Telecommunications (Integrated Public Number Database Scheme – Criteria for Deciding Authorisation Applications) Instrument 2017

Several concepts in the instrument determine what applications are eligible and how ACMA must evaluate them. They are defined in the instrument itself or by cross‑reference to the Telecommunications Act 1997 and related instruments.

• Protected information (s4). The instrument defines “protected information” as information or a document disclosed under subsection 285(1A) of the Act where the disclosure is for a purpose covered by subparagraph 285(1A)(c)(ii) or subparagraph 285(1A)(c)(iv). The instrument therefore restricts the scope of the authorisations it addresses to those two purposes set out in the parent Act.
• Public number directory authorisation and research authorisation (s4). Each authorisation type is defined by reference to the specific subparagraph of subsection 285(1A) it permits: public number directory authorisations permit use/disclosure for the purpose in subparagraph 285(1A)(c)(ii), while research authorisations permit use/disclosure for the purpose in subparagraph 285(1A)(c)(iv).
• Public number directory and public number (cross‑reference). The test for a directory product is tied to the statutory definition of “public number directory” in subsection 285(2) of the Act; the instrument requires ACMA to be reasonably satisfied that the proposed directory product “will satisfy the requirements of the definition of public number directory” (s6(1)(a)). The instrument does not restate that definition.
• Reasonable satisfaction standard. The instrument uses the phrase “be reasonably satisfied” repeatedly as the legal standard ACMA must meet in assessing applications (s6(1)(a)-(d); s7(1)(a)-(e); s7(3)-(4)). The instrument does not elaborate what evidentiary material will ordinarily meet that standard; it mandates the matters ACMA must consider.
• Customer data and customer (s4). The instrument uses “customer data” and “customer” but imports their definitions from the Integrated Public Number Database Scheme 2017 and from the instrument’s own definitions respectively. “Customer” is defined as a person supplied with a carriage service by a carriage service provider (s4).
• Contractor (s4). The instrument defines “contractor” to mean a person who performs services for and on behalf of the holder of an authorisation but excludes employees. The distinction matters because ACMA’s inquiries about future compliance extend to contractors (s6(2)(b), s7(2)(b)).
• Linkages to other instruments. The instrument cross‑references the Telecommunications (Integrated Public Number Database - Permitted Research Purposes) Instrument 2017 for the permitted kinds of research and for electoral/related definitions such as “candidate”, “electoral matter”, “political representative”, “Parliament”, “local government authority” and “registered political party” (s4; s7(1)(a); s7(3)). It also notes that expressions such as ACMA, carriage service, carriage service provider are defined in s7 of the Telecommunications Act (s4 Note).
• Prior compliance and processes (s6(2), s7(2)). For both authorisation streams, ACMA must take into account the extent of an applicant’s previous compliance with the Act in relation to use of customer data, and if an applicant lacks a relevant history, ACMA must assess whether the applicant has appropriate processes for future compliance, covering both the applicant and any contractor.

The instrument therefore allocates decision criteria across two axes: the permitted statutory purpose for disclosure of protected information, and governance/process indicators (past compliance plus demonstrable privacy/security processes). It leaves substantive definitions of permitted purposes, “public number directory” and “customer data” to the Act and other instruments it references.

The instrument affects a small, defined set of actors by altering the decision criteria ACMA must apply to applications under the integrated public number database scheme.

