Emergency Management Regulations 2006

The Regulations rest on a small set of organising legal concepts that determine jurisdiction, responsibilities and information flows.

• Hazard and hazard list: The Regulations expand the Act’s definition of hazard by prescribing additional events, situations or conditions (reg 15). These include land/water search and rescue events, nuclear warship radiation escape, space re‑entry debris, trapped persons from collapses, chemical/biological/radiological spills, epidemics, animal/plant pests or diseases, vessel incidents, oil spills, interruptions to energy supplies (natural gas, liquid fuel, electricity), heatwaves, hostile acts and cybersecurity incidents. Each listed hazard is a trigger for emergency management arrangements and for designation of a hazard management agency (reg 15).
• Hostile act, defined by conduct and reasonable suspicion: Regulation 14A defines "hostile act" through a set of examples and subcategories: use or threatened use of explosive or hazardous substances (14A(2)); possession or use of firearms or weapons when they cause or are reasonably suspected to be used to cause death or serious harm (14A(3)); use of vehicles or aircraft as weapons (14A(4)); and events such as hostage‑taking, kidnapping, sieges and hijackings (14A(1)(b)). The test repeatedly includes "reasonable suspicion", which is an evidential standard in the Regulations (reg 14A(1)-(4)).
• Cybersecurity incident: Regulation 14B introduces an express definition of cybersecurity incident tied to electronic systems. An "electronic system" is defined expansively to include networks, services, programs, devices and electronic information (14B(1)). A cybersecurity incident exists where an electronic system is modified or impaired in ways that could cause death, safety prejudice or damage to property/environment, or where there is a threat or reasonable suspicion of that modification or impairment (14B(2)-(3)).
• Hazard management agencies and territorial allocation: The Regulations map hazards to named HMAs and define the geographic areas for which they are responsible. Examples include the Commissioner of Police as HMA for air crashes, road crashes, State‑wide hostile act and certain maritime incidents in State waters and port areas (reg 16); the FES Commissioner for fires, floods, cyclones, tsunamis and chemical releases (reg 17); the Chief Health Officer for epidemics and heatwaves (reg 22); the Coordinator of Energy for fuel and electricity supply interruptions (reg 23B); the chief executive officer of the Transport Department for vessel incidents and oil spills in State waters and port areas (reg 23A); and ARC Infrastructure Pty Ltd and the Public Transport Authority for rail crashes on particular land (regs 20-21). Several HMAs are limited to particular land parcels, corridor land or State waters (regs 20-21, 16(2), 23A(2)-(3)).
• Information exchange: The Regulations prescribe categories of “relevant information” (reg 23) for the purposes of s 72(1) of the Act and limit onward disclosure and storage of that information to what is “reasonably necessary” for emergency management, backed by $1 000 fines for unauthorised further disclosure or failure to store securely (regs 24-25).
• Enforcement by infringement notices: The Regulations make the failure to comply with a direction under s 86(1) an offence eligible for infringement notices under the Criminal Procedure Act 2004 Part 2, set modified penalties ($1 000 individual, $5 000 corporate), and allow the State Emergency Coordinator to appoint approved and authorised officers who may issue or handle infringement notices (regs 33-35 and Schedule 1).

These concepts shape how discretion is allocated and how operational responses are structured. The presence of "reasonable suspicion" standards and the "reasonably necessary" limitation on disclosure are recurring legal thresholds that will influence on‑the‑ground choices by HMAs, hazard management officers and private entities involved in emergency responses.

The Regulations affect a wide set of public and private actors through defined duties, information flows and enforcement mechanisms.

