This industry standard (the Telecommunications (Domestic, Family and Sexual Violence Consumer Protections) Industry Standard 2025) prescribes minimum operational, governance, privacy, training, record-keeping and support requirements for carriage service providers in their dealings with consumers, and for carriers insofar as they must assist providers (see s 4 and s 26). It is made by the Australian Communications and Media Authority under subsection 125AA(1) of the Telecommunications Act 1997 (s 3). The standard establishes affirmative duties for providers to identify and support consumers who are, or may be, experiencing domestic and family violence or non-domestic sexual violence (defined in s 5), to avoid retraumatising interactions, and to protect the privacy and security of affected persons.

Mechanically, the instrument requires providers to:

recognise and treat consumers who disclose non-domestic sexual violence as "affected persons" for certain support duties (s 7);
offer and advertise specified support options and publish a domestic and family violence statement (DFV statement) with prescribed content and accessibility requirements (ss 16-17);
obtain an affected person’s confirmation that it is safe to communicate before discussing support, and agree a preferred communication method and time (ss 8-10);
offer minimum support options such as unlinked new accounts and account security measures (s 12), prioritise assistance and avoid restricting or disconnecting services for 30 days after safety concerns are raised by the affected person unless requested by them (s 13(2)), and reverse restrictions, suspensions or disconnections urgently on the first request where feasible (s 13(3)-(4));
avoid requiring evidence of DFV except where legally obliged or reasonably necessary to protect the affected person (s 14);

meta-content-style-type: text/css meta-content-type: application/xhtml+xml; charset=utf-8

?xml version="1.0" encoding="utf-8" standalone="no"?>

Commonwealth Coat of Arms of Australia

Telecommunications (Domestic, Family and Sexual Violence Consumer Protections) Industry Standard 2025

The Australian Communications and Media Authority makes the following standard under subsection 125AA(1) of the Telecommunications Act 1997.

Dated: 6 June 2025

Nerida O’Loughlin

[signed]

Member

Cathy Rainsford

[signed]

General Manager

Australian Communications and Media Authority

Contents

4 Application of industry standard

5 Definitions

6 References to other instruments

Part 2—Sexual violence outside a domestic and family violence situation

7 Requirement where a consumer has experienced sexual violence outside a domestic and family violence situation

Part 3—Providing support

8 Requirement to advise affected persons of available support

9 Application of sections 10 and 11

10 Requirement to agree on a preferred communication method

11 Requirement to discuss support options

12 Minimum requirements for support

13 Providing support to affected persons

14 A provider must not require evidence

15 Communications with an affected person

Part 4—Requirements relating to availability of DFV support information

16 Requirement to publish, on commencement of this provision, information relating to available support for affected persons

17 Requirement to publish a DFV statement

18 Requirements regarding access to DFV support services

Part 5—General requirements relating to policies and procedures

19 Develop domestic and family violence policies and procedures

20 Minimum requirements for DFV policies and procedures

Part 6—Training

21 Training for all personnel

22 Training of customer facing personnel

Part 7—Monitoring and review

23 Requirement to review policy and procedures

24 Requirement to monitor personnel

Part 8—Security and privacy

25 Requirements relating to the security and privacy of an affected person

26 Requirement on carriers to provide assistance

27 Security of personal and sensitive information

28 Privacy

29 Where privacy is breached

Part 9—Record keeping

30 Requirements to keep records

31 Record retention

Part 10—Consultation

32 Requirement to consult

Part 11—Conferral of functions and powers

33 Conferral of functions and powers on the TIO

Part 1—Preliminary

1 Name

This industry standard is the Telecommunications (Domestic, Family and Sexual Violence Consumer Protections) Industry Standard 2025.

2 Commencement

Each provision of this industry standard specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table.

Column 1	Column 2
Provisions	Commencement
1. Part 1, subsections 13(3), 13(4), 13(5), 15(1) and sections 16, 19, 21, 22 and 32.	1 July 2025.
2. Anything in this industry standard not elsewhere covered by this table	1 January 2026.

Note 1: This table relates only to the provisions of this industry standard as originally made. It will not be amended to deal with any later amendments of this industry standard.

Note 2: The Federal Register of Legislation may be accessed free of charge at www.legislation.gov.au.

Note 3. The provisions referred to in column 1, item 2 of this table commence on 1 January 2026. However, they do not apply to small providers until the date specified in subsection 4(2).

3 Authority

This industry standard is made under subsection 125AA(1) of the Telecommunications Act 1997.

4 Application of industry standard

For the purposes of subsection 125AA(1) of the Act:
this industry standard applies to participants in the following sections of the telecommunications industry:
carriage service providers in their dealings with consumers; and
carriers in relation to their supply of carriage services to carriage service providers;
this industry standard is drafted to give effect to the objectives set out in section 7 of the Telecommunications (Domestic, Family and Sexual Violence Consumer Protections Industry Standard) Direction 2024.
The provisions in column 1, item 2 of the table in section 2 of this industry standard do not apply to a small provider until 1 April 2026.

5 Definitions

In this industry standard:

Act means the Telecommunications Act 1997.

active service has the meaning given by subsection (2).

affected person means an individual who is a consumer and who identifies as someone who is, or may be, experiencing domestic and family violence including a former, prospective or current consumer.

agreed communication method means the method of, and, where applicable, time for, communicating as agreed under subsection 10(2).

authorised representative means a person who has authority from a consumer to deal with a provider on behalf of that consumer as their authorised agent.

bill means an invoice from a provider which advises a customer of the total of each amount of money due for payment by a customer under a consumer contract.

business day means a day that is not a Saturday, Sunday or gazetted public holiday in the location of the provider’s principal place of business.

business hours means the hours between 9.00am and 5.00pm local time.

coercive control means a repeated pattern of behaviour used by an individual that has the effect of creating and maintaining control over another individual by exerting power and dominance in everyday life to deny freedom and autonomy through fear, control, pressure or manipulation.

consumer means:

an individual who acquires or may acquire a telecommunications product for the primary purpose of personal or domestic use and not for resale;
a not-for-profit organisation which acquires or may acquire one or more telecommunications products which are not for resale; or
a business which acquires or may acquire one or more telecommunications products which are not for resale and which, at the time it enters into the consumer contract:
does not have a genuine and reasonable opportunity to negotiate the terms of the consumer contract; and
has or will have an annual spend with the provider which is or is estimated on reasonable grounds by the provider to be, no greater than $40,000.