• ACMA (decision‑maker). The Australian Communications and Media Authority is the administrative decision‑maker required to apply these criteria when deciding whether to grant public number directory authorisations or research authorisations under the integrated scheme (ss6-7). The instrument prescribes what ACMA must be “reasonably satisfied” of before authorisation.
• Applicants for public number directory authorisations. Any person seeking a public number directory authorisation under the integrated scheme will be assessed against the criteria in s6. ACMA must be satisfied the proposed directory product meets the statutory “public number directory” test (s6(1)(a)), that the applicant will use protected information for the permitted directory purpose (s6(1)(b)), that the applicant will otherwise comply with the Act and the scheme (s6(1)(c)), and that the applicant has or will implement privacy/security processes (s6(1)(d)). The applicant’s past compliance with the Act in use of customer data is a direct consideration (s6(2)(a)).
• Applicants for research authorisations. Persons seeking research authorisations are assessed under s7. ACMA must be satisfied the proposed research is of the kind specified in the separate Permitted Research Purposes Instrument 2017 (s7(1)(a)), is not primarily commercial (s7(1)(b)), will use protected information only for the permitted research purpose (s7(1)(c)), and that the applicant will comply with the Act and the scheme and protect privacy/security (s7(1)(d)-(e)). For research on electoral matters there are applicant‑type limits: the applicant must be a registered political party, political representative, candidate for Parliament or local government, or a person acting on their behalf (s7(3)). For research that will contribute to public policy, the research must be conducted by or on behalf of the Commonwealth or a Commonwealth entity, and the applicant must demonstrate the research will contribute to public policy (s7(4)(a)-(b)).
• Contractors of authorisation holders. Because “contractor” is defined and ACMA must assess whether an applicant and any contractor will be able to comply with applicable requirements (s6(2)(b) and s7(2)(b)), contractors who perform services for authorisation holders are affected. The instrument explicitly excludes persons performing services as employees from its “contractor” definition (s4).
• Commonwealth entities and public policy actors. The instrument narrows a class of research that can be authorised for development of public policy to research conducted by or on behalf of the Commonwealth or a Commonwealth entity, and requires demonstrable contribution to policy (s7(4)).
• Registered political parties, candidates and political representatives. The instrument restricts access for electoral research to the identified political actors and their agents (s7(3)).
• Carriage service providers and customers in indirect ways. The instrument uses the concepts of “customer” and “customer data” (s4) and requires ACMA to look at prior use of customer data by applicants (s6(2)(a), s7(2)(a)). Therefore carriage service providers and their customers are affected through the gating function of the criteria, although the instrument does not alter the underlying duties of carriers or the content of customer data definitions.

Who does not gain new access: the instrument is limited to the two purposes referenced in the Act (subparagraphs 285(1A)(c)(ii) and (c)(iv)). It does not expand the range of purposes for which protected information may be used, nor does it create categories of applicants beyond those permitted by the Act and the Permitted Research Purposes Instrument; it simply imposes criteria ACMA must apply in deciding applications for the two authorisation types identified.

This instrument is prescriptive about the matters ACMA must be satisfied of and the factors ACMA must consider; it does not itself create operational duties for third parties beyond those considerations, nor does it expressly create rights of third parties to obtain authorisations. The instrument’s operative obligations are therefore administrative constraints on ACMA’s decision‑making. Key duties and associated practical rights and constraints follow.

Duties placed on ACMA

• Apply specified criteria. ACMA must be “reasonably satisfied” of the matters listed before granting a public number directory authorisation (s6(1)(a)-(d)) and before granting a research authorisation (s7(1)(a)-(e)). Those are mandatory evaluative duties.
• Consider prior compliance and processes. Where relevant ACMA must consider an applicant’s prior compliance with the Act in relation to prior use of customer data (s6(2)(a); s7(2)(a)). If the applicant lacks a relevant compliance history, ACMA must consider whether the applicant and any contractor have appropriate processes in place to enable compliance with the Act, related instruments and the integrated scheme (s6(2)(b); s7(2)(b)).
• Apply extra applicant‑type filters for particular research. For electoral matter research, ACMA must be reasonably satisfied the applicant is a registered political party, political representative, candidate, or acting on behalf of such a party/representative/candidate (s7(3)). For public policy research, ACMA must be satisfied the research will be conducted by or on behalf of the Commonwealth or a Commonwealth entity and that the research will contribute to development of public policy (s7(4)).