• State bodies and officials: Ministers, the SEMC and its members (regs 2-13); hazard management agencies as named entities and officeholders (regs 16-23C); the State Emergency Coordinator, who may appoint approved and authorised officers for infringement notices (reg 34); and agency officers who act as hazard management officers or authorised officers under the Act and these Regulations (multiple provisions).
• Departments and combat/support agencies: The Health Department, FES Department, Environment Department, Police Force/Police Service, Communities Department, St John Ambulance, local government and others are designated combat agencies or support organisations for specified activities (regs 26-32). These designations allocate operational responsibilities such as health services, fire suppression and welfare services.
• Statutory and private operators of critical infrastructure: The Regulations name public statutory bodies and at least one private corporation as HMAs: ARC Infrastructure Pty Ltd is assigned HMA duties for rail crashes on infrastructure it operates (reg 21). The Public Transport Authority and the chief executive officer of the Transport Department are designated for rail and maritime/hazmat contexts (regs 20, 23A).
• Owners and operators of electronic systems and electronic information: The definition of "electronic system" and the inclusion of information relating to the person who owns, controls or manages electronic information or systems among the types of "relevant information" mean private IT providers, network operators, cloud hosts and critical infrastructure operators may be asked to disclose information and to ensure secure storage (regs 14B(1), 23( d)-(e), 23( f)).
• Individuals and businesses in emergencies: Persons who fail to comply with a direction under s 86(1) of the Act may receive infringement notices (reg 33 and Schedule 1). The modified penalties and the infringement notice process in Schedule 1 have direct financial and procedural consequences for individuals and bodies corporate.
• Welfare service providers and contracted entities: Regulation 24 allows hazard management officers or authorised officers to disclose relevant information to a person or entity engaged by an emergency management agency to provide welfare services during an emergency situation or state of emergency, subject to onward disclosure and storage limits (reg 24(1), (2), (3) and reg 25). Contracted NGOs and private welfare providers are thus subject to limitations on use, further disclosure and storage of the information they receive.
• Local governments: Designated as combat agencies for fire suppression (reg 31) and therefore exposed to operational, financial and liability consequences when fire suppression is required.

Who pays and bears operational costs, in practical terms, depends on the designation. Where State departments are HMAs or combat agencies (for example FES Department, Health Department), the State bears the primary operational expense. Where private or local entities are HMAs or combat or support organisations (ARC Infrastructure, local government, contracted welfare providers), those entities may bear immediate operational or compliance costs and could expect indemnities, reimbursements or funding arrangements to flow from emergency arrangements under the Act or separate instruments; the Regulations themselves do not set out funding mechanisms. Enforcement costs and fines fall on the entity or person found responsible for breach of the specific Regulations (for example, $1 000 fines in regs 24-25, modified penalties under reg 33).

The Regulations assign responsibilities to agencies, constrain use and disclosure of information, and provide procedural rights through the infringement notice process.