A reference to a consumer includes a reference to the consumer’s authorised representative.

consumer contract means an arrangement or agreement between a provider and a customer for the supply of a telecommunications product to that customer, including a standard form of agreement formulated by a provider for the purposes of section 479 of the Act.

credit management action means any action taken by a provider in relation to telecommunications products supplied by the provider to a customer, including a restriction, suspension or disconnection, to:

(a) manage any credit risks that are relevant to the provider; or

(b) collect outstanding debts from customers.

customer means a consumer who has entered into a consumer contract with a provider and includes a current customer of a provider or former customer who owes money to a provider in connection with their consumer contract.

disconnection means the termination of a telecommunications service provided to a consumer under a consumer contract.

domestic and family violence refers to behaviours of an individual that are designed to create a dependency or to isolate, monitor, dominate, or control another individual. These behaviours may consist of physical violence and/or other types of abuse, power, coercion or control that cause harm including life threatening communications, unwelcome communications, economic and financial abuse, technology facilitated abuse, threats and intimidation, emotional or psychological abuse, systems abuse, coercive control and sexual violence (other than non-domestic sexual violence). Domestic and family violence can occur in any personal relationship including between intimate partners, parents and children, immediate and extended family groups, communal and extended kinship connections, and in carer and guardianship arrangements.

domestic and family violence policy (DFV policy) means the policy developed by a provider under paragraph 19(1)(a).

domestic and family violence policy training (DFV policy training) means the training delivered or arranged for by a provider under section 21.

domestic and family violence procedures (DFV procedures) means written procedures developed by a provider under paragraph 19(1)(b).

domestic and family violence statement (DFV statement) means the written statement prepared by a provider under subsection 17(1).

domestic and family violence support (DFV support) means the support provided by a provider under Part 3.

economic and financial abuse means a pattern of behaviour used by an individual to control, exploit or sabotage the money, finances or economic resources, of another individual which affects the other individual’s ability to obtain, use or maintain economic resources, economic security and potential for self-sufficiency and independence.

end-user means the consumer using a telecommunications product who is not a customer.

inclusive design means a design process in which a product, service, or environment is designed to be usable for as many people as possible regardless of age, ability and circumstance.

intersectional approach means an approach that recognises that the experience of domestic and family violence can be different based on a range of cultural, individual, historical, environmental or structural factors including (but not limited to) race, age, geographic location, sexual orientation, ability or class.

large provider, for a financial year, means a provider with at least 30,000 services in operation on 1 July in that financial year.

life threatening communications has the meaning given by the C525 Handling of Life Threatening and Unwelcome Communications Industry Code.

Note: The C525 Handling of Life Threatening and Unwelcome Communications Industry Code can be accessed free of charge on Communications Alliance’s website: https://www.commsalliance.com.au.

non-domestic sexual violence means sexual violence outside of a domestic and family violence situation.

perpetrator means the individual who has or is using or is alleged to be using domestic and family violence against another individual.

personnel means staff, contractors or agents engaged by or on behalf of a provider who are involved, either directly or indirectly, with consumers in Australia.

Example: A senior manager or other manager employed by the provider who has direct or indirect involvement in the provider’s dealings with consumers will fall within this definition of “personnel”.

provider means a carriage service provider referred to in subparagraph 4(1)(a)(i).

quick exit function means a button that is prominently displayed on a webpage, that allows the user to instantly leave the webpage with a single click, and which redirects the user to a webpage not connected with the provider, to hide what the user was looking at.

restriction means a restriction imposed by a provider on a consumer’s access to telecommunications services, or to a feature of those services, that are offered for supply by the provider and includes reducing data speeds or imposing spend controls or other usage limits.

service in operation, on 1 July in a year, means a service that is both:

(a) a telecommunications service; and

(b) an active service on that day.

Note: A service in operation can be pre-paid or post-paid, and it can be the subject of a contract of fixed duration or can be a service without a minimum or maximum term.

sexual violence means sexual behaviour that occurs where consent is not freely given or obtained, is withdrawn or the individual is unable to consent due to their age or other factors. It can be physical or non-physical. It occurs any time an individual is forced, coerced, or manipulated into any sexual activity. It may occur within intimate relationships, friendships or with acquaintances and strangers.

small provider, for a financial year, means a provider with fewer than 30,000 services in operation on 1 July in that financial year.

specialised domestic and family violence training (specialised DFV training) means the training delivered or arranged for by a provider under section 22.

subscription broadcasting service has the same meaning as in the Broadcasting Services Act 1992.

subscription television narrowcasting service has the same meaning as in the Broadcasting Services Act 1992.

support telephone numbers means the following telephone numbers:

1800 Respect 1800 737 732

1800 ElderHelp 1800 353 374

Full Stop 1800 385 578

National Debt Helpline 1800 007 007

National Disability Abuse and Neglect Hotline 1800 880 052

Rainbow Sexual, Domestic and Family Violence Helpline 1800 497 212.

suspension means a suspension imposed by a provider on a consumer’s access to a telecommunications service, apart from access to emergency service numbers.

systems abuse means the manipulation of legal and other systems by a perpetrator, in order to exert control over, threaten or harass another individual which may result in depleting that individual’s financial resources and emotional wellbeing, and adversely impacting that individual’s capacity to maintain employment or to care for children.

technology facilitated abuse means abuse that is facilitated using technology, which may include telecommunications products and services, to control, abuse, track, intimidate, threaten or harass an individual.

telecommunications goods means any goods supplied by a provider for use in connection with the supply of a telecommunications service, whether or not the goods are supplied in conjunction with, or separately from, a telecommunications service.

telecommunications product means telecommunications goods or a telecommunications service.

telecommunications service means:

(a) a listed carriage service or any service supplied by a provider in connection with that service; and

(b) a content service (other than a subscription broadcasting service or a subscription television narrowcasting service) provided by a provider in connection with the supply of a listed carriage service.