Rights and expectations for applicants

• Right to apply. The instrument presumes an application route exists under the integrated public number database scheme; eligible persons may apply for either authorisation type. The instrument does not create an entitlement to authorisation; it sets minimum satisfaction thresholds ACMA must meet to grant one.
• Expectation of evidentiary material. Because ACMA must be “reasonably satisfied” of compliance, applicants must present material sufficient for ACMA to make that assessment. The instrument specifically signals two categories of material ACMA should examine: evidence of prior compliance with the Act in relation to customer data, and documented processes addressing privacy and security for protected information (s6(2), s7(2); s6(1)(d), s7(1)(e)).
• Contractors included in compliance assessment. Applicants must expect ACMA to assess whether their contractors, as defined, will be able to comply with the Act and the integrated scheme; applicant submissions should therefore address contractor governance, contracts and controls (s4; s6(2)(b); s7(2)(b)).
• Limits on purpose and applicant type. Applicants are constrained to the permitted statutory purposes identified in the Act and,in the case of electoral and public policy research,subject to applicant‑type constraints (s4; s7(3)-(4)).

Not stated or absent duties and rights

• No technical standards or minimum safeguards are prescribed in the instrument. The instrument instructs ACMA to “consider what processes the applicant has in place, or intends to put in place, to protect the privacy and security of protected information” (s6(1)(d); s7(1)(e)), but it does not prescribe technical or procedural minimums. ACMA therefore exercises discretion in determining what processes are adequate.
• No fees, time limits, or procedural steps for application processing are prescribed in the instrument; those operational aspects are left to the governing Act, the integrated public number database scheme and ACMA practice.

In short, the instrument imposes duties on ACMA to apply a defined set of evaluative criteria and directs ACMA to examine past behaviour and future processes, including contractor arrangements, while constraining applicants by purpose and, in some cases, applicant type. The instrument is administrative and procedural in nature; it sets criteria rather than operational obligations with prescriptive technical content.

The instrument itself does not create penalties, enforcement mechanisms, or sanctions. Its text prescribes decision criteria ACMA must apply when deciding whether to grant authorisations under the integrated public number database scheme (ss6-7) and repeals a prior instrument (Schedule 1), but contains no provisions about enforcement, monitoring, revocation, offences, or civil remedies.

What the instrument says about enforcement‑adjacent matters

• ACMA’s role is central. The instrument repeatedly directs ACMA to be “reasonably satisfied” of specified matters before granting authorisations (ss6-7). That allocates decision‑making authority to ACMA but stops short of prescribing what ACMA does after grant, or what sanctioning powers it may exercise for non‑compliance.
• Compliance checks focus on past conduct and future processes. ACMA must consider the extent of an applicant’s prior compliance with the Act in relation to previous use of customer data (s6(2)(a); s7(2)(a)). If an applicant lacks prior history, ACMA must assess whether the applicant and its contractors have appropriate processes to enable compliance in the future (s6(2)(b); s7(2)(b)). That mechanism is predictive and evaluative rather than punitive.

What the instrument does not do (and what follows)

• No penalties in this instrument. There are no penalty provisions in the instrument itself. It does not state that failure to comply with the instrument’s criteria attracts a fine, criminal offence, administrative penalty or revocation mechanism.
• Enforcement is therefore likely to be handled under the Telecommunications Act 1997, the integrated public number database scheme, and related instruments. The instrument repeatedly references those sources (s3; s4 Note; ss6-7). Any sanctions, monitoring, or enforcement powers, and the procedures for revoking or modifying authorisations, must be found in the Act or the integrated scheme rather than in this instrument. The instrument does not identify the relevant Act provisions nor reproduce them.

Practical consequence for applicants and authorised holders

• Applicants must supply satisfactory evidence to ACMA to obtain an authorisation because the instrument makes ACMA’s evaluative threshold explicit. Failure to persuade ACMA that the criteria are met will result in refusal of authorisation, but the instrument does not state appeal rights, timeframes, or sanctions for subsequent misuse of protected information.
• Because contractors are in scope for ACMA’s assessment of future compliance (s6(2)(b); s7(2)(b)), authorisation holders should anticipate contractual and governance requirements being relevant to ACMA’s ongoing oversight or conditions attached to authorisations even though the instrument does not itself set those conditions.

In summary, the instrument governs decision criteria and the evaluative lens ACMA must apply. It does not itself create enforcement mechanisms, penalties, or monitoring regimes; those matters are outside the text and must be located in the Telecommunications Act or the integrated public number database scheme that this instrument supplements.

The instrument is highly interdependent with the Telecommunications Act 1997, the integrated public number database scheme, and a companion instrument that defines permitted research purposes. It operates as a subordinate legislative instrument and deliberately delegates definitional and enforcement matters to those source instruments.

