PRIVATE SECURITY (SECURITY FIRMS) REGULATIONS 1998

The Regulations introduce or operationalise several concepts rooted in the Private Security Act.

Disqualifying offence (regulation 2) is the central barrier to entry. The list is exhaustive and cross-references specific sections of the Criminal Code (NT), the Firearms Act 1997, the Misuse of Drugs Act 1990, the Weapons Control Act 2001, and Commonwealth offences carrying a maximum penalty of two years or more imprisonment. It includes offences that are not obviously security-related, such as certain drug-trafficking offences and dishonesty offences. Note that for some offences (e.g. Criminal Code section 217, certain robbery), a custodial sentence that is wholly or partially served is required to trigger disqualification; mere conviction without a custodial term may not disqualify. The list has been amended frequently as the Criminal Code has been restructured, particularly for sexual offences and property offences. Practitioners must check the exact version in force at the time of application.

Revenue unit (regulation 5) is the basis for licence fees. The Regulations state fee amounts in revenue units rather than fixed dollar amounts. The value of a revenue unit is set by the Fees and Charges Act, which is typically indexed annually. This means fees rise automatically without further amendment. For example, if a revenue unit is $30, then 620 units equals about $18,600 for a one-year natural person licence. For a corporation, the one-year fee is 1,239 units, roughly $37,170. Partnerships pay 620 units per partner, so a two-partner firm pays 1,240 units for a one-year licence. These are substantial sums that represent a significant upfront cost for a small business.

Register of security officers (regulation 6) is a mandatory record-keeping obligation. It must contain the name and residential address of each security officer employed, the Director-assigned licence number, the firm-assigned daily identifier for each officer, and the date and details of every incident in which physical force was used by or against the officer. The register must be kept in a manner approved by the Director. The physical-force incident recording requirement has obvious privacy and litigation implications; it creates a discoverable record that could be used in civil proceedings against the firm or officer.

Security firm and security officer are defined in regulation 6(6) by reference to the relevant licence holdings. A security firm is the holder of a security firm licence; a security officer is the holder of a security officer's provisional licence or a security officer's licence. This distinguishes between the entity and the individual, making clear that the register obligation applies only to the firm.

The Regulations directly affect three categories of persons: applicants for a security firm licence, holders of a security firm licence, and the partners or officers of those firms.

Applicants must gather biometric and photographic information from every natural person who is the applicant, or, if the applicant is a partnership, from each partner, or if a corporation, from each officer as defined by section 17(1) of the Act. This is a broad net. A corporation with multiple directors, company secretaries, and other officers must provide fingerprints for each. A partnership with many partners (for example, a large legal or accounting partnership that also runs a security arm) must collect prints from every partner, even silent partners who take no role in the security business. The cost and administrative burden of collecting and submitting fingerprints for a large group can be significant, particularly if partners are located interstate or overseas.

Holders of a licence face ongoing compliance duties. They must maintain a register, allow inspection by an inspector, notify a change of address within 30 days, and ensure they hold all required licences and permits. Failure to do any of these is an offence. The address notification duty is particularly easy to overlook. A firm that moves offices and forgets to notify the Director faces a penalty even if the move does not affect its operations. The 30-day window is short, and there is no grace period for inadvertent oversight.

Corporate officers are individually implicated because their fingerprints are required. This means a director of a corporate licensee must submit to fingerprinting even if the director resides overseas or has no involvement in the security business. The director's personal criminal history may also be relevant if it includes a disqualifying offence, although the Regulations do not explicitly state that a disqualifying offence held by an officer disqualifies the corporate applicant. The Act likely governs that, but the effect is that a corporate applicant may be unable to obtain a licence if any officer has a relevant conviction.

Inspectors are conferred the right to examine the register. They are not named in the Regulations but are given a power that the firm must not obstruct. This creates a duty on the firm to produce the register on demand.

Security officers (individual employees) are indirectly affected because their personal information must be recorded in the register. They have no right under these Regulations to access that register or to correct it, though they may have rights under privacy legislation.

The Regulations impose four primary duties on the holder of a security firm licence, each backed by a penalty of 20 penalty units.

Duty to hold required licences and permits (regulation 6(1)). A security firm must not supply crowd controllers or security officers for reward unless it has all licences and permits required by any law in force in the Territory. This duty is not limited to the security firm licence itself; it extends across the entire body of Territory law. For example, if the firm supplies security officers who carry firearms, it must also hold the relevant firearms licences under the Firearms Act. The firm must also hold any permits required for specific activities. This creates a duty of proactive legal auditing: the firm must identify every licence or permit that applies to its business activities and ensure it holds each one before engaging in supply.