TIO means the Telecommunications Industry Ombudsman.

trauma informed means recognising the prevalence of trauma and its impacts on the emotional, psychological and social well-being of people and communities. Trauma-informed practice means integrating an understanding of past and current experiences of violence and trauma in all aspects of service delivery. The goal of trauma-informed systems is to avoid re-traumatising individuals and to support safety, choice and control to promote healing.

unwelcome communications has the meaning given by the C525 Handling of Life Threatening and Unwelcome Communications Industry Code.

Note: The C525 Handling of Life Threatening and Unwelcome Communications Industry Code can be accessed free of charge on Communications Alliance’s website: https://www.commsalliance.com.au.

warm transfer occurs when a member of the provider’s personnel (the transferor) answers a query from an affected person and transfers the query to another member of the provider’s personnel (the transferee), and:

where the affected person has made a telephone call to the transferor – the transferor explains the details of the affected person’s query to the transferee on behalf of the affected person; or
where the affected person is using an online written chat function on the provider’s website or through the provider’s mobile application – the transferor makes available the written details of the affected person’s query to the transferee on behalf of the affected person,

before transferring the query, to avoid the affected person having to repeat their circumstances.

The transferor may be an individual or an automated computer system.

The transferee must be an individual.

A service is an active service on 1 July in a given year if the provider of the service has issued an invoice to, or received a payment from, a customer for the provision of that service to the customer on any day in the three months prior to July of that given year.

Note: A number of other expressions used in this industry standard are defined in the Act, including the following:

ACMA;
carriage service;
carriage service provider;
carrier;
content service;
listed carriage service.

Note: Financial year is defined in the Acts Interpretation Act 1901 to mean a period of 12 months starting on 1 July.

6 References to other instruments

In this industry standard, unless the contrary intention appears:

(a) a reference to any other legislative instrument is a reference to that other legislative instrument as in force from time to time; and

(b) a reference to any other kind of instrument is a reference to that other instrument as in force or existing from time to time.

Note 1: For references to Commonwealth Acts, see section 10 of the Acts Interpretation Act 1901; and see also subsection 13(1) of the Legislation Act 2003 for the application of the Acts Interpretation Act 1901 to legislative instruments.

Note 2: For references to instruments that are not legislative instruments, see section 589 of the Act.

Note 3: All Commonwealth Acts and legislative instruments are registered on the Federal Register of Legislation which may be accessed free of charge at www.legislation.gov.au.

Part 2—Sexual violence outside a domestic and family violence situation

7 Requirement where a consumer has experienced sexual violence outside a domestic and family violence situation

Where a consumer discloses to a provider that they have experienced non-domestic sexual violence, the provider must treat the consumer as an affected person for the purposes of providing or offering telecommunications support in accordance with the following provisions:

subsection 8(2)
section 10
section 13;
section 14;
subsections 15(2), (3) and (4).

Part 3—Providing support

8 Requirement to advise affected persons of available support

For subsection (2) and subsection 9(1), where a provider interacts with an affected person, the provider must ask the affected person to confirm that it is safe for the affected person to communicate with the provider.
If a provider has received the confirmation under subsection (1), the provider must advise the affected person (unless this advice has already been given):
that the provider can assist the affected person in accordance with the provider’s DFV policy;
if the provider has personnel or a specialised team that provides tailored assistance to affected persons:
about that team; and
that the affected person can request to have a warm transfer to a member of that team; and
that there are support organisations listed in the provider’s DFV statement and where that statement can be located by the affected person.
Following the provision of information to an affected person under subsection (2), a provider must ask the affected person if they want to access further information and support from the provider.

9 Application of sections 10 and 11

Sections 10 and 11 apply if:
an affected person has indicated, in response to a provider’s question under subsection 8(3), that they want to access more information or support from the provider; and
the provider has received the confirmation under subsection 8(1).
When dealing with an affected person, a provider need only comply with subsections 10(1) and 11(1) once.

10 Requirement to agree on a preferred communication method

Where this section applies, the provider must:
advise the affected person what communication methods are offered by the provider; and
ask the affected person what their preferred communication method is and whether the affected person has a preferred time of day for communication from the provider using that method of communication.
For subsection (1), that method, and time of day where relevant, will be the agreed communication method for the affected person on matters relating to domestic and family violence until such time as a different communication method or time of day for communication, is requested by the affected person.
If there is an agreed communication method in place for an affected person, the provider must only communicate with the person on matters relating to domestic and family violence using that method, unless:
the provider is under a legal obligation to communicate with the affected person via a different communication method; or
the affected person contacts the provider using a different communication method and confirms that the provider can use that different communication method for the purposes of that communication.

