Director Identification Number Laws (Application) Data Standard 2022

This instrument, the Director Identification Number Laws (Application) Data Standard 2022, prescribes the data fields, collection methods, use and recording practices that the Commonwealth Registrar must follow when an individual applies for, updates, or corrects a director identification number (director ID). It is made under section 1270G of the Corporations Act 2001 and section 13 of the Commonwealth Registers Act 2020 for the purposes of subsection 1272A(4) of the Corporations Act 2001 and subsection 308-10(4) of the Corporations (Aboriginal and Torres Strait Islander) Act 2006 (see s 3). The instrument commences the day after registration (s 2).

Mechanically, the instrument:

• defines the data elements that the Registrar may require or request from applicants (s 5), including names, former names, addresses, contact details, and date and place of birth; it also permits the Registrar to request but not compel an applicant’s tax file number (TFN) (s 5(2));
• authorises the Registrar to request identity documents or information to establish identity, to request further information where identity remains unestablished, and to use third-party verification where reasonable (s 5(3)-(5));
• requires applications to be made through the Registrar’s electronic platform or an approved form, generally by the individual concerned (s 7(1)-(2));
• prescribes the timing and updating obligations about information provided at application (s 8(1)-(3));
• sets out permitted uses of director ID information, including identity establishment, record-making, validation/verification/authentication, and facilitating the Registrar’s statutory functions (s 9(1)-(4));
• requires recording and storage of information in a secure environment (s 10), allows the Registrar to correct recorded information where there is reason to believe it is incorrect (s 11), and states that electronic communication is the general default (s 12);
• imposes a signed-declaration requirement on the applicant covering identity, truthfulness of information, eligible officer status or intent to be one within 12 months, and whether the applicant already has a director ID (s 13(1)); and
• provides that the Registrar may accept applications that are substantially in accordance with the standard, and repeals the prior 2021 data standard (s 14; s 15).

The instrument itself does not create new criminal penalties; however, it explicitly notes existing offences in connected legislation for providing false or misleading information (see note in s 13 referencing s 1308 Corporations Act 2001; s 561-1 Corporations (Aboriginal and Torres Strait Islander) Act 2006; and s 137.1 Criminal Code). It also labels director ID information as "protected information" and points to secrecy and disclosure regimes in Part 9.1 of the Corporations Act 2001 and Part 4 of the Commonwealth Registers Act 2020 (s 9(2) note).

In short, the instrument operationalises how director IDs are applied for and processed by specifying minimum data, optional data, collection modalities, verification options, storage standards and applicant declarations, while leaving enforcement of false statements and disclosure controls to the referenced Acts.

The instrument frames a small number of interlocking concepts that determine how director ID applications are processed and how the Registrar handles the data.

Director ID information

• Defined as “all protected information collected in connection with the functions or powers of the Registrar under Part 9.1A of the Corporations Act 2001 and Part 6‑7A of the Corporations (Aboriginal and Torres Strait Islander) Act 2006” and includes the director ID itself, application data under the relevant sections, and any updates or corrections (definition in s 4). The instrument therefore treats operational data as “protected information” for the purposes of secrecy and disclosure regimes in the primary Acts (s 9(2) note).

Scope of required versus requested data

• The Registrar may require names, former names, addresses and former addresses, contact details, date and place of birth (s 5(1)). By contrast, the applicant’s TFN is explicitly requested but not compelled (s 5(2)). Identity documents or information are specifically authorised to be requested and collected for establishing identity (s 5(3)), and additional information may be sought if the Registrar remains not satisfied (s 5(4)). The distinction between "may require" and "may request, but not compel" matters for compliance choice: TFN is optional but may be requested; other items are framed as required.

Identity establishment options

• The instrument contemplates multiple routes to establish identity: direct documentary evidence (s 5(3)); additional information if initial evidence is inadequate (s 5(4)); and alternative identity establishment methods where the applicant cannot provide the usual information, including third-party verification by persons known to the individual, where the Registrar considers it reasonable (s 5(5)).