Direct statutory anchors and cross‑references

• Made under section 295N of the Telecommunications Act 1997. The instrument states its authority explicitly (s3). That situates it as a statutory instrument subordinate to the Act.
• Ties to the integrated public number database scheme. The instrument repeatedly references the “integrated public number database scheme” in operative criteria and in its definition of “customer data” (s4; s6(1)(c); s7(1)(d); s6(2)(b); s7(2)(b)). The scheme itself is described as being “in force under section 295A of the Act” (s4 definition). Definitions and substantive permissions in the scheme and in section 285 of the Act are therefore directly relevant to how the instrument operates.
• Relies on subsection 285(1A) and subsection 285(2) of the Telecommunications Act. The definitions of “protected information”, “public number” and “public number directory” are anchored to these Act provisions. The instrument requires ACMA to be satisfied that proposed directory products meet the statutory definition of “public number directory” (s6(1)(a)) and that proposed uses of protected information are for the specific subparagraphs cited in the Act (s4).
• Cross‑reference to Permitted Research Purposes Instrument 2017. The instrument requires ACMA to be satisfied that research is of the kind specified in that other instrument (s7(1)(a)). It also imports a number of other expressions (candidate, electoral matter, local government authority, Parliament, political representative, registered political party) from that Permitted Research Purposes Instrument (s4).
• Definition of “Commonwealth entity”. The instrument uses the phrase “Commonwealth entity” and adopts the meaning given by section 10 of the Public Governance, Performance and Accountability Act 2013 (s4). That links the instrument’s public‑policy research test (s7(4)) to external public sector governance law.

What the instrument does not do in relation to other laws

• It does not duplicate or displace Act provisions. The instrument defers to the Act for definitions and permitted purposes. It sets decision‑making criteria rather than redefining statutory permissions or enforcement. Where the Act sets out offences, conditions of disclosure, or enforcement mechanisms, this instrument does not alter those; it simply provides ACMA with thresholds for authorisation decisions.
• It does not set out administrative law mechanisms such as merits review or judicial review rights. Those mechanisms, if any, will be those provided by the Act or by general administrative law and are not described in this instrument.

Interplay effects to note (textually grounded)

• Dependency on the Permitted Research Purposes Instrument 2017. The instrument’s research authorisation stream turns on what that companion instrument specifies as permitted research types (s7(1)(a); s4). A change in the companion instrument would therefore alter what research ACMA could authorise under the criteria set out here.
• Dependency on the Act’s definitions of “public number directory” and “protected information”. Because the instrument requires ACMA to be satisfied the proposed product meets the statutory definition (s6(1)(a)), any change in subsection 285(2) would change the scope of acceptable directory products without amendments to this instrument.
• Contractor governance and employment law separation. The instrument defines “contractor” narrowly to exclude employees (s4). That distinction interacts with employment law and contractor law in that compliance obligations ACMA will assess extend to contractors but not to employees as defined here. This creates a legal separation between types of service providers that must be filled with contractual protections for contractors.

In practical terms, the instrument should be read and applied in tandem with:

• The Telecommunications Act 1997, especially subsection 285(1A) and subsection 285(2), and the integrated public number database scheme established under the Act (s4 Note);
• The Telecommunications (Integrated Public Number Database - Permitted Research Purposes) Instrument 2017 for permitted research types and electoral/research actor definitions (s7(1)(a); s4);
• The Public Governance, Performance and Accountability Act 2013 for the meaning of “Commonwealth entity” when applicants seek public policy research authorisations (s4).

The instrument therefore functions as a bridge between the Act, the integrated scheme, and the Permitted Research Purposes Instrument by converting statutory permissions into concrete decision criteria for ACMA.