11 Requirement to discuss support options

Where this section applies, the provider must:
identify whether the affected person is the customer or is an end-user of the telecommunications products;
where the affected person is a customer and there is an authorised representative listed on an affected person’s account – advise the affected person:
what the authorised representative can access on the account; and
that the affected person can keep, change or remove the authorised representative;
advise the affected person how they can make changes to their account and update their personal information;
ask what concerns the affected person has about their privacy, safety and security in relation to their telecommunications product and their account (if applicable);
if the affected person identifies that they have concerns for the purposes of paragraph (d) – discuss with the affected person what options are available to the affected person to protect their privacy, safety and security according to whether the affected person indicates they are the customer or an end-user of the relevant telecommunications products; and
ask the affected person for their instructions on which of the options discussed in paragraph (e), the affected person would like to adopt in relation to their telecommunications products and account (if applicable).
If the affected person indicates to the provider that their circumstances have changed, and requests that the instructions given pursuant to paragraph (1)(f) be updated, the provider must, as soon as practicable, amend the instructions as requested.
The provider must act in accordance with any instructions agreed with an affected person under this section.

12 Minimum requirements for support

For paragraph 11(1)(e), the provider must make available to an affected person, at least the following support options:

the setting up of a new account that is not linked to the perpetrator; and
privacy, safety and security protections on the affected person’s account, for example, a PIN or password, or the sending of a verification code to a safe number or email address provided by the affected person or within a mobile application.

13 Providing support to affected persons

Where an affected person has sought assistance from a provider – the provider must keep the affected person informed about that matter via the agreed communication method, if any.

Note: For agreed communication method, see subsection 10(2).

Where an affected person expresses or indicates concern about their safety to a provider, the provider must:
prioritise taking action to assist the person with any needs they may have in relation to their telecommunications product; and
where the affected person is the customer of the relevant account – in the 30 days, or in such other longer period agreed with the affected person, if any, after the person has first expressed or indicated concern about their safety – the provider must not restrict, suspend or disconnect the affected person’s telecommunications service, unless it is requested by the affected person.
Subject to subsection (5), in cases where:
an affected person’s telecommunications service has been restricted, suspended or disconnected (the service limiting action); and
the person requests that the service limiting action be reversed urgently because of a domestic and family violence related safety risk,

the provider of the telecommunications service must reverse the service limiting action as a matter of urgency, the first time that the affected person contacts the provider and raises the domestic and family violence related safety risk.

For subsection (3), if reversal of the service limiting action is not practical, the provider must offer the affected person an equivalent telecommunications service.

Note: For example, if the affected person’s account cannot be reconnected, the provider may offer the affected person a new telecommunications service on the same or equivalent terms.

Subsection (3) does not apply where reversal of the service limiting action would contravene another law of the Commonwealth.

Note: For example, see sections 65, 67 and 69 of the Telecommunications (Emergency Call Service) Determination 2019 which prohibit the supply of carriage services to a mobile phone that is not configured to be able to access the emergency call service.

Where the customer of a telecommunications product:
has been identified as an affected person; and
has sought assistance from the provider within the last 60 days,

before taking credit management action, the provider must:

take into account the potential impact on the affected person of such action at that time;
take into account whether any other person has contributed to the debt; and
review the affected person’s records to ensure that any action agreed to has been undertaken, including, for example, that payment plans have been set up correctly or payment extensions have been processed.

14 A provider must not require evidence

Subject to subsection (2), a provider must not require evidence or supporting material which demonstrates that a consumer is an affected person.
Subsection (1) does not apply where:
the provider is under a legal obligation to obtain evidence or supporting material in relation to a claim that a consumer is an affected person; or
obtaining such evidence or supporting material is reasonably necessary to protect the interests of an affected person.
For subsection (2), the provider must rely on evidence it already has in its system before requesting only the minimum amount of evidence or information needed for the relevant purpose mentioned in that subsection.

15 Communications with an affected person

A provider must not require an affected person to contact or engage with the perpetrator of the affected person’s domestic and family violence, or with the perpetrator’s authorised representative.
When communicating with an affected person, a provider must not require the affected person to disclose the circumstances of the abuse as a precondition to accessing support or assistance.
When:
a member of the personnel of a provider (the transferor) is speaking on the phone or chatting via an online chat function, to an affected person; and
the affected person needs to be transferred to another member of the provider’s personnel (the transferee) for appropriate support,

the transferor must offer a warm transfer to the affected person.

If an affected person accepts the offer of a warm transfer under subsection (3), the provider must undertake the warm transfer to the transferee.
If an affected person raises domestic and family violence as a safety concern with the provider of their telecommunications product and makes a request about how their bill is to be received, and the provider is able to comply with that request – the provider must comply with the request.

Part 4—Requirements relating to availability of DFV support information

16 Requirement to publish, on commencement of this provision, information relating to available support for affected persons

Subject to subsection (2), a provider must publish on its website information about:
the specific support, if any, the provider offers to an affected person;
how an affected person can access any support that is available.
If a provider does not offer specific support to affected persons – the provider must publish on its website:
information about one or more organisations that an affected person can contact for support in relation to domestic and family violence, including how an affected person can contact such organisations;
a statement that the provider will have further support in place on the date on which section 17 of this industry standard applies to the provider; and
where affected persons should direct any requests for support from the provider.

This section ceases to have effect at the end of the day before section 17 of this industry standard applies to the provider.

17 Requirement to publish a DFV statement

A provider that offers to supply telecommunications products to consumers must publish a DFV statement which includes information about how and where consumers can find DFV support.
A DFV statement must include:
an express statement that the provider has procedures and policies in place to protect the safety of affected persons;
an express statement that the provider is committed to:
keeping affected persons connected to their telecommunications service;
where a service has been restricted, suspended or disconnected (the service limiting action) and where affected persons express or indicate concern about their safety – reversing the service limiting action in relation to the telecommunications service as a matter of urgency; and
where subparagraph (ii) applies, but reversal of the service limiting action is not practical – offering the affected person an equivalent telecommunications service.
recognition that domestic and family violence, and, non-domestic sexual violence, can be a reason for non-payment and that consumers affected by domestic and family violence, or non-domestic sexual violence, may be entitled to financial hardship assistance under the Telecommunications (Financial Hardship) Standard 2024;
how consumers can contact the provider for assistance (including hours, method of contact and how to organise call backs); and
how the consumer can access information from one or more third party domestic and family violence support organisations.