• SEMC procedural duties: The SEMC must keep accurate minutes of proceedings and resolutions (reg 11). The Regulations set meeting procedures: the chairman may convene special meetings (reg 9(2)); quorum requires at least half the members in office including the chairman or deputy (reg 10); members may participate by telephone or instantaneous communication (reg 12); and written resolutions signed or assented to by each member have effect as meeting resolutions (reg 13). Members may be removed for neglect, misbehaviour, incompetence or incapacity (reg 4(2)). These are administrative duties and conditions governing the exercise of SEMC functions under the Act (reg 2 implements s 13(2) composition).
• Hazard management agency duties: HMAs identified in regs 16-23C are responsible for "emergency management" of the specified hazards and areas. That duty corresponds to functions under the Act such as coordinating response and issuing directions via hazard management officers. The Regulations also authorise specific officers to act in the name of a Department for the purposes of sections 50 and 53 of the Act and to authorise hazard management officers under s 55(1) (reg 23C(3)-(4) for the Department of the Premier and Cabinet and the Government Chief Information Officer).
• Information‑handling duties and constraints: Regulations 23-25 specify the types of relevant information (for s 72(1) of the Act) including financial/insurance information, owner/occupier of property, and information about who owns or manages electronic information and systems (reg 23(a)-(f)). During an emergency situation or state of emergency, a hazard management officer or authorised officer may disclose relevant information to an entity engaged to provide welfare services (reg 24(1) referencing s 72(2)(a)(ii)). Agencies receiving relevant information under s 72(2)(a)(i) must not further disclose it unless "reasonably necessary" for emergency management and face a $1 000 fine for unauthorised further disclosure (reg 24(2)). Likewise, persons or entities receiving relevant information under s 72(2)(a)(ii) must not further disclose it unless reasonably necessary, subject to a $1 000 fine (reg 24(3)). Agencies, persons or entities must keep disclosed relevant information secure so far as reasonably practicable, with a $1 000 penalty for breach (reg 25).
• Combat and support roles: Combat agencies are assigned specific emergency management activities: Health Department and St John Ambulance for providing health services (regs 26-27); Police Force and Police Service for disaster victim identity management (regs 28-29); Environment Department, FES Department and local governments for fire suppression (regs 30, 30A, 31); Communities Department as support organisation for welfare services (reg 32). These are duty assignments; the Regulations do not itself set funding or indemnity rights.
• Enforcement rights and procedures for alleged offenders: The offence in s 86(1) (failure to comply with a direction) is prescribed as one for which an infringement notice may be issued under the Criminal Procedure Act 2004 Part 2 (reg 33(1)). Modified penalties are set at $1 000 for individuals and $5 000 for bodies corporate (reg 33(2)). The State Emergency Coordinator may appoint approved officers and police may be appointed as authorised officers to issue infringement notices (reg 34). The forms in Schedule 1 set out how infringement notices and withdrawals are to be presented and the rights of the alleged offender to elect court prosecution rather than pay the modified penalty (Schedule 1, Form 1 Part D).
• Delegation and appointment powers: The Minister appoints SEMC members and deputies (regs 2 and 7). The State Emergency Coordinator appoints approved and authorised officers for the infringement regime (reg 34). The chief executive of the Department of the Premier and Cabinet and the Government Chief Information Officer are explicitly authorised to act in the name of the Department for specified Act sections and authorising hazard management officers (reg 23C(3)-(4)). These appointment powers allocate decision rights among named officials.

Rights of affected persons derive primarily from the infringement procedure (right to elect court proceedings; notice periods in Schedule 1) and from statutory safeguards on information disclosure (limited onward disclosure and storage obligations and penalties). The Regulations do not create direct private rights of action or detailed compensation schemes; such matters would be governed by the Act or other statutes not detailed in this instrument.

The Regulations create specific civil penalty and infringement mechanisms and set criminal procedure links for enforcement.

• Monetary penalties for information misuse and storage: Regulations 24 and 25 impose specified fines for improper handling of "relevant information". An agency receiving relevant information under s 72(2)(a)(i) must not further disclose unless reasonably necessary; contravention attracts a fine of $1 000 (reg 24(2)). A person or entity receiving relevant information under s 72(2)(a)(ii) (welfare service contractors) is likewise prohibited from further disclosure except where reasonably necessary; contravention attracts a $1 000 fine (reg 24(3)). The obligation to store disclosed relevant information securely is statutory, and breach is punishable by a $1 000 fine (reg 25). These fines are set in the Regulations and apply in addition to any other law.
• Infringement notices for failure to comply with a direction: The offence in s 86(1) of the Act (failure to comply with a direction) is prescribed as an offence for which an infringement notice may be issued (reg 33(1)). The modified penalties applicable if an infringement notice is issued are $1 000 for individuals and $5 000 for bodies corporate (reg 33(2)). The relevant enforcement procedure is under the Criminal Procedure Act 2004 Part 2; the Regulations also prescribe the forms for infringement notices and withdrawals (reg 35 and Schedule 1).
• Appointment of officers to issue/handle notices: The State Emergency Coordinator may appoint persons or classes of persons to be approved officers for the purposes of the Criminal Procedure Act 2004 Part 2, and may appoint police officers or classes of police officers to be authorised officers to issue infringement notices for the prescribed offence (reg 34(1)-(2)). A police officer so appointed may show authority by exhibiting a Certificate of Authority under the Police Force Regulations 1979 (reg 34(3)). This creates an administrative enforcement pathway that can operate without criminal prosecution where the modified penalty is paid.
• Procedural enforcement steps and consequences: Schedule 1 Form 1 sets out the content of an infringement notice, time limits (28 days to pay or elect to proceed to court), and notices about consequences of non‑payment (referral to enforcement under the Fines, Penalties and Infringement Notices Enforcement Act 1994 listed in the Form). The Form lists enforcement actions available under the enforcement Act such as suspension or cancellation of driver’s or vehicle licences, garnishment of earnings or bank accounts, immobilisation or seizure of vehicles, publication of details, and seizure and sale of property. Those enforcement mechanisms are not created by these Regulations but are referenced as possible enforcement steps once a modified penalty remains unpaid and enforcement proceeds under the Fines, Penalties and Infringement Notices Enforcement Act 1994.
• Limits and criminal liability: The Regulations do not themselves create new criminal offences beyond the monetary fines and the prescription of s 86(1) as an offence suitable for an infringement notice. Criminal liability under other statutes may continue to be available for conduct that meets thresholds for criminal prosecution.