The instrument itself contains only limited amendment history in the text provided. The operative history items visible in the instrument are:

• Date and making. The instrument is dated 18 July 2017, signed by the Minister for Communications (the instrument text shows the Minister’s name and date at the front), and includes a commencement clause stating the instrument commences on the day after it is registered (s2).
• Repeal of the earlier instrument. Schedule 1 repeals in full the earlier instrument titled Telecommunications (Integrated Public Number Database Scheme - Criteria For Deciding Authorisation Applications) Instrument 2007 (No. 1). The Schedule instructs the whole of the 2007 instrument be repealed (Schedule 1, item 1).
• No other amendments recorded. The instrument does not record any prior amendments to itself, and the document as provided contains no schedules or clauses that amend other instruments except for the express repeal in Schedule 1.

What this means in practice

• Replacement of 2007 criteria. The instrument functionally replaces the 2007 criteria instrument and becomes the operative criteria document for ACMA’s decisions about the two authorisation types described. Any procedural or substantive differences between the 2017 criteria and the 2007 instrument would need to be discerned by comparing the two texts; this instrument’s Schedule 1 removes the 2007 instrument from force (Schedule 1).
• Commencement depends on registration. The instrument commences the day after registration (s2); the text supplied includes a date but does not specify the registration date. The operative effect therefore begins at the statutory commencement point tied to registration.
• No later amendments. The instrument text as provided contains no later amendment notes, saving or transitional provisions, or sunset clauses. Any subsequent amendments or repeals would appear in later instruments or Acts and are not part of the text supplied.

For historical tracking, the instrument itself is the primary amendment indicator here: it repeals the earlier 2007 instrument and replaces it with the 2017 criteria. The instrument’s narrow scope and lack of embedded amendment mechanics means any future changes will also require a new instrument or amendment under the enabling provision (s295N of the Act).

The instrument contains no litigation history, and it does not cite or name any cases. Its text does not record any judicial or administrative decisions about its validity, interpretation or application. Where the instrument references statutory provisions (for example, subsection 285(1A) and subsection 285(2) of the Telecommunications Act 1997, and section 295N under which it is made), it does not provide any case law guidance or judicial interpretation.

Practical implications of the absence of litigation history in the instrument

• No recorded judicial interpretation. The instrument provides ACMA with mandatory consideration points and standards, but there are no reported judicial decisions in the instrument that clarify the meaning of “reasonably satisfied”, “public number directory”, “protected information” or similar phrases as used in the instrument.
• Administrative challenge routes not detailed. The instrument does not set out review pathways, appeal mechanisms, or how ACMA’s decisions will be preserved from or exposed to judicial review. Any litigation about an ACMA decision under this instrument would be governed by the Act and broader administrative law principles, but those mechanisms are not stated within the instrument.
• Evidence gap for practitioners. Because this instrument contains no litigation references, practitioners seeking interpretative guidance must look to the Act, the integrated public number database scheme, the Permitted Research Purposes Instrument 2017, ACMA practice statements, or judicial decisions that address the underlying Act or scheme; none of those are cited in the instrument itself.

To restate the textual reality: the instrument lists decision criteria and definitions and repeals a prior instrument, but it records no case law or litigation history. Any legal challenges or interpretations that have arisen since its commencement are not contained in this text.

The instrument is short and focused, but several practical pitfalls arise from what it says and, equally importantly, from what it does not say.

1. “Reasonably satisfied” repeated, but no evidentiary thresholds specified (ss6-7)

• The instrument requires ACMA to be “reasonably satisfied” of multiple matters before approving either type of authorisation. The text does not define what documentary or procedural evidence will meet that standard. Practitioners must therefore anticipate ACMA’s discretionary judgment and prepare comprehensive evidence on the matters listed (proposed product features, purpose, compliance systems, contractor capability, prior compliance records).

2. Purpose‑bound authorisations only (s4)

• “Protected information” is explicitly limited to disclosures under subsection 285(1A) of the Act for the purposes covered by subparagraphs 285(1A)(c)(ii) and (c)(iv). That means authorisations granted under these criteria are not general licences to use protected information; they are purpose‑bound. Applicants whose intended use falls outside those specific subparagraphs must not assume this instrument opens the door.

3. Applicant type constraints on research authorisations (s7(3)-(4))

• For electoral research, ACMA must be satisfied the applicant is a registered political party, political representative, candidate, or a person acting on behalf of one (s7(3)). For public‑policy research, ACMA must be satisfied the research will be conducted by or on behalf of the Commonwealth or a Commonwealth entity and that it will contribute to public policy (s7(4)). These are not mere discretionary considerations; ACMA must be “reasonably satisfied” of them.