Note: A third party domestic and family violence support organisation includes 1800 Respect.

A DFV statement must:
be in writing in print or digital form;
be clear and use plain language;
be accurate and up to date;
use a font style and size that is clear and easy to read;
be accessible, including to consumers with disabilities, from cultural or linguistically diverse backgrounds or with other special needs;
be made clearly available to consumers:
on the home page of the provider’s website; and
if the provider uses a mobile application – on the mobile application; and
if:
the provider offers an online written chat function;
a consumer has indicated during a chat that they are, or may be, an affected person; and
the consumer has consented to the provision of the statement,

on the online written chat function.

Note: See section 2 for commencement information.

18 Requirements regarding access to DFV support services

A provider must provide a range of contact channels to facilitate direct access for affected persons to its DFV support, including at least 2 of the following communication channels:
a domestic and family violence specialist support phone number;
a dedicated webform through which an affected person can request the provider to initiate contact with the affected person;
an online written chat function;
in person, in a retail store operated by the provider;
an email address.

Note: A provider may provide additional channels to those mentioned in subsection (1).

For subsection (1), at least one of the communication channels must allow an affected person to connect to a member of the personnel of the provider who is an individual.
For subsection (1), if an affected person requests a provider to initiate contact or to call the affected person back at a later time, the provider must use:
the agreed communication method for the affected person; or
any other communication method, and do so at any particular time, specified by the affected person, if the provider can support that communication method at the time of day specified by the affected person.
A provider must have personnel who are accessible during business hours to directly assist affected persons.

Part 5—General requirements relating to policies and procedures

19 Develop domestic and family violence policies and procedures

A provider that offers to supply telecommunications products to consumers must develop:
a DFV policy relating to its interactions with affected persons that complies with the minimum requirements in subsection 20(1);
DFV procedures which:
require personnel to give effect to its DFV policy;
require compliance with its obligations under this industry standard; and
comply with the minimum requirements in subsection 20(2);
The provider must ensure that its DFV policy and its DFV procedures are in place at all times after the end of:
for large provider – the 6 month period starting on the commencement of this section; and
for a small provider – the 9 month period starting on the commencement of this section.
The provider must:
comply with its DFV policy; and
comply with its DFV procedures.
The provider’s most senior responsible executive must:
approve the provider’s DFV policy;
approve the provider’s DFV statement; and
be responsible for the implementation and operation of the provider’s DFV procedures.

20 Minimum requirements for DFV policies and procedures

A provider’s DFV policy must:
be in writing;
prioritise the safety of affected persons;
set out how the provider will support and manage affected persons;
set out the options for assistance the provider can offer to affected persons;
set out the support the provider can offer to its personnel who deal with affected persons;
set out how the provider will protect the privacy and security of an affected person, including record-keeping requirements about the handling and disclosure of personal information that are tailored to protecting the privacy and security of an affected person;
set out how a provider will use inclusive design in the development and review of its systems, processes and telecommunications products to identify and reduce risks to affected persons; and
set out how the provider will use an intersectional approach in supporting consumers who are or may be experiencing domestic and family violence, and, where applicable, non-domestic sexual violence.
A provider’s DFV procedures must:
be trauma informed;
set out how personnel can safely and appropriately identify, support and assist consumers that are affected persons;
set out how personnel can safely and appropriately engage with perpetrators;
set out how personnel will implement the requirements in subsections 27(1) and (2);
set out how personnel can manage and respond to domestic and family violence, and where applicable, non-domestic sexual violence, including clearly identifying;
the responsibilities of personnel in relation to dealing with affected persons;
escalation channels that personnel can use;
when the escalation channels should be used; and
the support that is available to personnel to assist affected persons;
set out how actions agreed with an affected person will be recorded in a way that is safe from inadvertent disclosure to perpetrators, including when the actions have been completed; and
set out the provider’s processes to minimise the number of times an affected person has to explain their circumstances.

Part 6—Training

21 Training for all personnel

A provider must deliver, or arrange for a third party individual or organisation that has expertise in dealing with domestic and family violence to deliver, training on its DFV policy to all of its personnel.
The DFV policy training must be delivered to the personnel:
either:
for:
a large provider – within 9 months after the day on which this section commences; or
a small provider – within 12 months after the day on which this section commences; or

Note: See section 2 for commencement information.

for a person subsequently engaged as personnel by a provider - within one month of the person’s commencement as personnel for the provider; and
annually after the personnel first receive the training.

22 Training of customer facing personnel

A provider must deliver, or arrange for a third-party individual or organisation that has expertise in dealing with domestic and family violence to deliver, specialised DFV training to:
its personnel who deal directly with general inquiries from consumers;
its personnel who are likely to deal with domestic and family violence related issues due to the area in which they work; and
any specialist domestic and family violence support personnel.

Note: For paragraph (b), relevant areas may include, for example, sales, credit collections, financial hardship, fraud, privacy and complaint management.

The specialised DFV training referred to in subsection (1) must cover:
the application of the provider’s DFV policy and its DFV procedures;
the nature and impact of domestic and family violence with a focus on how domestic and family violence relates to telecommunications services;
how to identify affected persons;
recognising how intersectional issues may impact affected persons and the support they require;
how to engage with affected persons, including responding to affected persons where there is a change in their circumstances; and
how to recognise and prioritise the safety of affected persons, and of personnel, in engaging with perpetrators.
The specialised DFV training may be tailored as applicable to fit the relevant personnel’s specific role.
The specialised DFV training must be delivered to the personnel referred to in subsection (1):
either:
for those personnel who deal directly with consumers at the time this section commences:
for personnel of a large provider – within 9 months after the day on which this section commences; or
for personnel of a small provider – within 12 months after the day on which this section commences; or

Note: See section 2 for commencement information.

for personnel not covered by subparagraph (i) – before they first start dealing directly with consumers; and
annually after the personnel first receive the training.

