pt; display:inline-block"> </span><span>the entity reasonably suspects that the incident has occurred.</span></p></td></tr><tr><td style="width:12%; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>3</span></p></td><td style="width:30.64%; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Participating relying party</span></p></td><td style="width:57.36%; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>The entity must collect and store the pairwise identifier issued to the relying party in relation to each individual to enable the entity to comply with the reportable incident requirement mentioned in paragraph</span><span> </span><span>4.2(3)(k).</span></p></td></tr></tbody></table>
(2) The notification must include the following information:
(a) the entity’s name;
(b) the contact details for the entity;
(c) if the incident relates to an associated person of the entity—the name and contact details of the associated person; and
(d) a description of the incident;
(e) the following details of the incident:
(i) the date and time of the incident; and
(ii) the date on which the entity became aware of the incident.
Chapter 4—Reportable incidents
4.1
Application of this Chapter
4.1 Application of this Chapter
For the purposes of subsection 78(1) of the Act, this Chapter prescribes arrangements relating to the notification and management of incidents that have occurred, or are reasonably suspected of having occurred, in relation to the Australian Government Digital ID System.
Note: An entity is liable to a civil penalty if the entity is subject to a requirement under rules made for the purposes of subsection 78(1) and the entity fails to comply with the requirement (see subsection 78(4) of the Act).
4.2
Cyber security incidents and digital ID fraud incidents
4.2 Cyber security incidents and digital ID fraud incidents
(1) This rule applies to:
(a) a participating entity;
(b) an entity whose approval to participate is suspended; and
(c) an entity whose approval to participate has been revoked, but only in respect of incidents that have occurred, or are reasonably suspected of having occurred, while the entity was participating in the Australian Government Digital ID System.
(2) The entity must notify the System Administrator, in accordance with this rule, of any of the following:
(a) a cyber security incident; or
(b) a digital ID fraud incident;
if the incident occurred, or is reasonably suspected of having occurred, in relation to any accredited services:
(c) for an accredited entity—provided by the entity within the Australian Government Digital ID System; or
(d) for a participating relying party—received by the entity within the Australian Government Digital ID System.
(3) The notification must include the following information:
(a) the entity’s name;
(b) the contact details of the entity;
(c) the services affected by the incident;
(d) a description of the incident;
(e) the following details of the incident, so far as they are known to the entity:
(i) the date and time of the incident;
(ii) the date on which the entity became aware of the incident;
(iii) the method or source of detection of the incident;
(iv) the severity of the incident;
(v) whether the incident has been resolved; and
(vi) if the incident has been resolved—how it was resolved and how long the entity took to resolve it;
(f) each digital ID affected by the incident;
(g) for each individual whose digital ID is affected by the incident:
(i) if the individual has been informed of the incident—when the individual was informed of the incident; and
(ii) if the individual has not been informed of the incident—why the individual has not been informed of the incident;
(h) any relevant identity proofing level and authentication level and, if an individual’s digital ID has been re-proofed because of the incident, the date that occurred;
(i) the measures that the entity has taken and plans to take to deal with the incident, including any action the entity has taken or will take to reduce the risk to the accredited services the entity provides or receives within the Australian Government Digital ID System;
(j) whether the incident has been referred to an enforcement body or law enforcement agency and, if so, the body or agency to which the incident was referred and the date and time of that referral; and
(k) if the entity is a participating relying party—the pairwise identifier issued to the relying party in relation to each individual associated with the incident.
(4) The notification must be made as soon as practicable after, and in any event no later than 1 business day after, the entity becomes aware that an incident has occurred or reasonably suspects an incident has occurred.
(5) The notification may be given orally. However, if it is given orally, a written notification must be given no later than 3 business days after the oral notification.
(6) If it is not reasonably practicable for the entity to provide some or all of the information required by subrule (3) (required information) within the period specified in subrule (4) or (5), the entity is taken to comply with subrule (3) if the entity:
(a) provides an interim notification by the time required by subrule (4) or (5) that includes as much of the required information as is reasonably available to the entity at the time the interim notification is given;
(b) takes reasonable steps to obtain the outstanding required information as soon as reasonably practicable; and
(c) provides any outstanding information as soon as reasonably practicable, and in any event within 48 hours of the outstanding information becoming available to the entity.
(7) If the System Administrator receives a notification under subrule (2), the System Administrator may direct any entity of a kind mentioned in subrule (1) who has interacted with a digital ID affected by the incident to conduct an investigation into the incident.
(8) If the System Administrator directs an entity to conduct an investigation into an incident under subrule (7), that entity must:
(a) begin conducting the investigation as soon as reasonably practicable; and
(b) provide the System Administrator with a summary of the findings of the investigation as soon as reasonably practicable after the investigation is complete.
(9) However, if an investigation under subrule (7) is not completed within the period of 28 days beginning on the day the System Administrator directs the entity to conduct the investigation, the entity must update the System Administrator on the progress of the investigation:
(a) immediately after the end of that period; and
(b) at least once after the end of any subsequent period of 28 days until the investigation is complete.
4.3
Other incidents
4.3 Other incidents
(1) This rule applies to:
(a) a participating entity; and
(b) an entity whose approval to participate is suspended;
in respect of incidents that have occurred, or are reasonably suspected of having occurred, while the entity was participating in the Australian Government Digital ID System.
(2) The entity must notify the Digital ID Regulator, in accordance with this rule, of the following incidents:
(a) any material change in the entity’s circumstances that might affect its ability to comply with its obligations under the Act, these rules, the Accreditation Rules, the Accreditation Data Standards and the AGDIS Data Standards;
(b) any matter that could reasonably be considered relevant to whether the entity is a fit and proper person for the purposes of the Act, these rules, the Accreditation Rules, the Accreditation Data Standards and the AGDIS Data Standards, including matters involving an associated person of the entity; and
(c) any material change to, or error in, any of the information provided to the Digital ID Regulator.
(3) If the entity is an accredited entity—the entity must notify the System Administrator, in accordance with this rule, of the following incidents:
(a) any proposed change to the entity’s information technology system that interacts with the Australian Government Digital ID System, where the change will, or could reasonably be expected to, have a material effect on the operation of the Australian Government Digital ID System; and
(b) any planned or unplanned outage or downtime affecting the entity’s information technology system, where the outage or downtime will, or could reasonably be expected to, have a material effect on the operation of the Australian Government Digital ID System.
(4) The notification must include the following information:
(a) the entity’s name;
(b) the contact details for the entity;
(c) if the incident relates to an associated person of the entity—the name and contact details of the associated person;
(d) a description of the incident; and
(e) the following details of the incident:
(i) the date and time of the incident; and
(ii) the date on which the entity became aware of the incident.
(5) The notification must be made no later than 5 business days after the earliest of the following:
(a) the entity becomes aware that the incident has occurred; or
(b) the entity reasonably suspects that the incident has occurred.
4.4
Other digital ID systems
4.4 Other digital ID systems
(1) This rule applies to:
(a) an accredited entity that holds an approval to participate; and
(b) an accredited entity whose approval to participate is suspended.
(2) The entity must notify the Digital ID Regulator, in accordance with this rule, if:
(a) the entity uses an information technology system to provide services within the Australian Government Digital ID System; and
(b) the entity proposes to use that information technology system to provide or receive services within a digital ID system other than the Australian Government Digital ID System (other digital ID system).
(3) The notification must include the following information:
(a) the entity’s name;
(b) the contact details for the entity;
(c) a description of:
(i) the services to be provided or received by the entity within the other digital ID system; and
(ii) any accredited services provided by the entity that are the same as or similar to the services to be provided or received by the entity within the other digital ID system;
(d) details of the entity providing or managing the other digital ID system;
(e) the nature of the proposed use of the other digital ID system;
(f) the likely effect of the entity’s use of the other digital ID system on the levels of the entity’s risk of:
(i) a cyber security incident; and
(ii) a digital ID fraud incident; and
(g) details of how the entity:
(i) will clearly distinguish information flows within the Australian Government Digital ID System from information flows within the other digital ID system;
(ii) will clearly distinguish between accredited services provided in the Australian Government Digital ID System and services provided within the other digital ID system;
(iii) will ensure that information held by the entity for the purposes of the Australian Government Digital ID System is able to be located and distinguished from information held by the entity for the purposes of the other digital ID system; and
(iv) will meet its obligations under the Act, these rules, the Accreditation Rules, the Accreditation Data Standards and the AGDIS Data Standards in respect of its accredited services.
Note: Example: For subparagraphs (g)(i) and (ii), an information barrier.
(4) The notification must be made no later than 28 days before the proposed use of the other digital ID system.