Duty to notify change of address (regulation 6(2)). The firm must give written notice to the Director of its new address within 30 days of changing its address. The regulation does not specify what constitutes a change of address, but it likely includes the firm's principal place of business or registered office. The duty is strict; there is no exception for temporary changes or for situations where postal redirection is in place.

Duty to keep a register (regulation 6(3)). The firm must keep a register of security officers in a manner approved by the Director. The register must contain the information listed in regulation 6(5): name and residential address of each security officer, the Director-assigned licence number, the firm-assigned daily number, and details of any incident in which physical force was used by or against the officer. The duty to record physical-force incidents applies to each day on which the officer provides services. The firm must decide what constitutes an "incident" and what level of detail is required. Underrecording risks a penalty; overrecording may create unnecessary documentation that could be used in litigation.

Duty to permit inspection (regulation 6(4)). The employer must permit an inspector to examine the register. The regulation does not require the inspector to give notice or to have reasonable grounds. The duty is absolute: if an inspector demands to see the register, the firm must produce it. Refusal is an offence.

The Regulations confer no explicit rights on the firm or on any other person. There is no right to a hearing before a licence is refused, no right to appeal a Director's decision within these Regulations, and no right to access or correct the information in the register. Any such rights would arise from the Act or from general administrative law, not from the Regulations themselves.

The Regulations create three distinct offences under regulation 6, each with a maximum penalty of 20 penalty units. The penalty unit value is set by the Penalty Units Act (NT) and is currently indexed. At the time of writing, one penalty unit is $176, so 20 units is $3,520. This is a modest sum for a corporation but potentially significant for a sole practitioner or small partnership. The maximum penalty applies per offence, so a firm that commits multiple breaches (e.g. failing to keep a register and failing to notify a change of address) faces cumulative exposure.

Enforcement is likely handled by the Director of Licensing (now an office under the Licensing (Director-General) Repeal Act 2020) or by inspectors appointed under the Act. The Regulations do not create any special enforcement powers; they rely on the general enforcement provisions of the Act. An inspector may enter premises, examine registers, and gather evidence. Prosecution would follow the standard criminal procedure in the Local Court or Supreme Court.

The disqualifying offences in regulation 2 do not carry a direct penalty in the Regulations. Instead, they operate as a gatekeeping mechanism: if an applicant or licensee has been convicted of a prescribed offence, the Director may refuse to grant or may cancel a licence under the Act. The effect is to exclude persons with certain criminal records from the security industry entirely, without the need for a separate prosecution. This is a regulatory exclusion rather than a criminal sanction, but its practical impact on a person's livelihood can be severe. The list is broad and includes offences that may be old or that may have been dealt with by a non-custodial sentence. For some listed offences, a custodial sentence that is wholly or partially served is a necessary condition (e.g. Criminal Code section 217), but for most, mere conviction suffices.

The Regulations do not specify any penalties for providing false information in an application. That would likely be dealt with under the Act or under the general criminal law (e.g. fraud). Similarly, failure to provide fingerprints or photographs would presumably result in the application being refused rather than a direct penalty under these Regulations.

The Regulations are expressly subordinate to the Private Security Act 1995. They can only operate within the boundaries set by that Act. If the Act is amended to change the definition of "disqualifying offence" or the application process, the Regulations must be read consistently. The Regulations frequently cross-reference other NT legislation, creating a web of dependencies.

Criminal Code (NT). Regulation 2 lists dozens of specific sections of the Criminal Code. This list has been amended multiple times to track changes to the Code, including the insertion of new offence provisions (e.g. identity crime, sexual offences, property offences). Practitioners must verify that the listed section numbers correspond to the version of the Code in force at the time of the application. The list includes offences under the Criminal Code as in force before certain amending Acts, creating a trap for those who rely solely on the current Code without checking historical versions. For example, regulation 2(ca) refers to offences against sections 132, 188(2)(k), 192 or 192B of the Criminal Code as in force before the commencement of Part 2 of the Criminal Justice Legislation Amendment (Sexual Offences) Act 2023. That means a conviction under the pre-2023 version of those sections still disqualifies, even if the equivalent provision has been renumbered or repealed.

Firearms Act 1997. Regulation 2(d) lists offences against sections 59, 61, 63A, 74, 77, 82, 83, 84, 85 or 86 of the Firearms Act. This is a separate regulatory regime. A person convicted of any of those offences is disqualified from holding a security firm licence. Conversely, a security firm that supplies armed officers must comply with the Firearms Act licence requirements, as noted in regulation 6(1).

Misuse of Drugs Act 1990. Regulation 2(e) prescribes offences against Part II, Division 1 of that Act. This covers serious drug offences. Note that only Division 1 is captured; less serious drug offences under other divisions are not prescribed.

Weapons Control Act 2001. Regulation 2(f) lists offences against sections 6, 7, 8 or 9 of that Act. These cover prohibited weapons, offensive weapons, and similar.