Part 7—Monitoring and review

23 Requirement to review policy and procedures

A provider must monitor and review its DFV policy and its DFV procedures and make any relevant changes to ensure the policy and procedures are fit for purpose:

at least once in each period of 24 months after:
for a large provider – the day on which this section commences; or
for a small provider – the day on which this section first applies to small providers; and

Note: See section 2 for commencement information. See subsection 4(2) for the application of this section to small providers.

at any time, upon the provider becoming aware that its DFV policy or its DFV procedures are not operating to protect the safety of affected persons.

24 Requirement to monitor personnel

A provider must develop and implement an internal monitoring program to assess its personnel’s compliance with its DFV policy and its DFV procedures.
If the internal monitoring program implemented for subsection (1) indicates non-compliance by the provider’s personnel with the provider’s DFV policy or DFV procedures – the provider must commence action to ensure compliance by personnel with the DFV policy and DFV procedures, within 10 business days.
The most senior responsible executive of the provider must approve the internal monitoring program developed for subsection (1).
Not less than every 6 months starting from:
for a large provider – 6 months after the day on which this section commences; or
for a small provider – 6 months after the day on which this section first applies to small providers,

the most senior responsible executive of the provider must review the outcomes of the internal monitoring program developed for subsection (1).

Note: See section 2 for commencement information. See subsection 4(2) for the application of this section to small providers.

If the outcome of a review under subsection (4) indicates that the provider’s DFV policy or DFV procedures are not operating to protect the safety of affected persons, the provider must make any relevant changes to its DFV policy or DFV procedures as soon as practicable to ensure the policy and procedures are fit for purpose.

Part 8—Security and privacy

25 Requirements relating to the security and privacy of an affected person

Unless required by law, a provider must not, without the affected person’s consent, disclose to any other person any information about an affected person which:
can be used to identify or locate an affected person;
includes the contact details for an affected person; or
includes an affected person’s financial information.
A provider must provide a quick exit function on all webpages that relate to support for affected persons.
Any calls made using a telecommunications service to the support telephone numbers must not be recorded on any bill, record or other material issued to a customer in relation to the service.
A provider must only access an affected person’s information for a legitimate purpose directly related to management of the account.

26 Requirement on carriers to provide assistance

A carrier must provide reasonable assistance to enable a provider to comply with the requirement in subsection 25(3).

27 Security of personal and sensitive information

Any information collected by a provider under this industry standard in relation to an affected person must be stored securely in accordance with the measures in place under subsection (2).
A provider must implement measures to ensure the information it retains under this industry standard is protected from misuse, interference, loss or disclosure to a perpetrator, including:
details of the affected person’s arrangements agreed between the person and the provider;
the affected person’s current address and billing details; and
the fact that the affected person has been identified, or has identified, as being an affected person.

28 Privacy

Where a provider is not subject to the requirements of the Privacy Act 1988, it must ensure that personal information it collects in connection with this industry standard:

is not disclosed to a third party, or used, except:
where the disclosure is to the TIO or the ACMA as required to manage a complaint made to, or an investigation conducted by, either of those entities;
with the express consent of the consumer; or
where disclosure is otherwise required or authorised by or under an Australian law or a court or tribunal order; and
is disposed of, or destroyed, in a secure manner when it is no longer needed under this industry standard or any other applicable laws.

Note: Where a provider is subject to the Privacy Act 1988, Australian Privacy Principle 6 in Schedule 1 to that Act will apply to the use or disclosure of personal information it collects in connection with this industry standard.

29 Where privacy is breached

If the personal information of an affected person held by a provider is accessed or disclosed without authorisation – the provider must, within two days of becoming aware of the unauthorised access or disclosure:
subject to subsection (2), notify the affected person; and
notify the ACMA.
If notifying the affected person under paragraph (1)(a) would be inconsistent with the agreed communication method for the affected person – the provider must wait until the next time it can notify the affected person that is consistent with the agreed communication method.
When a provider notifies an affected person under subsection (1), the provider must provide the affected person with the contact details of a national or state based domestic and family violence support service for safety planning assistance.

Note: The Privacy Act 1988 includes obligations on some providers to notify individuals and the Office of the Australian Information Commissioner of a notifiable data breach.

Part 9—Record keeping

30 Requirements to keep records

A provider must keep records that are sufficient to demonstrate its compliance with the requirements of this industry standard:
Where a provider keeps records under this section:
it must limit the collection of information to information necessary to demonstrate compliance; and
it must take such steps as are reasonable in the circumstances:
to protect the information from misuse, interference and loss, and unauthorised access, modification or disclosure; and
to ensure the information is disposed of, or destroyed, in a secure manner where the record is no longer needed under this industry standard or any other applicable laws.

31 Record retention

Subject to subsection (2), a provider must:
keep the records required to be kept under subsection 30(1) for a minimum of 2 years or for as long as the affected person receives assistance under this industry standard, whichever is longer; and
make the records available to the ACMA, upon written request.
Where an affected person has made a complaint to a provider, the provider must keep the records required to be kept under subsection 30(1) that are relevant to that complaint:
for minimum of 2 years; or
if the complaint is not resolved within 2 years, for 12 months after the date the complaint is resolved.
Where practicable, records kept under subsection (1) must not contain the personal information of an affected person.
For paragraph 14(2)(a), where a provider obtains evidence or supporting material – it must:
only retain a copy or record of the information received from the affected person for the period that it is required in order to meet the legal obligation;
after the legal obligation has been met, dispose of, or destroy, all copies or records of the information in a secure manner; and
keep a record of the type of evidence that was sought, provided and sighted by the provider.
For paragraph 14(2)(b), where a provider obtains evidence or supporting material – after sighting the evidence or supporting material, it must:
dispose of, or destroy, all copies or records of the information in a secure manner; and
keep a record of the type of evidence that was sought, provided and sighted by the provider.