Enforcement architecture therefore combines administrative appointment of authorised officers, civil monetary sanctions via infringement notices, and specific low‑value fines for information misuse and storage failures. The involvement of the State Emergency Coordinator in appointing authorised officers concentrates enforcement decision rights in that official (reg 34). The Regulations give agencies and contractors limited criminal exposure under monetary fines; the serious penalties available via Fines Enforcement infrastructure apply to unpaid modified penalties once enforcement action commences.

The Regulations are heavily cross‑referential and operate in tandem with the Emergency Management Act 2005 and multiple other statutes. The instrument serves to allocate responsibilities under the Act and to align terminology and scope with other statutes.

• Anchor to the Act: The Regulations implement and supplement provisions of the Emergency Management Act 2005. Examples include SEMC membership under s 13(2) implemented by reg 2; the meaning of “relevant information” under s 72 expanded by regs 23-25; and the offence under s 86(1) made eligible for infringement notices under reg 33. The instrument repeatedly cites sections of the Act (regs 2, 23-25, 33, 23C(3)-(4) referencing s 50, s 53, s 55(1)).
• Criminal Procedure Act 2004: The infringement notice pathway is implemented via the Criminal Procedure Act 2004 Part 2. Reg 33 prescribes the offence for which an infringement may be issued and reg 34 establishes appointment powers for approved and authorised officers under that Part. Schedule 1 prescribes the forms used in that process for consistency with the Criminal Procedure Act.
• Police Force Regulations 1979: Reg 34(3) permits an authorised police officer to show authority by producing a Certificate of Authority defined in Police Force Regulations 1979 regulation 901A.
• Sectoral statutes that define territory or technical terms: The Regulations import or rely on definitions and territorial concepts drawn from other statutes: corridor land (Rail Freight System Act 2000 s 3) and railway infrastructure (reg 14); the meaning of “explosive substance” from The Criminal Code s 455 (reg 14); "weapon" from Weapons Act 1999 s 3 (reg 14); "State waters" tied to the Coastal Waters (State Powers) Act 1980 (Commonwealth) s 3(1) (reg 14); ports and port areas referenced to the Shipping and Pilotage Act 1967 s 3 and Port Authorities Act 1999 s 24 (regs 16(2), 23A(2)(b)(ii)-(iii), 23A(3)(b)(ii)-(iii)). These references determine the geographic reach of particular HMAs and thus interact with federal jurisdictional concepts.
• Health, biosecurity and energy laws: The Regulations align HMAs with other sectoral statutes: the Agriculture Director General is defined by reference to the Biosecurity and Agriculture Management Act 2007 s 6 (reg 19); the Health Department references the Public Health Act 2016 (reg 1A, reg 22); the Coordinator of Energy as defined in the Energy Coordination Act 1994 is assigned responsibility for energy supply hazards (reg 23B). These alignments coordinate emergency responsibilities with sectoral regulatory institutions and subject matter expertise.
• Commonwealth statutes: The inclusion of a terrorist act defined in The Criminal Code s 100.1 set out in the Schedule to the Criminal Code Act 1995 (Commonwealth) in reg 16(1)(g) shows interaction with Commonwealth criminal definitions for terrorism.
• Other enforcement statutes: The Schedule 1 Form 1 refers to enforcement options under the Fines, Penalties and Infringement Notices Enforcement Act 1994 for unpaid modified penalties. Though the Regulations do not create those enforcement powers, they trigger their application where modified penalties remain unpaid.
• Data protection and privacy law: The Regulations impose obligations on further disclosure and secure storage of relevant information (regs 24-25). Those obligations will interact with statutory privacy regimes and information‑sharing rules in other statutes, although the Regulations themselves do not quote or displace other privacy laws; recipients must comply both with these Regulations and applicable privacy statutes when handling relevant information.