4. Contractors are in scope; employees are excluded from “contractor” (s4; ss6(2)(b), 7(2)(b))

• The instrument defines “contractor” to exclude employees (s4), and expressly requires ACMA to consider whether the applicant and any contractor have appropriate processes to enable compliance (s6(2)(b); s7(2)(b)). This makes contractor governance, contractual clauses requiring compliance, and oversight arrangements central to an application. Applicants who outsource key processing must ensure contracts impose compliance obligations compatible with the Act and the integrated scheme.

5. No technical, operational or minimum privacy/security standards set (ss6(1)(d), 7(1)(e))

• ACMA is to “consider what processes the applicant has in place, or intends to put in place, to protect the privacy and security of protected information” (s6(1)(d); s7(1)(e)). The instrument does not prescribe technical controls, standards, certification or audit requirements. That leaves substantial discretion to ACMA and creates uncertainty about what will be accepted as sufficient.

6. Prior compliance is a gating factor (ss6(2)(a), 7(2)(a))

• ACMA must examine “the extent to which the applicant has complied with the requirements of the Act in relation to its previous use of customer data.” Applicants with poor or non‑existent compliance histories face extra scrutiny; conversely, a strong compliance track record will be material to a successful application.

7. Definitions live outside the instrument

• Key terms (for example, “public number directory”, “customer data” and the permitted research kinds) are defined in the Act and other instruments the text references. Applicants must consult the Telecommunications Act 1997, the integrated scheme instrument and the Permitted Research Purposes Instrument 2017. Failure to align an application with those external definitions will likely result in refusal.

8. The instrument does not address fees, timelines or appeal rights (s2-Schedule 1)

• The instrument is silent on application fees, statutory time limits for decisions, or appeal/merit review rights. Applicants should not assume the instrument establishes procedural protections; those will be found elsewhere in the Act or ACMA practice.

9. Repeal of the 2007 instrument (Schedule 1)

• The earlier criteria instrument is repealed in full. Practitioners must not rely on the 2007 instrument’s content; instead, they must apply the 2017 criteria. Any transition provisions or differences must be determined by comparing the instruments and by checking the registration/commencement timing.

10. Narrowness of permitted commerciality test for research (s7(1)(b))

• ACMA must be satisfied the proposed research “will not be conducted for a primarily commercial purpose.” The instrument provides no test for “primarily commercial.” Applicants proposing mixed‑purpose projects should be prepared to demonstrate why the research is primarily non‑commercial under ACMA’s likely interpretation; the instrument itself offers no yardstick.

In practice, the “gotchas” are about evidence, contractor governance, definitional alignment, and the discretionary space ACMA retains because the instrument sets criteria but not detailed procedures or standards. Applicants should build dossiers that speak to prior compliance, documented privacy/security processes, contractor agreements, and the precise statutory purpose being pursued.

Compliance here means preparing an application that enables ACMA to be “reasonably satisfied” of the matters set out in the instrument (ss6-7), and ensuring organisational arrangements are consistent with the instrument’s specific concerns. The instrument does not provide procedural forms, timelines, or fee information; it prescribes the substantive matters ACMA will assess. The steps below set out a practical compliance checklist anchored in the text.

1. Establish the statutory basis for the authorisation sought

• Identify which authorisation you are pursuing and the corresponding statutory subparagraph:
  • Public number directory authorisation: use/disclosure of protected information for the purpose in subparagraph 285(1A)(c)(ii) of the Act (s4).
  • Research authorisation: use/disclosure of protected information for the purpose in subparagraph 285(1A)(c)(iv) of the Act (s4).
• Confirm the proposed use falls squarely within the permitted purpose as defined in the Act and in the Permitted Research Purposes Instrument 2017 (s7(1)(a); s4). If the purpose is not covered, do not apply under these criteria.

2. For directory products, demonstrate the product meets the statutory definition

• Prepare a product submission that addresses the statutory “public number directory” elements found in subsection 285(2) of the Act. The instrument requires ACMA to be reasonably satisfied the proposed directory product will satisfy that definition (s6(1)(a)).
• Include sample outputs, distribution plans, and an explanation of how the product’s content and use align with the “public number directory” definition.