(5) In this rule:
other digital ID system has the meaning given in paragraph (2)(b).
4.5
System Administrator may give information
4.5 System Administrator may give information
(1) The System Administrator may give information notified to it under rule 4.2 or subrule 4.3(3) to the Digital ID Regulator, the Minister or to a participating entity.
Note: These notifications relate to cyber security incidents and digital ID fraud incidents, proposed changes to the entity’s information technology system and planned or unplanned outages or downtime affecting the entity’s information technology system.
(2) If the System Administrator acquires information about a cyber security incident or a digital ID fraud incident otherwise than by a notification under rule 4.2 or subrule 4.3(3), the System Administrator may give the information to a participating entity.
(3) The System Administrator may only give information under this rule if it considers it appropriate to do so to protect the security, integrity or performance of the Australian Government Digital ID System.
Note: This subrule does not limit the functions of the System Administrator under the Act, which include sharing information with the Minister, the Digital ID Regulator, the Digital ID Data Standards Chair and the Information Commissioner to assist them to exercise their powers or perform their functions under the Act (see subsection 95(i) of the Act).
(4) For the purposes of paragraph 78(2)(g) of the Act, a person or body to whom the System Administrator may give information under this rule is authorised to collect the information.
Note: This rule does not limit the functions of the Digital ID Regulator under the Act, which include sharing information with the Minister, the System Administrator, the Digital ID Data Standards Chair and the Information Commissioner to assist them to exercise their powers or perform their functions under the Act (see subsection 91(f) of the Act).
Chapter 4A—Redress framework
4A.1
Application of this Chapter
4A.1 Application of this Chapter
(1) For the purposes of subsection 88(1) of the Act, this Chapter provides for a redress framework for incidents that occur in relation to accredited services of accredited entities that are provided within the Australian Government Digital ID System.
(2) This Chapter applies to an ASP or an ISP that is one of the following:
(a) a participating entity;
(b) an entity whose approval to participate is suspended;
(c) an entity whose approval to participate has been revoked.
Note 1: This Chapter deals with cyber security incidents and digital ID fraud incidents that occur in certain circumstances. Rule 4.2 (Cyber security incidents and digital ID fraud incidents) of these rules and rules 4.11 (Support to individuals), 4.30 (Support to individuals) and 5.8 (Digital IDs affected by a fraud or cyber security incident) of the Accreditation Rules also deal with cyber security incidents and digital ID fraud incidents.
Note 2: Part 5 of this Chapter does not apply to an ASP or an ISP whose approval to participate is suspended or has been revoked (see rule 4A.6).
4A.2
Notifying affected individuals of incidents
4A.2 Notifying affected individuals of incidents
(1) This rule applies if a cyber security incident or a digital ID fraud incident occurs, or is reasonably suspected of having occurred, in relation to an accredited service provided by an entity to which this Chapter applies within the Australian Government Digital ID System.
(2) The entity must make reasonable attempts to notify each individual affected by the incident.
(3) Subrule (2) does not apply if the entity is satisfied that:
(a) there is a likelihood of the individual suffering an adverse outcome as a result of the entity attempting to notify the individual of the incident; or
(b) notifying the individual will, or could reasonably be expected to, have a material effect on the operation of the Australian Government Digital ID System.
Note 1: If an entity notifies an individual under subrule (2), the entity must also provide certain information, support and assistance to the individual (see rule 4A.5).
Note 2: Material effect, in relation to the operation of the Australian Government Digital ID System, is defined in subrule 1.4(2).
Part 3
Referring unresolved technical issues to the System Administrator
Part 3—Referring unresolved technical issues to the System Administrator
4A.3
Unresolved technical issues must be referred to the System Administrator
4A.3 Unresolved technical issues must be referred to the System Administrator
(1) This rule applies if:
(a) a cyber security incident or a digital ID fraud incident occurs, or is reasonably suspected of having occurred, in relation to an accredited service provided by an entity to which this Chapter applies within the Australian Government Digital ID System; and
(b) as a result of the incident, an individual is unable to use their digital ID due to a technical issue with the entity’s service that is within the control of the entity or another entity to which this Chapter applies.
(2) The entity must refer the technical issue to the System Administrator:
(a) as soon as reasonably practicable after the entity becomes aware of the issue; and
(b) if the entity became aware of the issue because of a complaint made by the individual—in any case within 28 days after the complaint is made.
(3) However, the entity must refer the issue to the System Administrator under subrule (2) only if:
(a) the entity is reasonably satisfied that the technical issue cannot be resolved without referring it to the System Administrator; and
(b) the entity has complied with rule 4A.5 (if applicable) in relation to the incident.
Note: Rule 4A.5 is applicable if the entity became aware of the issue because of a complaint made by the individual (see paragraph 4A.5(1)(b)).
4A.4
System Administrator may recommend a resolution
4A.4 System Administrator may recommend a resolution
(1) If the System Administrator receives a referral from an entity under rule 4A.3, the System Administrator may recommend a course of action to the entity to resolve the technical issue.
(2) Without limiting subrule (1), a course of action recommended by the System Administrator may include that the entity do any of the following:
(a) provide the individual an explanation of the circumstances giving rise to the technical issue;
(b) issue an apology to the individual.
Part 4
Providing information, support and assistance to individuals affected by incidents
Part 4—Providing information, support and assistance to individuals affected by incidents
4A.5
Providing information, support and assistance to individuals affected by incidents
4A.5 Providing information, support and assistance to individuals affected by incidents
(1) This rule applies if:
(a) an entity notifies an individual about an incident under subrule 4A.2(2); or
(b) an entity becomes aware of a technical issue mentioned in rule 4A.3 because of a complaint made by an individual.
(2) The entity must:
(a) direct the individual to any relevant public resources, including the information published by the entity on the resolution of incidents and the entity’s complaints processes; and
(b) if the individual is unable to use their digital ID due to a technical issue with the entity’s service that is within the control of another entity to which this Chapter applies—provide reasonable assistance to help the individual identify that other entity and its contact details.
Part 5
Policies relating to incidents and complaints
Part 5—Policies relating to incidents and complaints
4A.6
Application of this Part
4A.6 Application of this Part
Despite subrule 4A.1(2), this Part does not apply to an ASP or an ISP that is one of the following:
(a) an entity whose approval to participate is suspended;
(b) an entity whose approval to participate has been revoked.
4A.7
Policies relating to the identification etc. of incidents
4A.7 Policies relating to the identification etc. of incidents
An entity to which this Part applies must develop and publish policies relating to the identification, management and resolution of cyber security incidents and digital ID fraud incidents that occur, or are reasonably suspected of having occurred, in relation to the accredited services provided by the entity within the Australian Government Digital ID System.
4A.8
Policies relating to complaints by individuals
4A.8 Policies relating to complaints by individuals
(1) An entity to which this Part applies must develop and publish policies relating to complaints by individuals relating to cyber security incidents and digital ID fraud incidents that occur, or are reasonably suspected of having occurred, in relation to the accredited services provided by the entity within the Australian Government Digital ID System.
(2) Without limiting subrule (1), the policies must deal with the following matters:
(a) the process by which an individual may make a complaint to the entity, including the contact details that an individual may use for that purpose;
(b) procedures for dealing with complaints made by individuals and a simplified outline of those procedures;
(c) timeframes for resolving complaints made by individuals.
(3) An entity may comply with subrule (1) by developing and publishing a policy relating to complaints by individuals:
(a) generally; or
(b) in relation to other matters as well as the matters mentioned in subrules (1) and (2).
Chapter 5—Trustmarks
5.1
Application of this Chapter
5.1 Application of this Chapter
(1) For the purposes of subsection 117(1) of the Act, this Chapter specifies the digital ID trustmark that may be used by an accredited entity and the conditions and requirements in relation to the use or display of that digital ID trustmark.
(2) For the purposes of paragraph 168(1)(b) of the Act, this Chapter also specifies the digital ID trustmark that may be used by an entity specified in rule 5.4 (authorised entity) and the conditions in relation to the use or display of that digital ID trustmark.
Note: An entity is liable to a civil penalty if:
(a) an entity uses a digital ID trustmark, but the entity is not authorised by subsection 118(1) of the Act to use the digital ID trustmark (see subsection 118(2) of the Act); or
(b) an entity is required by these rules to display a digital ID trustmark in circumstances specified in these rules and the entity fails to comply with the requirement (see section 119 of the Act).
(3) To avoid doubt, this Chapter does not affect or limit a right or remedy provided by any other law of the Commonwealth or a law of a State or Territory.
(4) In this Chapter:
authorised entity has the meaning given by subrule 5.1(2).
Digital ID Accreditation Trustmark has the meaning given by rule 5.2.