Where allocation of responsibilities overlaps, the Regulations specify priority by geographic or hazard boundaries. For example, reg 17(2) assigns FES Commissioner State‑wide responsibility for chemical or radiological releases (reg 17(2)(g)), but reg 23A(3) explicitly provides that, despite reg 17(2), the chief executive officer of the Transport Department is the HMA for oil spillage events (reg 23A(3)). Where multiple agencies have duties over similar hazards in different areas (for example, maritime oil spillage in State waters and port areas), the Regulations delineate coverage to prevent immediate jurisdictional uncertainty; the precise interface with federal maritime law or port authority powers still requires attention to the external statutes cited.

The Regulations include a detailed compilation table setting out a sequence of amendments from 2006 through 2025. Key points drawn from the instrument’s compilation entries and marginal notes are as follows.

• Initial enactment and early amendments: Emergency Management Regulations 2006 commenced 21 April 2006. Amendment Regulations in 2007 and a series in 2008-2013 adjusted definitions, hazard lists and agency assignments, with reprints recorded in 2008 and 2011 and a reprint as at 7 March 2014 (compilation table).
• 2010-2013 changes: Amendments in 2010 and 2013 adjusted hazard definitions and hazard management agency assignments, including insertion of certain regs and assignments for rail and transport HMAs (see regs 20-21 inserted Gazette 13 Jan 2009 and later amendments in 2010, 2012, 2013 as noted in marginal notes next to regs).
• 2011 combat/support designations: On 19 July 2011 the Regulations were amended to create explicit combat agency and support organisation entries (regs 26-32).
• 2020 tranche of amendments: The Emergency Management Amendment Regulations 2020 and related 2020 instruments (including SL 2020/24 and SL 2020/31) made notable changes. Regulation 14A (hostile act) was inserted by SL 2020/24 r. 6. The 2020 amendments also implemented the infringement notice regime and forms (SL 2020/31) and added or amended combat agency roles (SL 2020/24 r. 14-17).
• 2020-2022 administrative updates: SL 2020/165 (25 Sep 2020) and SL 2022/176 (2 Nov 2022) made further adjustments, including to the information exchange provisions (regs 23-25 amended by SL 2022/176 r. 4-6 and r. 7-9).
• 2024-2025 updates: The Emergency Management Amendment Regulations 2024 (SL 2024/294) and 2025 (SL 2025/214) inserted new terms and definitions and expanded the hazard list. Notably, regulation 14B (Cybersecurity incidents) was inserted by SL 2025/214 r. 5. Regulation 1A (Terms used) was amended by SL 2025/214 r. 4. Regulation 23C (Department of the Premier and Cabinet as HMA for cybersecurity incidents) was inserted by SL 2025/214 r. 7. The compilation table records commencement dates for these instruments and the staggered commencement approach for some parts.
• Marginal notes and insertion annotations: Each inserted or amended regulation carries an annotation indicating when it was inserted and by which legislative instrument (for example, "Regulation 14A inserted: SL 2020/24 r. 6"; "Regulation 14B inserted: SL 2025/214 r. 5"; "Regulation 23C inserted: SL 2025/214 r. 7"). Those annotations establish the provenance of textual changes and the legislative instrument to consult for explanatory material or second reading speeches.