Part 10—Consultation

32 Requirement to consult

In developing its DFV policy, DFV procedures, DFV policy training and specialised DFV training, a provider must consult with:
a national or state based domestic and family violence support service or organisation; and
either:
a panel comprised of people with lived experience of domestic and family violence or representatives of people with lived experience of domestic and family violence; or
a national or state-based organisation that represents a group who are or may be disproportionately affected by domestic and family violence, for example, individuals with disabilities, First Nations people, people from culturally and linguistically diverse backgrounds or people who identify as LGBTQIA+.
When reviewing its DFV policy and DFV procedures under paragraph 23(a), a provider must consult with:
a national or state based domestic and family violence support service or organisation; and
either:
a panel comprised of people with lived experience of domestic and family violence or representatives of people with lived experience of domestic and family violence; or
a national or state-based organisation that represents a group who are or may be disproportionately affected by domestic and family violence, for example, individuals with disabilities, First Nations people, people from culturally and linguistically diverse backgrounds or people who identify as LGBTQIA+.
For a large provider, consultation undertaken for subsections (1) and (2) must be undertaken by the provider directly.
For a small provider, consultation undertaken for subsections (1) and (2) may be undertaken on behalf of the provider by an industry group or body that represents the provider.
A provider must take into account the responses, if any, to consultations conducted under this Part when developing and reviewing its DFV policy, DFV procedures, DFV policy training and specialised DFV training.

Part 11—Conferral of functions and powers

33 Conferral of functions and powers on the TIO

This industry standard confers on the TIO the functions and powers of:

receiving;
investigating;
facilitating the resolution of;
making determinations in relation to;
giving directions in relation to; and
reporting on,

consumer complaints about matters referred to in this industry standard.

Note: See section 114 of the Act.

meta-content-style-type: text/css meta-content-type: application/xhtml+xml; charset=utf-8

?xml version="1.0" encoding="utf-8" standalone="no"?>

Telecommunications (Domestic, Family and Sexual Violence Consumer Protections) Industry Standard 2025

The Australian Communications and Media Authority makes the following standard under subsection 125AA(1) of the Telecommunications Act 1997.

Dated: 6 June 2025

Nerida O’Loughlin

[signed]

Member

Cathy Rainsford

[signed]

General Manager

Australian Communications and Media Authority

Contents

4 Application of industry standard

5 Definitions

6 References to other instruments

Part 2—Sexual violence outside a domestic and family violence situation

7 Requirement where a consumer has experienced sexual violence outside a domestic and family violence situation

The standard establishes and operationalises a set of interlocking concepts to manage provider behaviour and consumer risk in the context of domestic and family violence (DFV) and sexual violence.

Affected person. The central concept is the "affected person", defined in s 5 as an individual consumer who identifies as someone who is, or may be, experiencing DFV, including former, prospective or current consumers. The standard also requires that consumers who disclose non-domestic sexual violence be treated as affected persons for the purposes of several support provisions (s 7). That expands the protective regime beyond strictly domestic settings to specified instances of sexual violence.

Provider and carrier roles. "Provider" is defined to mean carriage service providers in their dealings with consumers (s 4 and s 5). The instrument also addresses carriers in relation to their supply of carriage services to carriage service providers (s 4). The distinction matters operationally: providers have direct consumer obligations (policies, statements, contact channels, training, records), while carriers have a limited, enabling obligation to assist in particular technical respects, such as ensuring support call activity is not recorded on bills (s 26) and assisting providers to comply with the no-recording requirement (s 25(3), s 26).

Support mechanics and communication. The standard sets a procedural sequence when a consumer interacts with a provider: (1) ask whether it is safe to communicate and obtain confirmation (s 8(1)); (2) advise about available support and provide DFV statement details (s 8(2)); (3) where the affected person asks for more support, agree an "agreed communication method" and preferred time (s 10); (4) identify whether the person is a customer or an end-user and discuss account options including removal of an authorised representative (s 11); and (5) offer and implement support options (ss 11-13). The agreed communication method becomes the default channel for DFV matters and limits provider communications to that method unless legal obligations or subsequent consents allow otherwise (s 10).

Privacy and security. The standard emphasises minimising disclosure and protecting personal and sensitive information. Providers must not disclose identifying or contact or financial information about an affected person without consent unless required by law (s 25(1)). Providers must implement measures to protect the fact of identification as an affected person, arrangements agreed with the person, and the person’s address and billing details (s 27). It requires quick exit functions on webpages dealing with support (s 25(2)), and specifically prevents listing calls to support telephone numbers on any bill or other material issued to a customer (s 25(3)). When privacy is breached, providers must notify the affected person and ACMA within two days, subject to communication-safety constraints (s 29).

Policies, procedures and training. Providers must develop DFV policies and written procedures that are trauma informed, prioritise safety, set out support options and account protections, and address inclusive design and intersectional approaches (ss 19-20). The most senior responsible executive must approve the DFV policy and DFV statement and be responsible for implementation (s 19(4)). Training obligations require DFV policy training for all personnel and specialised DFV training for customer-facing staff, with timing and annual refresh requirements and prescribed training content (ss 21-22).