5.2
Digital ID trustmark
5.2 Digital ID trustmark
The digital ID trustmark (Digital ID Accreditation Trustmark) specified in item 1 of Schedule 1 may be used by an accredited entity and an authorised entity.
5.3
Use or display of digital ID trustmark—accredited entities
5.3 Use or display of digital ID trustmark—accredited entities
(1) This rule prescribes the conditions and requirements in relation to the use or display of the Digital ID Accreditation Trustmark by an accredited entity.
Accredited identity exchange providers
(2) The Digital ID Accreditation Trustmark may only be used or displayed by an IXP:
(a) on public-facing accredited services of the IXP;
(b) on any document that contains public-facing information related to accredited services concerning:
(i) the accredited services of the IXP; or
(ii) the accredited services of another accredited entity that is operating within the same digital ID system as the accredited services of the IXP.
Note: Example: Subparagraph (2)(b)(ii) allows an IXP to publish a list of its service providers and identify which of those providers are accredited entities by using the Digital ID Accreditation Trustmark.
Accredited entities
(3) If an accredited entity uses or displays the Digital ID Accreditation Trustmark, the accredited entity must also:
(a) use and display a hyperlink to the Digital ID Accredited Entities Register near the Digital ID Accreditation Trustmark;
(b) if a document on which the Digital ID Accreditation Trustmark is or can be printed—use and display the internet address of the Digital ID Accredited Entities Register near the Digital ID Accreditation Trustmark; and
(c) if the accredited entity also provides a service that is not an accredited service—take reasonable steps to ensure when using or displaying the Digital ID Accreditation Trustmark that it is clear which service is an accredited service and which service is not an accredited service.
(4) An entity ceases to be permitted to use or display the Digital ID Accreditation Trustmark within 7 days of the entity’s accreditation being suspended or revoked.
5.4
Use or display of digital ID trustmark—authorised entities
5.4 Use or display of digital ID trustmark—authorised entities
(1) This rule prescribes the conditions in relation to the use or display of the Digital ID Accreditation Trustmark by an authorised entity.
(2) For the purposes of this rule, the following entities are authorised entities:
(a) the Digital ID Regulator;
(b) the System Administrator;
(c) the Information Commissioner;
(d) the Secretary;
(e) the Digital ID Data Standards Chair.
(3) The Digital ID Accreditation Trustmark may only be used or displayed by an authorised entity for the following purposes:
(a) the performance of functions under or in relation to the Act;
(b) education in relation to ‘this Act’ (as defined in section 9 of the Act);
(c) promotion of the objects of ‘this Act’ (as defined in section 9 of the Act).
Chapter 6—Record-keeping
6.1
Application of this Chapter
6.1 Application of this Chapter
(1) For the purposes of subsection 135(3) of the Act, an entity specified in subrule (2) must keep records of the kind, for the period and in the manner prescribed by this Chapter.
(2) Subject to subrule (3), this Chapter applies to:
(a) an entity that holds an approval to participate in the Australian Government Digital ID System;
(b) an entity whose approval to participate in the Australian Government Digital ID System is suspended; and
(c) an entity whose approval to participate in the Australian Government Digital ID System has been revoked.
(3) This Chapter does not apply to a relying party.
(4) For the avoidance of doubt, if the accreditation of an entity is suspended or revoked, this Chapter continues to apply to the entity after its accreditation has been suspended or revoked.
6.2
Record keeping requirements
6.2 Record keeping requirements
(1) An entity must keep a prescribed record for whichever of the following periods ends later:
(a) the period of 3 years that starts on the day the record was created;
(b) the period of 3 years that starts on the day the record was last used by the entity for the purpose of providing a service that the entity is or was accredited to provide.
(2) An entity must not destroy or de-identify information contained in a prescribed record if:
(a) the information is personal information; and
(b) the information is not biometric information; and
(c) the information was obtained by the entity in the course of providing accredited services; and
(d) the entity is required or authorised to retain the information by or under:
(i) the Act, these rules or the Accreditation Rules;
(ii) a direction issued by the Digital ID Regulator under section 127 of the Act; or
(iii) a court/tribunal order (within the meaning of the Privacy Act); and
(e) the information relates to:
(i) any current or anticipated legal proceedings; or
(ii) any dispute resolution proceedings; or
(iii) a current compliance or enforcement investigation under ‘this Act’ (as defined in section 9 of the Act);
to which the entity is a party.
(3) In this rule:
prescribed record, in relation to an entity, means a record that:
(a) is a log required by subrule 4.20(7) of the Accreditation Rules; and
(b) contains personal information.
Chapter 7—Application, saving and transitional provisions
7.1
Application of amendments made by the Digital ID Amendment (Redress Framework and Other Measures) Rules 2025
7.1 Application of amendments made by the Digital ID Amendment (Redress Framework and Other Measures) Rules 2025
(1) In this rule:
amending Rules means the Digital ID Amendment (Redress Framework and Other Measures) Rules 2025.
commencement day means the day on which the amending Rules commence.
(2) Subrules 4.2(7), (8) and (9), as added by the amending Rules, apply in relation to notifications received on or after the commencement day.
(3) Rules 4A.2 and 4A.3, as inserted by the amending Rules, apply in relation to incidents that occur, or are reasonably suspected of having occurred, on or after the commencement day.
(4) Rules 4A.7 and 4A.8, as inserted by the amending Rules, apply to entities to which Part 5 of Chapter 4A applies on and after 1 July 2026.
Source text: opening excerpt
Sourced from the Federal Register of Legislation (legislation.gov.au), CC BY 4.0.
1.1 Name
1.1 Name
These rules are the Digital ID Rules 2024.
1.3 Authority
1.3 Authority
These rules are made under section 168 of the Digital ID Act 2024 for the purposes of the provisions in the Act in which the term ‘Digital ID Rules’ occurs.
1.4 Definitions
1.4 Definitions
Note 1: A number of expressions used in these rules are defined in section 9 of the Act, including the following:
(a) accredited entity;
(b) accredited service;
(c) cyber security incident;
(d) digital ID;
(e) digital ID fraud incident;
(f) participating relying party.
Note 2: A number of expressions used in these rules are defined in rule 1.4 of the Accreditation Rules, including the following:
(a) DI data environment;
(b) identity proofing level;
(c) public-facing accredited services;
(d) public-facing information related to accredited services.
(1) Unless otherwise specified, expressions defined in the Accreditation Rules have the same meaning in these rules.
(2) In these rules:
Accreditation Data Standards means the Digital ID (Accreditation) Data Standards 2024.
Accreditation Rules means the Digital ID (Accreditation) Rules 2024.
Act means the Digital ID Act 2024.
AGDIS Data Standards means the Digital ID (AGDIS) Data Standards 2024.
associated person, of an entity, means any of the following:
(a) a person who makes, or participates in making, decisions that affect:
(i) the entity’s management of its DI data environment; or
(ii) for a participating relying party—the performance of the entity’s functions when operating in the Australian Government Digital ID System; or
(b) a person who has the capacity to significantly affect:
(i) the entity’s management of its DI data environment; or
(ii) for a participating relying party—the performance of the entity’s functions when operating in the Australian Government Digital ID System; or
(c) a person who would be a person mentioned in paragraphs (a) or (b) if the entity was an accredited entity or a participating relying party; or
(d) if the entity is a body corporate—a person who:
(i) is an associate (within the meaning of the Corporations Act) of the entity; or
(ii) is an associated entity (within the meaning of the Corporations Act) of the entity.
The Rules identify who receives notifications and the types of information that may be shared by the System Administrator for security, integrity and performance reasons (rule 4.5(1)-(3)). They also create obligations on entities’ governing bodies to approve cyber security, fraud management and business continuity plans before a relying party is approved to participate (rule 3.3(2)(a)-(c)). The Rules therefore operate by shifting managerial, technical and reporting responsibilities onto applicants and participants, establishing specified time-bound incident communication lines between entities, the System Administrator and the Digital ID Regulator, and defining compliance-related record retention and public-facing policy duties for affected entities.
Official purpose claims appear in the Rules’ notes and headings (for example, rule 1.3: these rules are made under s 168 of the Act; Chapter 4 is for the purposes of subsection 78(1) of the Act). These purpose-claims frame the Rules as implementing notification, integrity and redress obligations. Measured against those claims, the Rules trade additional administrative and operational costs onto entities in return for centralised detection, reporting and coordinated response channels (System Administrator, Digital ID Regulator), explicitly creating duties that persist in a range of entity statuses, including after suspension or revocation for incidents occurring while participating (see rule 4.2(1) and rule 6.1(4)).