For precise drafting chronology, the compilation table in the Regulations should be read alongside the individual Statutory Instruments cited. The compilation table in the text above lists each amending instrument, its publication and commencement dates. Users who need to track legislative intent or transitional arrangements should consult the cited amending instruments and any associated explanatory memoranda because these Regulations’ marginal notes identify insertion points but do not reproduce explanatory material.

The text of the Regulations itself contains no decisions, cases or litigation history. There are no judicial determinations or reported cases cited in the instrument. The Regulations do reference other statutes that have case law of their own, but the instrument does not summarize or list any litigation that interprets it.

Practical implications for research and risk assessment:

• No precedent recorded in instrument: Because the Regulations do not include case references, anyone seeking judicial interpretation of their provisions must search external databases for litigation involving the Emergency Management Act 2005 and these Regulations. Relevant searches should include administrative law challenges, judicial review of emergency declarations or directions, prosecutions or enforcement actions relating to s 86(1) and any proceedings involving the infringement notice regime implemented by reg 33. The Regulations themselves do not identify where such cases exist.
• Potential areas for litigation to monitor: The Regulations create numerous legal thresholds that can be contested in court: the meaning of "reasonably necessary" for onward disclosure (regs 24(2)-(3) and reg 25), the scope of "reasonable suspicion" in hostile act and cybersecurity incident definitions (regs 14A, 14B), the territorial boundaries between HMAs for incidents in State waters and port areas (regs 16(2), 23A, 23B), the legality of a direction under s 86(1) that gives rise to infringement notices (reg 33), and appointment or removal decisions under regs 3-7 for SEMC members. These thresholds are natural loci for judicial review or appellate consideration if disputed in practice.
• Administrative review and tribunals: Administrative decisions under these Regulations, such as appointments of approved/authorised officers (reg 34), authorisations to act under s 55(1) by the Department (reg 23C(3)-(4)), and operational directions by HMAs, may be subject to internal review mechanisms, statutory appeals or judicial review. The Regulations do not itself stipulate appeal routes or review mechanisms for each decision; those are governed by the Act and general administrative law.
• Evidence and admissibility: The Regulations' requirements for secure storage of disclosed relevant information (reg 25) will bear on evidentiary issues in enforcement proceedings. Non‑compliance with the storage requirement could influence admissibility, chain of custody, or credibility of information presented in court or administrative proceedings.

If litigation analysis is required, the appropriate next step is to search WA judicial and tribunal databases and registries for cases citing the Emergency Management Act 2005 and these Regulations, and to review decisions on data disclosure, public emergency directions, and infringement notices under the Criminal Procedure Act 2004. This instrument does not report any such cases.

Practitioners and compliance officers should note the following practical traps and friction points that arise directly from the Regulations’ text.