Collection modalities and applicant primacy

• Electronic collection is the default (s 6(1)). Paper or other non-electronic collection is available where the individual is unable to provide information electronically (s 6(2)). Applications must be made through the electronic platform or an approved form and generally by the individual concerned (s 7(1)-(2)). The Registrar retains discretion to accept applications made by another person if satisfied the individual cannot apply personally.

Use, recording, correction, and communication

• The Registrar may use director ID information for identity establishment, maintaining accuracy, record-keeping, and facilitating statutory obligations under the Corporations Act and the Aboriginal and Torres Strait Islander Corporations Act (s 9(1)-(4)). The Registrar must record and store information in a secure environment (s 10), may correct recorded information if there is reason to believe it is incorrect (s 11), and will generally communicate electronically (s 12(1)). Individuals can access the information they provided in relation to their director ID (s 12(2)).

Primary affected persons and bodies

• Individuals who are eligible officers or who will become eligible officers within 12 months, because they must apply for a director ID under the Corporations Act 2001 or the Corporations (Aboriginal and Torres Strait Islander) Act 2006. The instrument requires the applicant to declare eligible officer status or intent to become one within 12 months (s 13(1)(c)). The instrument therefore targets people who hold, or expect to hold, statutory officer roles subject to director ID rules in the referenced Acts.

Registrar and Commonwealth bodies

• The Commonwealth Registrar, as appointed under section 1270 of the Corporations Act 2001 and section 6 of the Commonwealth Registers Act 2020 (s 4), is the decision maker for data collection modalities, acceptance of forms, verification steps, corrections, storage, and communications. The Registrar may accept or require different methods in individual circumstances (s 5(5); s 6(2); s 14).

Organisations and associated entities

• While the instrument addresses individual applicants, it explicitly contemplates the Registrar using director ID information to “facilitate the director or associated entities to meet their obligations” under the Corporations Act and the Corporations (Aboriginal and Torres Strait Islander) Act (s 9(4)). That means companies, incorporated associations, Aboriginal and Torres Strait Islander corporations and other entities that are subject to directors’ obligations will be secondarily affected because their officers must meet the requirements set by the instrument when applying for or maintaining director IDs.

Intermediaries and third parties

• Third parties who may be asked to verify an individual’s identity are potentially implicated by the instrument. Section 5(5) allows the Registrar to establish identity by “other manner, which may include verification of the individual’s identity by third parties known by the individual.” The instrument does not prescribe immunity, costs or formal status for such third parties; it simply authorises their use as a verification mechanism.

Data recipients and legal actors

• Persons and agencies permitted by law to access director ID information under Part 9.1 of the Corporations Act and Part 4 of the Commonwealth Registers Act are affected because the instrument indicates the data standard creates records and stores protected information that will be accessible under the statutory disclosure regimes (s 9(2) note; s 12(3)). The instrument does not itself expand or restrict those disclosure powers beyond labelling the records as “protected information”.

Key duties placed on applicants

• Provide required information at time of application: An individual must provide the information required under s 5 when they apply for a director ID (s 8(1)). Required fields that the Registrar may collect include names and former names, addresses and former addresses, contact details, and date and place of birth (s 5(1)). The Registrar may also request identity documents or other information to establish identity (s 5(3)-(4)). The TFN is explicitly optional , the Registrar “may request, but not compel” it (s 5(2)).
• Make the application themselves: Applications must be made by the individual to whom the application relates, except where the Registrar is satisfied the individual is unable to make the application themselves (s 7(2)).
• Sign a declaration: Applicants must provide a signed declaration confirming their identity as the applicant, that information is true and correct, that they are an eligible officer or intend to become one within 12 months, and that they do not already have a director ID or have been directed to apply by the Registrar (s 13(1)).
• Notify errors and request updates: An individual with a director ID must inform the Registrar of any errors or corrections to the information provided under s 5 (s 8(3)), and may request the Registrar to update name, addresses, and contact details (s 8(2)).