Main concepts
The Rules introduce and fix a set of operational concepts and legal categories that determine who has what duties, when those duties arise, and what information must be kept or communicated. Central concepts are: accredited entity, participating relying party, participating entity, participating approval, streamlined application, DI data environment, cyber security incident, digital ID fraud incident, pairwise identifier, material effect and prescribed record. Many expressions are defined in the Act or in the Accreditation Rules or Accreditation Data Standards; rule 1.4 confirms those cross-references and adds new definitions and clarifications specific to these Rules.
Streamlined application is a key procedural concept (rule 1.5). It applies where a receiving entity is of a prescribed government type and is receiving functions (approved services) from a participating relying party as the result of a machinery of government change. A streamlined application permits procedural differentiation: Chapter 2 expressly excludes streamlined applications from the main fit and proper person mandatory matters (rule 2.2(1A)), but rule 2.3 sets a narrow mandatory matter for streamlined applications,whether the corresponding transferring entity’s approval has ever been suspended or revoked.
Fit and proper person assessment is operationalised by a list of mandatory relevant matters (rule 2.2(1)). These include convictions for specified offences within the previous 10 years; contraventions of laws relevant to management of DI data environments; determinations under the Privacy Act (paragraph 52(1)(b) or paragraphs 52(1A)(a)-(d)); director disqualifications or banning orders; insolvency history; certain determinations by recognised external dispute resolution schemes; prior refusals of accreditation or participation; and suspensions or revocations of accreditation or approvals. Rule 2.2(3) defines “serious criminal offence” for this context.
Participation in the System has both application-stage and ongoing compliance elements. Before approval, all applicants must demonstrate they have effective written procedures to notify the System Administrator of any proposed IT change or planned/unplanned outage that could have a material effect on the System (rule 3.2). Relying parties face higher pre-approval governance requirements: mandatory risk assessments for cyber security and digital ID fraud risks (rule 3.3(1)); written cyber security, fraud management and disaster recovery/business continuity plans approved by the governing body, each to be reviewed at least annually (rule 3.3(2)).
Reportable incidents are split into cyber security incidents and digital ID fraud incidents (Chapter 4, rule 4.2), other incidents and material changes (rule 4.3), and matters concerning use of other digital ID systems (rule 4.4). The cyber/fraud incident regime prescribes a detailed notification form (rule 4.2(3)) and tight timeframes (notification as soon as practicable and no later than 1 business day, rule 4.2(4)), with interim reporting rules where information cannot be provided immediately (rule 4.2(6)). The System Administrator can direct entities it deems relevant to investigate and must be kept updated on investigations (rule 4.2(7)-(9)).
A redress framework (Chapter 4A) sets obligations to notify affected individuals (rule 4A.2), to refer unresolved technical issues to the System Administrator (rule 4A.3), and to provide information, support and assistance to affected individuals (rule 4A.5). It requires entities to develop and publish incident-identification, management and complaint policies (rules 4A.7-4A.8). The Rules also regulate a Digital ID Accreditation Trustmark, restricting its use to accredited entities and authorised entities and imposing conditions including hyperlinking to the Digital ID Accredited Entities Register and clear demarcation where a provider supplies accredited and non-accredited services (rules 5.2-5.4).
Record-keeping rules require participating entities (but not relying parties) to keep prescribed records for at least three years from creation or last use (rule 6.2(1)), and prohibit destruction or de-identification of certain personal information where retention is required by the Act, these Rules or other specified legal instruments (rule 6.2(2)). The prescribed record is defined to include logs required by subrule 4.20(7) of the Accreditation Rules (rule 6.2(3)).
Finally, transitional provisions (rule 7.1) specify when certain additions take effect: some amendments to rule 4.2 apply from the commencement day of the amending Rules; parts of Chapter 4A apply to incidents on or after commencement day; and parts of the redress policy requirements apply from 1 July 2026.
Who it affects
The Rules affect several overlapping classes of entities and people. Primary categories are accredited entities (including accredited identity exchange providers, IXPs), participating relying parties, participating entities (entities with approval to participate) and, in limited respects, authorised entities (rule 5.4 identifies the regulator, System Administrator, Information Commissioner, Secretary and Data Standards Chair as authorised entities for trustmark use). The Rules explicitly extend some obligations to entities whose approvals are suspended or revoked, where incidents occurred or are reasonably suspected to have occurred while they were participating (see rule 4.2(1) and rule 4.3(1)-(3)). Relying parties are excluded from Chapter 6 record-keeping obligations (rule 6.1(3)), but they face specific requirements such as the need to retain pairwise identifiers for incident reporting (3.4(3) and 4.2(3)(k)).
Individuals are affected indirectly and directly. The redress framework (Chapter 4A) creates duties for entities to notify and assist individuals affected by cyber security or digital ID fraud incidents and to provide public-facing complaint policies (rules 4A.2, 4A.5, 4A.7-4A.8). Where an incident affects an individual’s digital ID, the notification content must include whether and when the individual has been informed (rule 4.2(3)(g)(i)-(ii)), applicable identity proofing/authentication levels (rule 4.2(3)(h)), and the pairwise identifier for relying parties (rule 4.2(3)(k)).
Governing bodies, directors and associated persons are also within scope. Fit and proper person assessments extend to associated persons and to corporate directors and certain statutory disqualifications and banning orders (rule 2.2(1)(a)-(d)). Entities must have governing body approvals for cyber security, digital ID fraud and disaster recovery/business continuity plans before relying parties may be approved (rule 3.3(2)). The definition of associated person (rule 1.4) captures decision-makers and those with capacity to affect DI data environment management, broadening the personnel who will be relevant in fit and proper inquiries and compliance checks.
Third parties engaged in investigations also feature. The System Administrator can direct an entity to investigate incidents and receive summaries of investigations (rules 4.2(7)-(9)), and the System Administrator may share information with the Digital ID Regulator, the Minister and participating entities where appropriate to secure the System (rule 4.5(1)-(3)). The notes reference statutory powers (for example subsections 95(i) and 91(f) of the Act) with respect to information sharing; these note the System Administrator’s ability to share information to assist other decision-makers under the Act (rule 4.5 notes).
Who pays and who decides: financial and administrative costs fall primarily on applicants and participants. They pay for risk assessments, plans, governance approvals, monitoring mechanisms and record retention. The Digital ID Regulator and the System Administrator are decision points for approvals, suspensions, directions to investigate, and recipient bodies for notifications. The Rules build in discrete decision nodes: regulator assessments for fit and proper matters (Chapter 2), System Administrator interactions for operational incident management (Chapter 4), and the Digital ID Regulator for other notifications and authorisations (Chapter 4 and 6). The Rules allocate responsibilities across these institutional actors and impose behavioural changes on private and public entities that want to operate within the Australian Government Digital ID System.
Key duties and rights
The Rules impose a suite of affirmative duties and set out limited rights (mainly procedural), across application, operational and post-incident stages. Duties are precise in timing and content.
Pre-approval duties:
All applicants must have effective written procedures to notify the System Administrator of any proposed IT change or outage that may have a material effect on the System (rule 3.2). This is a gating condition before approval to participate.
Relying parties must conduct risk assessments of cyber security and digital ID fraud risks prior to application (rule 3.3(1)). They must also have written cyber security, digital ID fraud management, and disaster recovery/business continuity plans approved by the governing body and reviewed at least annually (rule 3.3(2)(a)-(c)).
Notification and incident duties:
Participating entities, suspended entities and revoked entities (in respect of incidents that occurred while participating) must notify the System Administrator of cyber security or digital ID fraud incidents affecting accredited services, in relation to services provided by accredited entities or services received by participating relying parties (rule 4.2(1)-(2)). The notification must be made as soon as practicable and no later than 1 business day after the entity becomes aware or reasonably suspects an incident (rule 4.2(4)).
The notification content is prescribed and extensive, requiring entity and contact details, services affected, description, timestamps, detection method, severity, resolution status and steps taken/planned, identity proofing and authentication levels, whether re-proofing occurred, referrals to law enforcement, and, for relying parties, the pairwise identifier for each individual associated with the incident (rule 4.2(3)(a)-(k)).
If immediate provision of all information is not reasonably practicable, an interim notification with available information must be given within the 1 business day period, with outstanding information supplied as soon as reasonably practicable and within 48 hours of it becoming available (rule 4.2(6)(a)-(c)).
The System Administrator may direct entities that have interacted with affected digital IDs to investigate and must be provided with summaries and updates (rule 4.2(7)-(9)).
Other notification duties:
Entities must notify the Digital ID Regulator of material changes that may affect their ability to comply with obligations, matters relevant to fit and proper status, and material changes or errors in information provided to the Regulator (rule 4.3(2)). These notifications must be made no later than 5 business days after becoming aware (rule 4.3(5)).