• Reasonable suspicion and reasonable necessity are legal thresholds used repeatedly: The definitions of hostile act and cybersecurity incident hinge on "reasonable suspicion" that harmful conduct is being or will be carried out (regs 14A(1)-(4), 14B(2)). Information‑handling limits are subject to what is "reasonably necessary" for emergency management (regs 24(2)-(3), 25). Those phrases are factually flexible and invite differing operational judgements; they create exposure to challenge if an agency or contractor’s judgement is later questioned.
• Cybersecurity incidents bring in owners/operators of electronic systems: The Regulations define "electronic system" broadly (14B(1)) and explicitly list information about the person who owns, controls or manages electronic information and systems as "relevant information" (reg 23(d)-(e)). Providers of cloud services, managed IT, or telecommunications may be required to assist or to have their information disclosed and stored under the Act’s information exchange rules. That can conflict with contractual confidentiality terms and commercial obligations if not pre‑planned.
• Overlapping or shifting HMAs for similar hazards: The instrument assigns HMAs by hazard and by geographic area, but a hazard can involve multiple jurisdictions (for example, oil spillage in ports or State waters; compare regs 17(2)(g), 23A(3) and 16(2)). Practitioners should note where regs specifically override other assignments, for example reg 23A(3) states "Despite regulation 17(2), the chief executive officer of the Transport Department is the hazard management agency" for oil spillage in State waters and port areas. Operational confusion can arise at the margins where incidents cross land/water/rail corridor boundaries.
• Private entity designated as hazard management agency: ARC Infrastructure Pty Ltd is explicitly designated as the hazard management agency for rail crashes on infrastructure it operates or manages (reg 21). That is an atypical allocation because an operator is given HMA duties; the Regulations do not set out funding, indemnity or liability arrangements for private corporate HMAs. Practitioners should review commercial contracts and insurance when an entity is named an HMA.
• Low monetary fines but non‑monetary consequences: The statutory fines for inappropriate disclosure or storage of relevant information are relatively low ($1 000) (regs 24-25). However, the reputational, contractual and privacy compliance costs for agencies or private entities may be significant. Further, failing to pay modified penalties under reg 33 can trigger enforcement actions under the Fines Enforcement Act, which the Schedule references in detail, and which can result in licence suspensions and asset enforcement measures.
• Infringement notice procedure specifics: The prescribed form (Schedule 1) requires certain information and sets a 28‑day timeline to pay or elect court proceedings. Failure to comply with timelines can lead to enforcement under the Fines Enforcement Act (Schedule 1, Form 1). The form also details procedural rights for withdrawal and refund (Form 2). Errors in completing or serving the form could raise procedural grounds for dispute or challenge.
• Appointments centralise discretion: The Minister appoints SEMC members and deputies with an obligation to ensure deputies have expertise (reg 7(2)). The Minister may remove members for a range of reasons (reg 4(2)). The State Emergency Coordinator appoints approved and authorised officers under the Criminal Procedure Act for infringement notices (reg 34). These appointment powers allocate substantial discretion to named officials and create an administrative review risk where appointments or removals are contested.
• Security and storage obligations juxtaposed with practical constraints: Agencies, welfare providers and contractors must keep disclosed relevant information "in a secure manner so far as it is reasonably practicable to do so" (reg 25). The "reasonably practicable" qualifier recognises practical constraints but leaves room for dispute about whether a recipient took adequate technical and organisational measures, particularly in high‑volume or rapidly evolving emergency contexts.
• Interaction with other legal duties: The Regulations require disclosure of certain categories of information during an emergency (reg 23). Those disclosure obligations may conflict with statutory secrecy provisions in other laws, privacy laws or contractual confidentiality clauses. The Regulations do not override other statutes on their face; recipients will need to reconcile competing legal duties and to document the legal basis for any disclosure made under s 72 and regs 23-25.

These gotchas are concrete: they produce decision points at operational levels (incident commanders, hazard management officers, contractors). Practitioners should treat "reasonable suspicion", "reasonably necessary" and "reasonably practicable" as legal standards that require contemporaneous documentation of reasons for disclosure, secure storage measures and the decision to seek or withhold assistance.

Practical compliance steps for public agencies, private entities and contracted providers are outlined below, grounded in the Regulations’ text.

1. Map responsibilities and territory

   • Public agencies should document which hazards they are designated as hazard management agencies for under regs 16-23C and the precise territorial limits (for example, State waters, port areas, corridor land). That mapping should be integrated into operational plans and incident command structures to avoid jurisdictional friction when incidents cross boundaries.
   • Private operators named as HMAs (for example ARC Infrastructure Pty Ltd under reg 21) must identify legal, insurance and funding arrangements that cover operational response and liabilities arising from acting in an HMA capacity.