Key duties placed on the Registrar

• Specify collection method and provide application platform/form: The Registrar must provide an electronic platform or an approved form for applications (s 7(1)). Electronic collection is the default, with non-electronic collection permitted where an individual cannot provide information electronically (s 6).
• Collect and use information for defined purposes: The Registrar may use director ID information to establish identity and maintain accuracy, may record information gathered in the course of processing applications, and may validate or authenticate information (s 9(1)-(3)). The Registrar may use director ID information to perform functions and exercise powers, including facilitating obligations under the Corporations Act and the Aboriginal and Torres Strait Islander Corporations Act (s 9(4)).
• Secure storage and records handling: The Registrar must record and store information in a secure environment (s 10). The instrument notes that Records Authorities may be issued by the National Archives of Australia (s 10 note).
• Correct records where appropriate: The Registrar may correct recorded information if they have reason to believe it is incorrect (s 11).

The instrument itself is a data standard and does not create new standalone criminal sanctions or a novel enforcement regime. Nevertheless, it connects applications to existing offence and disclosure frameworks in the Corporations Act 2001, the Corporations (Aboriginal and Torres Strait Islander) Act 2006 and the Criminal Code Act 1995, and establishes the data handling environment that those regimes will apply to.

Criminal and civil offences referenced

• Knowingly providing false or misleading information: The instrument notes that a person may commit an offence if they knowingly give false or misleading information, and references the specific provisions that apply , section 1308 of the Corporations Act 2001, section 561-1 of the Corporations (Aboriginal and Torres Strait Islander) Act 2006, and section 137.1 of Schedule 1 to the Criminal Code Act 1995 (s 13 note). The instrument does not reproduce the penalties in those provisions; it points applicants toward the established offence provisions in existing legislation.

Secrecy, disclosure and protected information

• Protected information and statutory control of disclosure: Director ID information is expressly characterised as "protected information" (s 9(2) note). The instrument therefore triggers the secrecy and disclosure rules in Part 9.1 of the Corporations Act 2001 and Part 4 of the Commonwealth Registers Act 2020. Those Parts include offences for unauthorised disclosure and authorised disclosure pathways; the data standard itself does not change those substantive rules but situates the records that fall under them.

Administrative enforcement and record correction

• Registrar correction power: The Registrar has an administrative power to correct any information recorded and held relating to an individual’s director ID if the Registrar has reason to believe the information is incorrect (s 11). That is an administrative correction power, not a direct enforcement sanction.

Registrar discretion and operational enforcement

• The instrument confers discretion on the Registrar to demand further information, to require identity documents, to validate/verify/authenticate information, and to reject or accept applications (s 5(3)-(4); s 9(3); s 14). While these are not statutory penalties, the Registrar’s operational decisions may produce practical effects akin to enforcement: refusal to issue a director ID until identity is established, requests for further proof, or directions to apply again (declared in s 13(1)(d) where an applicant may be directed to apply or apply again).

The data standard operates as a subordinate instrument within a network of primary legislation and administrative law norms. It is explicitly linked to multiple statutes and must be read alongside those Acts and applicable rules.

Primary statutory anchors

• Corporations Act 2001: The instrument is made under s 1270G and is for the purposes of Part 9.1A of the Corporations Act 2001 (s 3). It cross-references the Corporations Act at multiple points: the definition of “eligible officer” is drawn from s 1272B of the Corporations Act for applications made under that Act (s 4); timing obligations for who must have a director ID refer to s 1272C and s 1272E (s 8 notes); and the instrument references s 1308 of the Corporations Act as an offence provision for false or misleading information (s 13 note). The data standard thus implements procedural detail that supports the substantive director ID obligations in the Corporations Act.

• Corporations (Aboriginal and Torres Strait Islander) Act 2006: Parallel references are made for Aboriginal and Torres Strait Islander corporations. The instrument is made for the purposes of Part 6‑7A and subsection 308-10(4) and draws the meaning of “eligible officer” from s 308-15 (s 3; s 4). Timing references cite s 308-20 and s 308-30 for director ID deadlines (s 8 notes). Offence cross-reference includes s 561-1 of that Act (s 13 note).

• Commonwealth Registers Act 2020: The instrument is made under s 13 of that Act (s 3). The instrument’s definition note points to the Commonwealth Registers Act and the effect of paragraph 13(1)(b) of the Legislation Act 2003, meaning that expressions used in the data standard have the same meaning as in the Commonwealth Registers Act, Corporations Act and the Aboriginal and Torres Strait Islander Corporations Act insofar as those Acts are in force (s 4 note).