Accredited entities must notify the System Administrator if they propose to use an IT system used in the Australian Government Digital ID System within another digital ID system, with specified content and at least 28 days before the proposed use (rule 4.4(2)-(4)).
Redress and individual-facing duties:
Entities covered by Chapter 4A must make reasonable attempts to notify each individual affected by a cyber security or digital ID fraud incident, unless notification itself is likely to cause an adverse outcome or materially affect the System (rule 4A.2(2)-(3)). Where notification occurs, the entity must provide information, support and assistance (rule 4A.5), and entities must publish policies for incident identification and complaints handling (rules 4A.7-4A.8). Unresolved technical issues that prevent an individual using their digital ID must be referred to the System Administrator where the issue cannot be resolved by the entity and after applicable obligations to assist have been met; referrals must be made as soon as reasonably practicable and within 28 days if discovered via a complaint (rule 4A.3).
Trustmark and publication duties:
Accredited entities and authorised entities may use the Digital ID Accreditation Trustmark under the conditions set out in Chapter 5 (rules 5.2-5.4). Accredited entities must hyperlink to the Digital ID Accredited Entities Register and, where the trustmark appears on a document, include the Register’s internet address near the trustmark; they must also take reasonable steps to ensure it is clear which services are accredited and which are not (rule 5.3(3)(a)-(c)). Use ceases within seven days of suspension or revocation (rule 5.3(4)).
Record-keeping duties:
Participating entities (but not relying parties) must keep prescribed records for three years from creation or last use (rule 6.2(1)). There are express prohibitions on destroying or de-identifying certain personal information obtained while providing accredited services if retention is required or authorised by the Act, these Rules, the Accreditation Rules, a direction by the Digital ID Regulator under section 127 of the Act, or a court/tribunal order (rule 6.2(2)(a)-(e)). The prescribed record is specified to include logs required by the Accreditation Rules (rule 6.2(3)).
Rights and procedural protections:
The Rules include some time-limited and procedural protections: for example, interim reporting is permitted where full information is not available (rule 4.2(6)), notifications may be given orally initially but must be followed up in writing within three business days (rule 4.2(5)), and the System Administrator’s ability to share information is constrained by an appropriateness standard tied to protection of security, integrity or performance of the System (rule 4.5(3)). Streamlined applications receive a tailored, narrower fit and proper inquiry (rule 2.1 and rule 2.3).
These duties collectively shift risk-management, monitoring and reporting responsibilities onto entities operating inside the System, impose governance sign-offs and review cycles, mandate record retention and public-facing policy publication, and create structured channels for disclosure to central authorities and affected individuals.
Penalties and enforcement
The Rules themselves make frequent cross-references to enforcement provisions in the Act and expose entities to civil penalties where they fail to comply with requirements made for the purposes of the Act. The instrument explicitly notes that an entity is liable to a civil penalty if it is subject to a requirement made for the purposes of subsection 78(1) of the Act and fails to comply (see rule 4.1 note referring to subsection 78(4) of the Act). That connection situates the incident notification rules (Chapter 4) within the Act’s civil penalty regime.
Specific enforcement mechanisms and decision-makers referred to in the Rules include:
The Digital ID Regulator is repeatedly named as the authority who considers fit and proper person matters, receives a range of notifications (rule 4.3), may issue directions under section 127 (referenced in rule 6.2(2)(d)(ii)), and is the recipient of certain disclosures the System Administrator may make (rule 4.5(1)). These references suggest the Regulator will exercise investigatory and enforcement discretion in accordance with the Act.
The System Administrator is empowered to receive incident notifications, to direct entities to investigate incidents and to receive investigation summaries and progress updates (rule 4.2(7)-(9)). The System Administrator may share information notified to it with the Digital ID Regulator, the Minister or participating entities where appropriate to protect the System’s security, integrity or performance (rule 4.5(1)-(3)). The note to rule 4.5 references subsection 95(i) of the Act regarding the System Administrator’s functions to share information with other bodies under the Act, and the note to 4.5(4) refers to paragraph 78(2)(g) of the Act authorising recipients to collect the information.
The Rules require entities to comply with directions to investigate and report under rule 4.2(7)-(9). Failure to comply with a requirement made for the purposes of subsection 78(1) (for example, prescribed incident notifications) attracts civil penalty exposure (rule 4.1 note).
Trustmark misuse is flagged as creating liability under the Act. The Rules note that an entity is liable to a civil penalty if it uses a digital ID trustmark without being authorised under subsection 118(1) of the Act, or if it is required by these Rules to display a trustmark and fails to do so, referencing subsections 118(2) and section 119 of the Act (rule 5.1 note).
The Rules themselves do not set out criminal sanctions, fines quantum, or detailed enforcement procedures; instead, they link to enforcement and civil penalty provisions in the Act. They also create obligations that can be enforced indirectly: the requirement to retain records when directed (rule 6.2(2)(d)(ii)) or to provide investigation summaries (rule 4.2(8)) enables oversight and fact-finding. The Rules provide for continued obligations even after an entity’s approval is suspended or revoked, where incidents relate to the period when the entity participated (rule 4.2(1) and rule 6.1(4)), preserving avenues for enforcement or remedy for historical conduct.
Operational enforcement risk also arises from mandated governance approvals and annual review duties (rule 3.3(2)), which create audit points for regulator scrutiny and may be used as evidence of compliance (or non-compliance) in any enforcement process. The Rules’ time-limited obligations,notifications within 1 business day (rule 4.2(4)) or within 5 business days for other incidents (rule 4.3(5)),create specific failure events that can trigger civil penalty proceedings via the Act where a requirement of the Act has been made and breached.
The System Administrator’s discretion to share information (rule 4.5(3)) and to direct investigations (rule 4.2(7)) concentrates operational enforcement levers in a central body. That concentration enables rapid operational responses, but also imports implementation risk in the form of dependency on central decision-making for investigation referrals and direction compliance.
How it interacts with other laws
The Rules are expressly cross-referential to the Act and to other instruments referenced in the Act. Rule 1.4 continues defined terms used in the Accreditation Rules and in section 9 of the Act, ensuring conceptual alignment across the regulatory architecture. Several interactions with other laws and instruments are explicitly stated in the text and notes.
Privacy law: The Rules reference the Privacy Act 1988 (rule 1.4). Fit and proper person considerations include whether entities or associated persons have been the subject of determinations under paragraph 52(1)(b) or 52(1A)(a)-(d) of the Privacy Act (rule 2.2(1)(c)). Record-keeping prohibitions on destruction or de-identification of personal information rely in part on the definition of court/tribunal orders within the Privacy Act (rule 6.2(2)(d)(iii)). The Rules therefore sit alongside privacy compliance obligations, and in some instances require retention of personal information for legal or investigatory purposes notwithstanding ordinary privacy considerations.
Corporations and insolvency law: The Rules adopt terms from the Corporations Act 2001 regarding directors, associate, associated entity and banning orders (rule 1.4 and rule 2.2(3) note on banning orders). Fit and proper person assessments include director disqualifications and banning orders (rule 2.2(1)(d)), and insolvency or bankruptcy history is a mandatory relevant matter (rule 2.2(1)(e)). These references tie corporate governance and solvency status under corporate law into participation eligibility under the digital ID regime.
Criminal law and spent convictions: Rule 2.2(2) preserves the operation of Part VIIC of the Crimes Act 1914 and corresponding foreign equivalents regarding spent convictions, noting particular reliefs for disclosure of spent convictions and obligations to disregard them. The Rules therefore interface with criminal disclosure protections when assessing fit and proper status. Rule 2.2(3) defines a “serious criminal offence” by reference to potential imprisonment durations in the Jervis Bay Territory, linking the threshold to criminal sentencing standards.
External dispute resolution and consumer law: Rule 2.2(1)(f) makes determinations under external dispute resolution schemes that were recognised under section 35A of the Privacy Act or section 56DA of the Competition and Consumer Act 2010 relevant to fit and proper person inquiries. That interaction integrates consumer and privacy redress mechanisms into the assessment of whether an entity is fit to be accredited or participate.
Directions and regulator powers: The Rules reference directions by the Digital ID Regulator issued under section 127 of the Act as a basis for preservation of records (rule 6.2(2)(d)(ii)). The System Administrator’s functions and information sharing powers referenced in the notes (rule 4.5 note referring to subsection 95(i) of the Act) show networked statutory functions across the Act, the Regulator, Minister and other oversight bodies.