2. Information governance and records

   • Adopt an "emergency disclosure" protocol that aligns with regs 23-25. The protocol should:
     • Identify categories of "relevant information" (reg 23) within the organisation.
     • Provide decision templates for hazard management officers to record legal basis and reasons for disclosure, addressing the "reasonably necessary" standard (reg 24(2)-(3)).
     • Establish secure storage controls proportionate to the sensitivity of the information and the "reasonably practicable" test (reg 25). Technical controls could include encryption, restricted access logging, custodial assignment and retention schedules consistent with emergency needs and privacy law obligations.
   • Ensure contracts with third‑party welfare providers or IT vendors include clauses that permit necessary disclosures in an emergency, require secure storage, and prohibit onward disclosure except where reasonably necessary for emergency management, with breach remedies and compliance auditing rights (reg 24(1)-(3), reg 25).

3. Cybersecurity preparedness

   • Because "cybersecurity incident" is defined to include modifications or impairments to electronic systems that could cause loss of life or injury (reg 14B(2)-(3)), organisations operating critical systems should:
     • Have incident response plans that permit rapid coordination with the Department of the Premier and Cabinet (reg 23C(2)), the designated HMA for cybersecurity incidents (reg 23C(2)).
     • Maintain contact details for hazard management officers and the Government Chief Information Officer authorised to act under reg 23C(4).
     • Document system ownership and management details so they can be provided under reg 23( d)-(e) when required.

4. Training and delegation

   • Ensure operational staff understand SEMC procedures and the role of deputies (regs 2-13). Maintain records of authorisations and delegations, including the State Emergency Coordinator’s appointments of approved and authorised officers under reg 34.
   • Police and agency personnel who may issue infringement notices should be familiar with the forms in Schedule 1 and the 28‑day timelines and election rights (Schedule 1, Form 1).

5. Prepare for enforcement and dispute resolution

   • Individuals and organisations should establish internal procedures to manage receipt of an infringement notice under reg 33 and Schedule 1:
     • Decide in advance the criteria for electing court proceedings versus paying modified penalties.
     • Retain counsel or compliance advisers who can rapidly assess the legality of the directing order under s 86(1).
     • Keep documentation on interactions with hazard management officers to contest or mitigate enforcement.

6. Insurance and indemnities

   • Entities designated as HMAs, combat agencies or support organisations should review insurance coverage and seek clarifications or indemnities from the State where appropriate, in particular if operational duties may expose them to liability or significant expense (reg 21 for private HMA; regs 26-31 for combat agencies).

7. Interagency Memoranda and contractual readiness

   • Establish memoranda of understanding or service agreements that set out expectations about operational roles, cost recovery, data sharing, indemnity and privacy obligations. Contracts with IT and welfare service providers should include procedures for disclosure, secure storage and lawful onward disclosure consistent with regs 23-25.

8. Documentation of “reasonable” standards

   • Because the Regulations rely on reasonableness standards, agencies and private parties should adopt a policy of contemporaneous decision records,who made the decision, on what information, the legal basis (specific regulation and Act section), and the duration that disclosure is expected to be necessary. These records reduce legal risk if actions are later challenged.

9. Privacy law alignment

   • Check obligations under privacy statutes applicable to the entity and ensure emergency disclosure procedures are coordinated with those obligations. The Regulations impose specific duties and penalties but do not displace other legal duties; compliance requires parallel adherence.

10. Testing and exercises

    • Conduct multi‑agency exercises that simulate hazardous events listed in reg 15 (including cyber incidents and hostile acts) to test information exchange, command relationships, secure storage practices and the practical interface between HMAs, combat agencies and support organisations.

Compliance is largely operational: document authority and decision‑making, embed information security measures proportionate to the sensitivity of relevant information, ensure contractual readiness for disclosure and secure storage, and train staff on the thresholds and forms set out in the Regulations (notably regs 14A, 14B, 23-25, 33-35 and Schedule 1).