Statutory secrecy, disclosure, and protected information regimes

• Protected information: The instrument classifies director ID information as “protected information” and therefore subject to the secrecy and disclosure provisions in Part 9.1 of the Corporations Act 2001 and Part 4 of the Commonwealth Registers Act 2020 (s 9(2) note). Those primary Acts determine who may access the information, authorised disclosures, and criminal or civil consequences of unauthorised disclosure. The data standard does not alter those regimes; it confines itself to data standardisation and administrative handling.

Form and provenance

• The instrument is signed by Chris Jordan in his capacity as Commissioner of Taxation acting as the Registrar and bears the date 23 February 2022 (signature block). It is made under section 1270G of the Corporations Act 2001 and section 13 of the Commonwealth Registers Act 2020 (s 14 signature block). The commencement provision specifies operation from the day after registration on the Federal Register of Legislation (s 2).

Repeal of predecessor instrument

• The instrument expressly repeals the Corporations Director Identification Number Data Standard 2021 (F2021L00454), which was registered on 16 April 2021 (s 15). The repeal is an explicit, single-item repeal; the 2022 instrument replaces the 2021 standard as the operative data standard for director ID applications.

Definition continuity

• The instrument includes a note that, under paragraph 13(1)(b) of the Legislation Act 2003, expressions used in the instrument have the same meaning as in the Commonwealth Registers Act 2020, the Corporations Act 2001 and the Corporations (Aboriginal and Torres Strait Islander) Act 2006 “as in force from time to time” (s 4 note). That phrasing means the instrument’s operative definitions will reflect future amendments to those primary Acts without necessitating immediate amendment to the data standard itself; this is a standard drafting technique to maintain definitional alignment.

Stated acceptance of substantial compliance

• Section 14 and repeated paragraphs later in the instrument state that the Registrar may accept an individual’s application as meeting the data standard if it is substantially in accordance or has only such variations as the nature of the individual’s circumstances requires. The repetition of this acceptance clause appears multiple times in the instrument text. That clause is a durable administrative flexibility rather than an amendment provision, but it is significant for how the Registrar will treat non-standard or borderline-compliant applications.

No amendments listed beyond repeal and replacement

• The instrument contains no schedule of amendments or transitional provisions apart from the repeal of the 2021 data standard. It does not contain retrospective modification clauses or specified future amendment mechanisms. Changes to the data standard after registration would require separate instruments or amendments consistent with the Legislation Act and enabling provisions in the Corporations Act and Commonwealth Registers Act.

The instrument itself does not record or reference any litigation, judicial decisions, or administrative tribunal determinations. It is a subordinate legislative instrument setting procedural standards and therefore is not accompanied in the instrument text by any case law or litigation summary.

What is recorded in the instrument

• The instrument references statutory provisions (including offences) in primary Acts, but it does not cite, summarise or rely upon judicial construction or litigation history. The only external authorities mentioned are statutes and the signature of the Registrar (Chris Jordan).

Implication for legal research

• Because the instrument is procedural and administrative in nature, any legal contestation about its application is likely to arise in litigation concerning:
  • the Registrar’s exercise of discretion under the standard (for example, whether the Registrar unreasonably refused to accept an alternative verification method under s 5(5) or refused to accept an application by another person under s 7(2));
  • privacy and disclosure issues under Part 9.1 of the Corporations Act 2001 and Part 4 of the Commonwealth Registers Act 2020 as those Parts are applied to director ID records; or
  • alleged false or misleading statements in an application and the applicability of offence provisions cited in the instrument (s 13 note).

No cases named

• The instrument contains no named cases and does not itself generate precedent. Any litigation relating to its application will be found in decisions that interpret the primary Acts (Corporations Act, Commonwealth Registers Act, Criminal Code, and the Corporations (Aboriginal and Torres Strait Islander) Act) in the context of director IDs and their data-handling processes.