Accreditation Rules and Accreditation Data Standards: Rule 1.4 brings in definitions from the Accreditation Rules and Accreditation Data Standards. Recordkeeping obligations reference logs required by subrule 4.20(7) of the Accreditation Rules (rule 6.2(3)). The incident classes (cyber security incident; digital ID fraud incident) are defined in the Act or related standards (see rule 1.4 notes). The Rules therefore operate as a layer within a broader regulatory framework constituted by the Act and subordinate instruments.
Administrative law and remedies: While the Rules do not themselves outline merits review pathways, they create administrative decision points (approvals, suspensions, revocations, directions to investigate) that will be subject to the Act’s broader review and appeal architecture. The Rules’ obligations to publish complaint and incident policies (rules 4A.7-4A.8) interact with administrative transparency expectations and consumer-facing complaint redress mechanisms.
In summary, these Rules explicitly reference privacy, corporate, criminal, consumer and administrative law regimes and instruments. They embed cross-cutting references so that determinations under those regimes feed into fit and proper assessments, record retention and investigatory processes, and they situate the System Administrator and Digital ID Regulator as nodes for information flow across legal regimes.
Amendment history
The Rules as provided include one express transitional provision addressing future amendments: rule 7.1 deals with the application of amendments made by the Digital ID Amendment (Redress Framework and Other Measures) Rules 2025 (the amending Rules). Rule 7.1(2) provides that subrules 4.2(7), (8) and (9), as added by the amending Rules, apply to notifications received on or after the commencement day of the amending Rules. Rule 7.1(3) provides that rules 4A.2 and 4A.3, as inserted by the amending Rules, apply to incidents that occur on or after the commencement day. Rule 7.1(4) provides that rules 4A.7 and 4A.8, as inserted by the amending Rules, apply to entities to which Part 5 of Chapter 4A applies on and after 1 July 2026.
The Rules therefore already embed a forward-looking update mechanism and timetable for the redress framework and related enforcement procedures. The transitional clauses identify that certain investigatory-update provisions (rule 4.2(7)-(9)) will be phased in from the amending Rules’ commencement day, that the individual-notification and referral rules in Chapter 4A (4A.2 and 4A.3) will apply from the amending Rules’ commencement day, and that the publication requirements for incident identification and complaint policies (4A.7 and 4A.8) will come into force in relation to affected entities from 1 July 2026.
Other than rule 7.1, the instrument text does not set out a history of prior amendments. The presence of the transitional rule indicates that the Rules are to be treated as subject to future amendment by subordinate instrument, and that the drafters intended staged implementation for some redress-related duties. Practitioners should note the specific dates and commencement sequencing mandated by rule 7.1: certain obligations will apply only to notifications or incidents occurring on or after the relevant commencement day, and some publication obligations become enforceable from 1 July 2026. That phasing creates compliance sequencing obligations tied to the amending instrument’s commencement.
Because the Rules cross-reference other instruments (Accreditation Rules, Accreditation Data Standards, AGDIS Data Standards) and the Act, future changes to those instruments or to the Act will alter how these Rules operate. The transitional provisions demonstrate a controlled amendment approach for the redress and investigatory provisions; they also create an implementation window for entities to prepare for new duties that will become operative on the dates specified.
Litigation history
The text of these Rules contains no judicial decisions, enforcement proceedings, or litigation history. It names no cases and does not record prior determinations. Practically, that means there is no legal precedent embedded in the instrument itself to interpret or challenge particular obligations under the Rules. The Rules do reference statutory avenues for determinations and directions under the Act,for example, references to determinations under the Privacy Act and to the Digital ID Regulator’s functions,but they do not catalogue any litigation outcomes.
For practitioners, the absence of litigation history in the instrument means that interpretive questions will likely be resolved initially via regulator guidance, administrative decisions, and any future judicial or tribunal proceedings that arise from enforcement actions or from review of administrative decisions under the Act. The Rules create discrete compliance events that are likely to generate factual disputes about what constitutes “as soon as practicable”, when an entity “reasonably suspects” an incident, what a “material effect” on the operation of the System is, or whether an entity has a “history of insolvency” relevant to fit and proper inquiries (rules 3.2, 4.2(4), 1.4(2), 2.2(1)(e)). Those are the kinds of questions that, absent existing authority, will be fertile ground for administrative review applications and, potentially, merits or judicial review litigation under the Act’s review mechanisms.
Practitioners should track several likely litigation or dispute vectors:
disputes about timeliness and adequacy of incident notifications (for example, whether an interim notification was sufficient under rule 4.2(6));
challenges to fit and proper person findings that rely on the Rules’ mandatory matters (rule 2.2), where an entity disputes the regulator’s assessment;
enforcement actions tied to civil penalties referenced in the Rules and the Act (see rule 4.1 note), particularly where an entity is alleged to have failed to notify or to retain records as required (rules 4.2 and 6.2);
interpretation of the interaction between the Rules and the Privacy Act where retention or sharing of personal information is at issue (rules 6.2 and 4.5 notes).
Until administrative decisions or court judgments appear, the Rules themselves are the primary source of obligation. Entities should therefore plan compliance on the basis of the text, and expect that litigation and precedent will develop as the Regulator and System Administrator exercise their powers and as enforcement actions under the Act are pursued. The Rules’ built-in references to the Act’s enforcement provisions indicate the pathways that litigation would take, but the instrument does not itself supply litigation history or precedents to guide immediate dispute resolution.
Gotchas
Several specific provisions create practical pitfalls for applicants and participants. These are textual, timing, governance, documentation, and scope traps that are easily overlooked but have concrete compliance consequences under the Rules.
Narrow but consequential definition of streamlined application (rule 1.5): streamlined applications are limited to certain government transfers resulting from machinery of government changes and require the transferring entity to be an approved participating relying party. Entities that assume they qualify for a streamlined pathway without verifying those precise conditions risk missing fit and proper person scrutiny that applies to ordinary applicants (rule 2.2(1A) excludes streamlined applications from main matters, but rule 2.3 then imposes a focused check). The one mandatory matter for streamlined applications (rule 2.3) is whether the transferring entity’s approval has ever been suspended or revoked; otherwise, the receiving entity must still satisfy other legal obligations.
Short notification windows for cyber/fraud incidents (rule 4.2(4)): entities must notify the System Administrator as soon as practicable and in any event within 1 business day of awareness or reasonable suspicion. That is a tight operational timeframe compared with many corporate incident-response protocols. If complete incident data are not available within that window, the Rules require an interim notification and set a 48-hour deadline for outstanding information once it becomes available (rule 4.2(6)). Entities lacking 24/7 monitoring or established escalation lines risk missing the 1-day requirement.
Pairwise identifier retention for relying parties (3.4(3) and 4.2(3)(k)): participating relying parties must collect and store the pairwise identifier issued to them for each individual, and include it in incident notifications. This is a technical and data‑management requirement that has privacy, storage, and discovery implications. Relying parties must ensure systems capture and map those identifiers reliably; failure to do so undermines fulfilment of incident reporting and assistance duties. Note also that Chapter 6 record-keeping obligations explicitly exclude relying parties (rule 6.1(3)), but rule 3.4(3) still mandates retention of pairwise identifiers for incident reporting.
Continuing obligations after suspension or revocation (rules 4.2(1), 6.1(4)): entities whose approvals are suspended or revoked remain subject to incident notification and record-keeping obligations for incidents that occurred while they participated. This continuity can require continued administrative effort after participation ceases and must be reflected in offboarding and data retention plans.
Oral notification permitted but limited (rule 4.2(5)): an entity may give an initial oral notification, but must provide a written notification no later than three business days after the oral notification. Relying on oral communication as a substitute for immediate documentation is risky.
Different timeframes for different incident types (rule 4.3(5) vs rule 4.2(4)): other material changes or matters relevant to fit and proper status must be notified to the Digital ID Regulator no later than 5 business days, while cyber/fraud incidents have the 1 business day standard. Treating these timeframes as interchangeable is a common compliance error.
Publication and hyperlinking obligations tied to marketing (rule 5.3(3)): accredited entities displaying the trustmark must hyperlink to the Digital ID Accredited Entities Register and make service distinctions clear. Marketing, partner lists and documentation must be reviewed and maintained, and the trustmark must be removed within seven days of suspension or revocation. Organisations that use static collateral or third-party platforms must ensure they can remove or update content within that seven-day period.
Record retention traps (rule 6.2): participating entities must retain prescribed records for three years from creation or last use, and must not destroy certain personal information subject to statutory retention directions or orders. The prescribed record is tied to logs required by the Accreditation Rules (subrule 4.20(7) of the Accreditation Rules). Entities that conflate their general records retention policies with these specialised obligations risk unlawful destruction of required information.