3. For research, show the research is the permitted kind and not primarily commercial

• Demonstrate that the research is of a kind specified in the Permitted Research Purposes Instrument 2017 (s7(1)(a)).
• Provide a clear business model or funding statement showing the research is not “conducted for a primarily commercial purpose” (s7(1)(b)). If the project has any commercial elements, provide evidence that the dominant purpose is non‑commercial research.

4. Provide evidence of prior compliance with the Act in relation to customer data

• ACMA must consider an applicant’s prior compliance with the requirements of the Act relating to previous use of customer data (s6(2)(a); s7(2)(a)). Assemble compliance records, audit reports, incident logs, or other documentation of prior handling of customer/customer data that demonstrate adherence to legal obligations.

5. If no prior compliance history, document processes enabling compliance

• Where prior compliance history is absent or limited, ACMA must assess whether the applicant and any contractor have appropriate processes to enable compliance with the Act and the integrated scheme (s6(2)(b); s7(2)(b)). Provide:
  • Written privacy and information security policies.
  • Data handling workflows and access controls.
  • Incident response plans.
  • Staff training programmes related to the Act and the scheme.
  • Audit and reporting arrangements.
  • Evidence that contractors are bound contractually to comply with these processes.

6. Address contractor governance explicitly

• Because “contractor” is defined and included in ACMA’s assessment (s4; s6(2)(b); s7(2)(b)), applicants must ensure contractors’ contracts include:
  • Obligations to comply with the Act, relevant legislative instruments, and the integrated public number database scheme.
  • Confidentiality, data security, and audit rights for the applicant and, if required, ACMA.
  • Clear delineation of responsibilities for data protection and incident management.

7. For electoral research, confirm applicant eligibility and provide proof

• If the research concerns an electoral matter, ACMA must be satisfied the applicant is a registered political party, a political representative, a candidate in an election for a Parliament or local government authority, or a person acting on behalf of one (s7(3)). Include registrations, authorisations, or letters of instruction as applicable.

8. For public policy research, secure and document Commonwealth involvement

• To qualify for public policy research authorisation, the research must be conducted by or on behalf of the Commonwealth or a Commonwealth entity, and the applicant must demonstrate that the research will contribute to development of public policy (s7(4)(a)-(b)). Provide:
  • Letters of instruction or contracts showing Commonwealth sponsorship or commissioning.
  • A research plan explicitly linking outputs to policy development processes.

9. Prepare a privacy and security dossier

• Because ACMA must “consider what processes the applicant has in place, or intends to put in place, to protect the privacy and security of protected information” (s6(1)(d); s7(1)(e)), prepare:
  • Technical descriptions of data storage, encryption, access control, retention and deletion mechanisms.
  • Privacy impact assessments.
  • Compliance mappings to the Act and the integrated scheme.
  • If appropriate, third‑party certifications, penetration testing results, or independent assurance reports.

10. Anticipate ACMA discretion and gaps in the instrument

• The instrument gives ACMA discretion on sufficiency of processes, technical standards, and on interpreting “primarily commercial”. Expect questions and prepare justificatory materials. Because the instrument does not specify procedures, be ready to respond to ACMA requests for further information.

11. Ensure alignment with definitions outside this instrument

• Confirm that “customer data”, “public number”, and other key terms are interpreted consistently with the integrated public number database scheme and the Telecommunications Act 1997 (s4 Note). Failure to align definitions may result in refusal.

12. Administrative housekeeping

• Note the commencement rule: the instrument commences on the day after registration (s2). Ensure that any application refers to currently operative criteria and not to the repealed 2007 instrument (Schedule 1).

By following these steps , mapping purposes to the Act and complementary instruments, compiling prior compliance evidence or mature processes, documenting contractor arrangements, and preparing robust privacy/security materials , applicants present ACMA with the information it must evaluate under the instrument. The instrument’s silence on administrative procedures and penalties means applicants should also consult ACMA’s administrative guidance and the integrated scheme for procedural compliance.