Commonwealth law. Regulation 2(g) prescribes any offence against a law of the Commonwealth where the penalty is imprisonment for 2 years or more. This is a catch-all that brings in federal crimes such as fraud, bribery, or terrorism offences. No need for the offence to be analogous to a Territory offence; any Commonwealth offence with a 2-year maximum penalty qualifies.

Business Names Act 2007 and Business Names (National Uniform Legislation) Implementation Act 2012. These Acts amended the former Schedule to the Regulations, which was repealed in 2014. They reflect the harmonisation of business names registration.

Licensing (Director-General) Repeal Act 2020. This Act changed references from "Director-General" to "Director" throughout NT licensing legislation, including in regulation 6.

The Private Security (Security Firms) Regulations 1998 have been amended at least thirteen times since commencement on 4 August 1998. The amendment record shows a pattern of reactive updates, primarily to keep regulation 2's disqualifying offence list aligned with changes to the Criminal Code and to adjust fees.

The original regulation 2 was substituted by the Private Security (Security Firms) Amendment Regulations 2006 (SL No. 3, 2006). That same instrument inserted regulation 6, which had not existed in the original 1998 version. The fees in regulation 5 were also substituted in 2006, then amended by the Treasury Legislation Amendment (Revenue Units) Regulations 2006 (SL No. 33, 2006) and later by the Fees and Charges Amendment Regulations 2009 (SL No. 34, 2009) and the Private Security (Security Firms) Amendment Regulations 2013 (SL No. 9, 2013). The 2013 amendment adjusted the fee amounts and introduced the three-year licence option.

Regulation 3 was originally a provision about business names. It was repealed by the Licensing (Repeals and Consequential Amendments) Act 2014, which also repealed the Schedule and made consequential amendments to regulation 2. That same 2014 Act removed references to business names, reflecting the transition to the national business names register.

The most significant substantive amendments to regulation 2 occurred through the Criminal Code Amendment (Criminal Responsibility Reform) Act 2005, the Criminal Code Amendment (Identity Crime) Act 2014, the Justice Legislation Amendment (Drug Offences) Act 2016, the Private Security Legislation Amendment Regulations 2017, the Criminal Justice Legislation Amendment (Sexual Offences) Act 2023, and the Justice and Other Legislation Amendment Act 2024. Each of these Acts or Regulations added or amended prescribed offences to reflect new or restructured criminal provisions.

The general amendments made by the Interpretation Legislation Amendment Act 2018 updated regulation 1 (citation) and regulation 2 with formal, non-substantive changes.

The source text contains no recorded litigation history. The endnotes list amending legislation but no court cases. This is consistent with the nature of the Regulations: they are technical, fee-setting, and disqualification-listing instruments that rarely generate their own jurisprudence. Most legal challenges would likely be directed at the parent Act or at administrative decisions made under it, not at the Regulations themselves.

That said, several potential grounds for challenge exist. The disqualifying offence list is broad and could be argued to be disproportionate or to offend the implied freedom of political communication if it excludes persons with convictions for protest-related offences (not currently listed, but the Commonwealth catch-all could capture some). The fingerprint requirement for all partners and officers could be challenged as an invasion of privacy or as exceeding the scope of the Act, depending on how the Act defines the Director's power to require information. The fee structure, particularly the per-partner fee for partnerships, could be argued to discriminate against partnerships as compared to natural persons and corporations, although the per-partner fee is arguably a proxy for the number of controllers.

No such challenges appear in the source. Practitioners should be aware that the absence of litigation does not mean the provisions are immune to challenge; it may simply reflect the cost-benefit calculus for licensees facing relatively low penalties and high administrative hurdles to mounting a court action.

Several provisions in the Regulations are prone to being overlooked or misunderstood.

Fingerprints for all partners and officers. A natural person applicant must provide their own fingerprints. But for a partnership, every partner must provide fingerprints, even silent partners with no involvement in the security business. For a corporation, every officer as defined in section 17(1) of the Act must provide fingerprints. That definition likely includes directors, company secretaries, and possibly other managers. A corporate applicant that has many officers (for example, a large holding company that also operates a security division) must collect prints from all of them. This can be logistically difficult and may raise privacy objections from officers who see themselves as unconnected to the security operations.

Fee per partner. Regulation 5(1)(b) and (2)(b) provide that the fee for a partnership is calculated per partner. For a one-year licence, it is 620 revenue units per partner. A partnership with five partners pays 3,100 units, compared to a corporation that pays 1,239 units for the whole entity. The Regulations do not explain why partnerships are treated less favourably than corporations. This creates a strong incentive for security firms to incorporate rather than operate as a partnership, purely to reduce licence fees.