Interaction with other digital ID systems (rule 4.4): accredited entities proposing to use the same IT systems in multiple digital ID systems must notify the Digital ID Regulator at least 28 days before proposed use, and provide detailed plans for distinguishing information flows, services and data locations (rule 4.4(3)(g)). Failure to segregate or to document segregation plans sufficiently risks regulator scrutiny and potential non-compliance.
Phased implementation (rule 7.1): some redress and investigatory provisions apply only from the amending Rules’ commencement day or from 1 July 2026. Relying on transitional timing without tracking the amending Rules’ commencement may lead to unpreparedness once those sections become enforceable. Entities must monitor commencement dates closely.
Fit and proper person scope (rule 2.2): the mandatory matters require checks on associated persons, directors and past external dispute resolution findings. The ten-year lookback for convictions and the inclusion of overseas convictions require thorough international and domestic background checks. Overlooking associated persons in due diligence is a common source of regulator concern.
System Administrator discretion to share information (rule 4.5): the System Administrator may share incident information if it considers it appropriate to protect the System’s security, integrity or performance. Entities should plan for the possibility of third-party disclosure of incident details and ensure their incident response communications and privacy notices contemplate such disclosure.
These “gotchas” are mechanistic: they derive from defined timeframes, data retention and notification content rules. They create operational dependencies (24/7 detection and escalation, data mapping of pairwise identifiers, rapid content management for trustmarks, and sustained record retention) that entities must address deliberately.
How to comply
To operationalise compliance with the Rules, entities should adopt a documented programme aligned to the specific requirements and timeframes in the Rules. The following is a compliance checklist grounded in the Rules’ provisions and sequenced by entity lifecycle stage.
Governance and pre-approval preparation
Map entity classification: determine whether your organisation is an accredited entity, participating relying party, participating entity, or an authorised entity for trustmark purposes (rule 1.4 and Chapter 5).
Prepare and document written procedures to notify the System Administrator of proposed IT changes and planned/unplanned outages that could have a material effect on the System (rule 3.2). These procedures must enable notification as soon as practicable.
For relying parties, conduct risk assessments for cyber security and digital ID fraud risks in relation to intended services (rule 3.3(1)). Document findings and mitigation plans.
Plans and governing-body approvals
Draft a written cyber security plan addressing risk-management (including risks identified in the risk assessment), prevention/identification/investigation/management of cyber security incidents, and incident notifications from the System Administrator; obtain governing body approval and schedule annual reviews (rule 3.3(2)(a)(i)-(iii)).
Draft a written digital ID fraud management plan that addresses fraud risks and includes incident management and review cadence; obtain governing body approval (rule 3.3(2)(b)).
Draft a disaster recovery and business continuity plan covering disaster recovery for critical functions within the System, with governing body approval and annual review frequency (rule 3.3(2)(c)).
Incident detection and notification mechanics
Implement 24/7 or suitably monitored detection and escalation processes to achieve notification timelines: cyber/digital ID fraud incidents must be notified as soon as practicable and no later than 1 business day after awareness or reasonable suspicion (rule 4.2(4)); other incidents to the Digital ID Regulator must be notified no later than 5 business days (rule 4.3(5)).
Prepare incident notification templates that capture the full list of required information under rule 4.2(3): entity name and contact details; services affected; incident description and timestamps; detection method; severity; resolution status and remediation steps; each affected digital ID; individual notification status; identity proofing/authentication levels and re-proofing dates; referrals to law enforcement; and pairwise identifiers for relying parties (rule 4.2(3)(a)-(k)).
Build capability to issue interim notifications if full information cannot be assembled within the 1-business-day period, and to supply outstanding information as soon as reasonably practicable and within 48 hours of it becoming available (rule 4.2(6)).
Data and technical controls
Ensure systems capture and retain the pairwise identifier for each individual for whom the relying party receives a digital ID, and ensure these identifiers can be compiled into incident notifications (rule 3.4(3) and 4.2(3)(k)).
Configure logging to meet the prescribed record requirements (rule 6.2(3) referencing Accreditation Rules subrule 4.20(7)). Maintain logs and ensure they are retrievable for three years from creation or last use (rule 6.2(1)).
For accredited entities using the same IT system across multiple digital ID systems, document how information flows, accreditation scope, data location and segregation will be achieved and notify the Digital ID Regulator at least 28 days before proposed use (rule 4.4(2)-(4)).
Publication and individual redress preparations
Prepare and publish policies for identification, management and resolution of cyber security and digital ID fraud incidents (rule 4A.7), and policies for complaints handling by individuals describing how to make complaints, procedures and timeframes (rule 4A.8). Note that 4A.7 and 4A.8 apply to entities in Part 5 of Chapter 4A from 1 July 2026 per rule 7.1(4).
For entities covered by Chapter 4A, build processes to make reasonable attempts to notify affected individuals promptly (rule 4A.2(2)) and provide the specified assistance and public resources (rule 4A.5). Where an individual cannot use their digital ID due to a technical issue within an entity’s control, refer the issue to the System Administrator if it cannot be resolved internally (rule 4A.3).
Trustmark and public-facing compliance
If using the Digital ID Accreditation Trustmark, ensure use is limited to permitted contexts: public-facing accredited services for IXPs (rule 5.3(2)), and accredited services for accredited entities (rule 5.3(3)). For accredited entities, include a hyperlink to the Digital ID Accredited Entities Register near the trustmark and, for printed documents, include the Register’s internet address near the trustmark. Make clear distinctions between accredited and non-accredited services (rule 5.3(3)(a)-(c)).
Implement rapid removal capability for trustmark use on public-facing material within seven days of any suspension or revocation of accreditation (rule 5.3(4)).
Record retention and legal holds
Maintain prescribed records for at least three years from creation or last use (rule 6.2(1)). Implement legal hold procedures to prevent destruction or de-identification of personal information where retention is required by these Rules, the Act, the Accreditation Rules, a regulator direction under s 127, or a court/tribunal order (rule 6.2(2)(a)-(d)).
Map retention obligations and ensure information governance policies reflect the interplay between privacy obligations and statutory retention requirements mentioned in rule 6.2(2).
Fit and proper person due diligence
Conduct comprehensive background checks on the entity, associated persons, and directors, including convictions in the previous 10 years for serious criminal or dishonesty offences, previous determinations under the Privacy Act, insolvency history, and external dispute resolution determinations, as these are mandatory matters for fit and proper assessment (rule 2.2(1)(a)-(f)). Document findings and remediation measures.
Operational readiness and exercises
Run tabletop and technical incident-response exercises to ensure that incident detection, interim reporting and follow-up reporting can meet the 1 business day and 48-hour post-data availability deadlines (rules 4.2(4) and 4.2(6)).
Schedule annual reviews of security, fraud management and continuity plans as required (rule 3.3(2)(a)(iii), (b)(iii), (c)(ii)).
Monitoring and liaison
Designate and maintain up-to-date contact details and notify the Digital ID Regulator of any change within seven days for participating relying parties (3.4 item 1 in the participation conditions table).
Maintain channels for receiving System Administrator notifications and for responding to directions to investigate; plan to provide investigation summaries and periodic updates if investigations extend beyond 28 days (rule 4.2(7)-(9)).
Practical compliance habits:
Keep a live compliance checklist cross-referencing the Rules’ numbered requirements.
Integrate notification templates into your incident management system so that the required fields under rule 4.2(3) auto-populate where possible.
Implement a records inventory linking each retention obligation to the relevant statutory hook (Act, these Rules, Accreditation Rules, s 127 directions, court orders).
Ensure board and governing body briefing materials and approvals are scheduled and minuted to evidence compliance with the governing-body approval requirement for plans (rule 3.3(2)).
Monitor commencement dates for amending Rules as specified in rule 7.1 to ensure readiness for staged obligations (notably the 1 July 2026 date for certain publication obligations).
Adhering to these steps aligns operational practice with the Rules’ text, reduces enforcement and operational risk, and creates documentary evidence of compliance should regulator engagement, audit or enforcement follow.
authentication level has the same meaning as in the Accreditation Data Standards.
Corporations Act means the Corporations Act 2001.
IXP means an accredited identity exchange provider.
material change has its ordinary meaning.
Note: The definition of ‘material change’ in these rules is different to the definition of the same expression in the Accreditation Rules.
material effect, in relation to the operation of the Australian Government Digital ID System, includes:
(a) any degradation or loss of functionality within the Australian Government Digital ID System; and
(b) any detrimental effect on the ability of an entity that participates in the Australian Government Digital ID System to access the System.
pairwise identifier, in relation to an individual, means an identifier that:
(a) identifies the individual to an accredited entity or a participating relying party; and
(b) cannot be correlated with:
(i) the individual’s identifier used by a different accredited entity or participating relying party; or
(ii) another individual’s identifier.
participating entity means an entity that holds an approval to participate in the Australian Government Digital ID System.