Research approach

• Practitioners seeking litigation history relevant to the data standard should therefore:
  1. Search for decisions interpreting Part 9.1A of the Corporations Act 2001 and Part 6‑7A of the Corporations (Aboriginal and Torres Strait Islander) Act 2006 (the substantive director ID provisions).
  2. Search for judicial or tribunal decisions that specifically address Registrar decisions under the data standard’s administrative powers, including disputes about verification, correction under s 11, and access to protected information under the disclosure regimes referenced in s 9(2).

Several practical and legal pitfalls emerge from the instrument’s language and structure. These are not valuation judgments; they are operational risks, discretion points and compliance traps grounded in the instrument.

TFN is requested but not required , expectations differ

• The instrument expressly states the Registrar may request, but not compel, the TFN (s 5(2)). Applicants may therefore be asked for a TFN and may be uncertain whether refusal will materially affect processing. The instrument does not state the consequences of not providing a TFN, so operational delays or further verification requests are plausible. Practitioners should not assume TFN is mandatory simply because it is requested.

Registrar discretion on identity establishment creates uncertainty

• The Registrar may request further information where identity is not established from provided documents (s 5(4)) and may establish identity by “other manner” including third-party verification when it is reasonable in the applicant’s circumstances (s 5(5)). That discretion benefits applicants with non-standard documentation but creates administrative uncertainty: the instrument does not specify standards, timelines or evidentiary thresholds for such alternative verification.

Applications generally must be made by the individual

• The instrument requires applications to be made by the individual to whom the application relates (s 7(2)). Another person may apply only if the Registrar is satisfied the individual is unable to do so. This creates an evidentiary burden on third parties seeking to file on behalf of others (for example, where an agent, family member, or legal representative seeks to act), and practitioners should plan for potential proof of inability to apply.

Electronic-first approach, but paper available only if necessary

• Electronic collection and communication are the general default (s 6(1); s 12(1)). Non-electronic options exist (s 6(2); s 12(1)), but the instrument conditions those on the individual’s inability to use electronic means. This approach may disadvantage applicants with intermittent digital access or those who cannot easily prove inability to use electronic channels.

Scope of required data includes former names and addresses

• The Registrar may require former names and former addresses (s 5(1)(a)-(b)), which can be administratively burdensome for applicants with long histories or extensive address movements. Applicants should be prepared to produce historical supporting documentation if needed.

This section sets out a practical, source-grounded checklist and procedural guidance to satisfy the instrument’s requirements and minimise compliance friction. All steps below cite the instrument’s provisions where relevant.

1. Prepare required personal information (s 5(1); s 8(1))

   • Gather current full name and any former names, current address and any former addresses, contact details (phone, email), and date and place of birth. The Registrar “may require and collect” these items (s 5(1)).
   • Keep documentary evidence for each field (for example, passports, birth certificates, marriage certificates, deeds or tenancy records for former addresses) because the Registrar “may request and collect identity documents” to establish identity (s 5(3)).

2. Be ready to provide TFN only if you choose (s 5(2))

   • The TFN is requested but not compelled. Decide whether to provide a TFN when requested; if you decline, expect the Registrar may ask for alternative identity evidence or cause additional verification steps.

3. Expect identity verification and potential follow-up (s 5(3)-(5); s 9(3))

   • The Registrar may validate, verify or authenticate information (s 9(3)). If identity is not established from initial evidence, the Registrar may request other information (s 5(4)).
   • If you are unable to provide standard identity documents, inform the Registrar early and provide reasons and alternative supporting evidence. The Registrar may accept alternative verification methods, including third-party verification by persons known to you, where reasonable in your circumstances (s 5(5)).

4. Use the electronic platform or approved form (s 7(1); s 6(1))

   • Apply using the electronic platform provided by the Registrar or an approved form (s 7(1)). The Registrar prefers electronic applications (s 6(1); s 12(1)). If you cannot apply electronically, contact the Registrar to arrange a non-electronic method (s 6(2)).

5. Apply personally unless you cannot (s 7(2))

   • The application must be made by the individual. If someone else must apply on your behalf, ensure the Registrar is satisfied that you are unable to apply personally; be prepared to provide evidence of incapacity to make the application if requested (s 7(2)).