Register content includes residential addresses and physical-force incidents. Regulation 6(5)(a) requires the name and residential address of each security officer. This information must be kept in a register that an inspector can examine on demand. The register is not necessarily confidential; there is no provision limiting its use. The requirement to record residential addresses creates a data breach risk. The requirement to record details of physical-force incidents (regulation 6(5)(d)) creates a discoverable record that can be used against the firm in civil litigation or workers' compensation proceedings. Firms may be tempted to downplay incidents to minimise exposure, but that exposes them to a penalty for failing to keep accurate records.

The 30-day notification window. Regulation 6(2) requires a firm to notify the Director of a new address within 30 days. The clock starts on the date of the change, not the date the firm becomes aware of the need to notify. If a firm moves on 1 March and notifies on 2 April, it is 2 days late and commits an offence. There is no de minimis exception.

Multiple permits required. Regulation 6(1) requires the firm to have "the licences and permits required by a law in force in the Territory." This is not limited to licences under the Private Security Act. A firm that supplies crowd controllers must check whether any other legislation applies, such as local council permits for events or liquor licensing requirements. A gap in any permit renders the firm's entire business an offence.

Penalty units versus revenue units. The fees are in revenue units; penalties are in penalty units. These are different indices. A practitioner must check the current value of both to calculate actual costs.

Historical offence versions. Regulation 2(ca), (cb), and (cc) refer to offences under the Criminal Code "as in force before the commencement of" certain amending Acts. This means the disqualifying effect depends on the version of the Code at the time of conviction, not the current version. An applicant who was convicted under a provision that has since been renumbered may still be disqualified if the old provision matches one of the listed sections.

To comply with the Private Security (Security Firms) Regulations 1998, an applicant or licensee should follow a structured process.

Step 1: Criminal history screening. Before applying, identify every natural person who will be the applicant, every partner of a partnership applicant, and every officer of a corporate applicant. For each person, obtain a national police clearance. Check the person's criminal record against the exhaustive list of disqualifying offences in regulation 2. Pay particular attention to offences under repealed or renumbered provisions of the Criminal Code that are preserved by the transitional clauses. Also check for any Commonwealth offence with a maximum penalty of at least two years imprisonment, even if the actual sentence was non-custodial. If any person has a conviction for a listed offence, consider whether the licence application is viable or whether the person should be removed from the entity (e.g. a partner could retire, a director could resign) before applying. Note that the Act may still deem the entity disqualified if the person was involved at the time of the offence, so legal advice is recommended.

Step 2: Collect biometric and photographic information. Obtain two current passport-sized photographs and fingerprints from each natural person identified in Step 1. The fingerprints must be of a quality acceptable to the Director. Use a recognised fingerprinting service. The Regulations do not specify a particular format, so follow any guidelines issued by the Director.

Step 3: Determine the fee. Choose a licence term of one, two, or three years. Calculate the fee using the revenue unit amounts in regulation 5. For a natural person: 620 (1 year), 930 (2 years), or 1,096 (3 years) units. For a partnership: multiply the applicable number by the number of partners. For a corporation: 1,239 (1 year), 1,794 (2 years), or 2,143 (3 years) units. Obtain the current value of a revenue unit from the Fees and Charges Act. Pay the fee with the application. Consider the cash flow benefit of a longer term versus the risk that market conditions change.

Step 4: Submit the application. Lodge the application with the Director under section 14 of the Act, including the photographs, fingerprints, and fee. Ensure all information is accurate; false statements may be prosecuted under the Act.

Step 5: Address ongoing duties. Once licensed, the firm must:

• Ensure it holds all licences and permits required for any activity it undertakes, including firearms licences, event permits, etc. Conduct a legal audit of each service offered.
• If the firm changes its address, notify the Director in writing within 30 days. Keep proof of notification.
• Maintain a register of security officers. The register must be kept in a manner approved by the Director (contact the Director for the current approved format). Record for each officer: full name, residential address, Director-assigned licence number, the firm-assigned daily number for each day worked, and details of any physical-force incident (date, persons involved, nature of force, outcome). The incident record must be created promptly after the incident occurs. Retain the register for the period required by the Act (not specified in Regulations, but generally until the officer leaves employment plus a reasonable period).
• Permit an inspector to examine the register on demand. Do not refuse. If the inspector wishes to take copies, the firm should ensure it keeps a copy for itself.

Step 6: Renewal. Before the licence expires, apply for renewal under section 24 of the Act. Provide any updated information as required. Pay the renewal fee using the same calculation as for a new grant. The renewal fee is the same amount as the grant fee for the same term. Regulation 5(3) sets a separate fee of 30 revenue units for something under section 25(1A) of the Act, which likely relates to a late renewal or variation; check the Act to see if this applies.