Privacy Act means the Privacy Act 1988.
receiving entity: see rule 1.5.
reportable incident requirement means a requirement in these rules in respect of an incident specified in Chapter 4.
streamlined application: see rule 1.5.
transferring entity: see rule 1.5.
1.5 Meaning of streamlined application
1.5 Meaning of streamlined application
In these rules, streamlined application means an application under section 61 of the Act made by an entity (the receiving entity) where:
(a) the receiving entity is of a kind mentioned in paragraph (c), (d), (e), (f) or (g) of the definition of entity in the Act; and
(b) a participating relying party (the transferring entity) that is an entity of a kind mentioned in one of those paragraphs is approved to provide, or to provide access to, one or more services within the Australian Government Digital ID System (the approved services); and
(c) a function of the transferring entity that includes the provision of the approved services is, or is reasonably expected to be, transferred to the receiving entity as a result of a machinery of government change; and
(d) the application is for an approval to provide, or to provide access to, one or more of the approved services.
Chapter 2—Fit and proper person considerations
2.1 Application of this Chapter
2.1 Application of this Chapter
(1) For the purposes of paragraph 12(a) of the Act, this Chapter specifies the matters to which the Digital ID Regulator must have regard when considering whether the person is a fit and proper person for the purposes of the Act, these rules, the Accreditation Rules, the Accreditation Data Standards and the AGDIS Data Standards.
Note: In deciding whether to accredit an entity, suspend or revoke the accreditation of an entity, approve an entity to participate in the Australian Government Digital ID System, or suspend or revoke the approval of an entity to participate in the Australian Government Digital ID System, the Digital ID Regulator may have regard to whether the entity is a fit and proper person (see subsections 15(5), 25(4), 26(3), 62(2), 71(3) and 72(3) of the Act).
(2) For the avoidance of doubt, this Chapter does not limit the matters to which the Digital ID Regulator may have regard when considering whether the person is a fit and proper person for the purposes of the Act, these rules, the Accreditation Rules, the Accreditation Data Standards and the AGDIS Data Standards.
2.2 Mandatory relevant matters
2.2 Mandatory relevant matters
(1A) This rule does not apply in relation to a streamlined application.
(1) In having regard to whether an entity is a fit and proper person, the Digital ID Regulator must have regard to the following matters:
(a) whether the entity, or an associated person of the entity, has, within the previous 10 years, been convicted or found guilty of:
(i) a serious criminal offence; or
(ii) an offence of dishonesty;
against any law of the Commonwealth or of a State or Territory, or a law of a foreign jurisdiction;
(b) whether the entity, or an associated person of the entity, has been found to have contravened:
(i) a law relevant to the management of its DI data environment; or
(ii) a similar law of a foreign jurisdiction;
(c) whether the entity, or an associated person of the entity, has been the subject of:
(i) a determination under paragraph 52(1)(b), or any of paragraphs 52(1A)(a) to (d), of the Privacy Act; or
(ii) a finding or determination of a similar nature under a similar law of a State or Territory or a foreign jurisdiction;
(d) if the entity is a body corporate—whether any of the directors of the entity, or of an associated person of the entity:
(i) has been disqualified from managing corporations; or
(ii) is subject to a banning order;
(e) whether the entity, or an associated person of the entity, has a history of insolvency or bankruptcy;
(f) whether the entity, or an associated person of the entity, has been the subject of a determination made under an external dispute resolution scheme that:
(i) included a requirement to pay compensation; and
(ii) was, at the time the determination was made:
(A) recognised under section 35A of the Privacy Act; or
(B) recognised under section 56DA of the Competition and Consumer Act 2010;
(g) if the entity has made an application under section 14 of the Act for accreditation as an accredited entity—whether the entity’s application was refused;
(h) if the entity has made an application under section 61 of the Act for approval to participate in the Australian Government Digital ID System—whether the entity’s application was refused;
(i) if the entity is or has been an accredited entity—whether the entity’s accreditation is or has been suspended or revoked;
(j) if the entity is or has been approved to participate in the Australian Government Digital ID System—whether the entity’s approval is or has been suspended or revoked.
(2) Subrule (1) does not affect the operation of Part VIIC of the Crimes Act 1914 or a corresponding provision of an Australian or a law of a foreign country.
Note: Part VIIC of the Crimes Act 1914 includes provisions that, in certain circumstances, relieve persons from the requirement to disclose spent convictions and require persons aware of such convictions to disregard them.
(3) In this rule:
banning order has the same meaning as in the Corporations Act.
director has the same meaning as in the Corporations Act.
serious criminal offence means an offence for which, if the act or omission had taken place in the Jervis Bay Territory, a person would have been liable, on first conviction, to imprisonment for a period of not less than 5 years.
Note: The Jervis Bay Territory is mentioned because it is a jurisdiction in which the Commonwealth has control over the criminal law.
2.3 Mandatory relevant matters—government entities affected by a machinery of government change
2.3 Mandatory relevant matters—government entities affected by a machinery of government change
(1) This rule applies in relation to a streamlined application.
(2) In considering whether the receiving entity is a fit and proper person, the Digital ID Regulator must have regard to whether the approval of the corresponding transferring entity to provide, or to provide access to, services within the Australian Government Digital ID System, has ever been suspended or revoked.
Chapter 3—Participation in the Australian Government Digital ID System
Part 1 Applications for approval to participate
Part 1—Applications for approval to participate
3.1 Application of this Part
3.1 Application of this Part
(1) This Part does not apply in relation to a streamlined application.
(2) For the purposes of paragraph 62(1)(f) of the Act, this Part prescribes additional requirements that must be met before the Digital ID Regulator may approve an entity to participate in the Australian Government Digital ID System.
Note: An application for approval to participate in the Australian Government Digital ID System made under section 61 of the Act must be accompanied by any information or documents required by this Part (see paragraph 141(1)(c) of the Act). The Digital ID Regulator is not required to make a decision on the application until the information or documents are provided (see subsection 143(2) of the Act).
3.2 Applications for approval to participate—all entities
3.2 Applications for approval to participate—all entities
Before approving an application for approval to participate in the Australian Government Digital ID System, the Digital ID Regulator must be satisfied that the entity has in place effective written procedures to notify the System Administrator as soon as practicable of:
(a) any proposed change to the entity’s information technology system that interacts with the Australian Government Digital ID System, if the change will, or could reasonably be expected to, have a material effect on the operation of the Australian Government Digital ID System; and
(b) any planned or unplanned outage or downtime affecting the entity’s information technology system, if the outage or downtime will, or could reasonably be expected to, have a material effect on the operation of the Australian Government Digital ID System.
3.3 Applications for approval to participate—relying parties
3.3 Applications for approval to participate—relying parties
(1) Before a relying party applies for approval to participate in the Australian Government Digital ID System, the entity must conduct a risk assessment to identify, evaluate and manage the risks of:
(a) a cyber security incident; and
(b) a digital ID fraud incident;
occurring in connection with a service that the entity intends to provide, or provide access to, within the Australian Government Digital ID System.
(2) A relying party that has made an application for approval to participate in the Australian Government Digital ID System must, at the time it makes the application, have all of the following:
(a) a written cyber security plan approved by the entity’s governing body that addresses at least the following:
(i) management of any risks identified when conducting the risk assessment referred to at paragraph (1)(a);
(ii) prevention, identification, investigation and management of cyber security incidents, including incidents notified to the entity by the System Administrator, if the entity is approved to participate in the Australian Government Digital ID System; and
(iii) the frequency with which the entity will review the plan, being at least once per year; and
(b) a written digital ID fraud management plan approved by the entity’s governing body that addresses at least the following:
(i) management of any risks identified when conducting the risk assessment referred to at paragraph (1)(b);
(ii) prevention, identification, investigation and management of digital ID fraud incidents, including incidents notified to the entity by the System Administrator, if the entity is approved to participate in the Australian Government Digital ID System; and
(iii) the frequency with which the entity will review the plan, being at least once per year; and
(c) a written disaster recovery and business continuity plan approved by the entity’s governing body that addresses at least the following:
(i) disaster recovery procedures for critical functions of the entity’s information technology system within the Australian Government Digital ID System; and
(ii) the frequency with which the entity will review the plan, being at least once per year.
Part 2 Approval to participate
Part 2—Approval to participate
3.4 Conditions on approval to participate
3.4 Conditions on approval to participate
(1) For the purposes of subsection 64(5) of the Act, the approval of an entity described in column 1 of an item of the following table is subject to the conditions specified in column 2 of the item.