Record-keeping, monitoring and accountability. Providers must keep records sufficient to demonstrate compliance, limit collection to what is necessary, protect records and dispose securely (ss 30-31). Records must be retained for a minimum of two years or longer while assistance continues (s 31(1)). Providers must implement and approve internal monitoring programs and must act to correct non-compliance by personnel within ten business days of detecting it (s 24). Providers must consult DFV organisations and panels with lived experience in developing and reviewing policies and training (s 32).

Dispute resolution and oversight. The instrument expressly confers functions and powers on the Telecommunications Industry Ombudsman to receive and determine complaints about matters referred to in the standard (s 33). The text also creates express reporting and notification duties to ACMA in privacy breach cases and requires providers to make records available to ACMA on written request (s 29(1)(b); s 31(1)(b)).

Temporal and scale distinctions. The standard differentiates large and small providers. Large providers are those with at least 30,000 services in operation on 1 July in a financial year; small providers have fewer than 30,000 services (s 5). Different timelines for policy implementation, training and review apply to large and small providers (see ss 2, 19, 21-23). Some provisions do not apply to small providers until a later date (s 2; s 4(2)). The instrument contains commencement staging and notes that the table in s 2 relates to the original making and will not be amended to address later amendments (s 2 Note 1).

Primary regulated entities. The standard applies to carriage service providers in their dealings with consumers and to carriers in relation to their supply of carriage services to carriage service providers (s 4(1)). In the body of the instrument "provider" is used to refer to the carriage service provider subject to obligations such as policies, training, service support and record-keeping (s 5). Carriers carry a narrower set of obligations, principally to assist providers to avoid billing records for support calls being visible to customers (s 26) and to otherwise support providers' compliance with the privacy and no-recording provisions (s 25(3), s 26).

Consumers and affected persons. The standard regulates interactions with consumers, defined broadly to include individuals who acquire telecommunications products for personal or domestic use, certain not-for-profits, and small businesses meeting specified criteria (s 5). The operative protected class is the "affected person", an individual consumer who identifies as experiencing DFV or non-domestic sexual violence where specified (s 5; s 7). The instrument also recognises end-users , consumers using a product who are not the account customer , and sets separate obligations when the affected person is an end-user rather than the account customer (s 11).

Personnel. Obligations fall on "personnel", defined to include staff, contractors or agents engaged by or on behalf of a provider involved with consumers in Australia (s 5). The standard requires training for all personnel (s 21) and specialised training for customer-facing and other identified personnel (s 22), and requires providers to monitor personnel compliance and act on non-compliance (s 24).

Authorised representatives and perpetrators. The standard addresses authorised representatives who may appear on accounts, mandating that providers advise affected persons about what authorised representatives can access and that affected persons can change or remove authorised representatives (s 11(1)(b)). Providers are expressly prohibited from requiring affected persons to contact or engage with perpetrators or their authorised representatives (s 15(1)). The instrument also requires personnel procedures for safe engagement with perpetrators where necessary (s 20(2)(c)).

Industry bodies and third-party organisations. Providers are required to consult with domestic and family violence support organisations and either a lived-experience panel or representative organisations when developing and reviewing policies, procedures and training (s 32). For small providers the consultation may be undertaken on their behalf by an industry group or body that represents the provider (s 32(2)).

Regulatory bodies. ACMA is the issuing authority and retains oversight roles. Providers must notify ACMA of unauthorised access or disclosure of affected person information within two days of becoming aware (s 29(1)(b)). Providers must make records available to ACMA on written request (s 31(1)(b)). The TIO is given explicit functions and powers to receive, investigate, facilitate resolution, make determinations, give directions in relation to, and report on complaints arising under the standard (s 33).

Timing and scale effects. Obligations phase in by size. Certain core provisions commence on 1 July 2025 (s 2 Column 1 item 1), with most obligations commencing on 1 January 2026 (s 2 Column 1 item 2). The provisions in item 2 do not apply to small providers until 1 April 2026 (s 4(2) and s 2 Note 3). Implementation timetables for policies and training differentiate large and small providers (ss 19(2), 21(2), 22(2)). These timing rules affect who must comply from which date and create lead time for operational preparation.

This section summarises the principal affirmative duties the instrument places on providers, and the rights it creates for affected persons, with references to the exact provisions.

Duty to treat non-domestic sexual violence disclosures as DFV. If a consumer discloses non-domestic sexual violence, the provider must treat the consumer as an affected person for purposes of specified support provisions including the duty to advise available support, agree communication methods, provide support and not require evidence (s 7).

Safety-first communication protocol. Before discussing support, providers must ask an affected person to confirm that it is safe to communicate (s 8(1)). If safety is confirmed, providers must advise the affected person of available assistance under the DFV policy, whether a specialised team exists and where the DFV statement and third-party supports are located (s 8(2)). The provider must then ask whether the affected person wants further information and support (s 8(3)).

Agreed communication method. If the affected person requests more support, the provider must disclose available communication methods, ask for the affected person's preferred method and time, and use that "agreed communication method" for DFV matters unless legal obligations require another method or the affected person later authorises a different method (s 10). Providers must keep affected persons informed via the agreed communication method in relation to matters they have sought assistance for (s 13(1)).

Account protections and support options. Providers must discuss support options and identify whether the affected person is a customer or an end-user (s 11(1)). When assisting a customer who has an authorised representative, providers must explain what that representative can access and inform the affected person they can keep, change or remove authorised representatives (s 11(1)(b)). Minimum support options that must be available include setting up a new account not linked to the perpetrator and security protections such as PINs or verification codes to safe contact points (s 12).

Restriction, suspension or disconnection rules. Where an affected person indicates safety concerns, the provider must prioritise assistance and must not restrict, suspend or disconnect the affected person’s service for 30 days after the safety concern is first expressed, unless the affected person requests the restriction or disconnection or another period is agreed (s 13(2)). If a service has been restricted, suspended or disconnected and the affected person urgently requests reversal because of DFV safety risk, the provider must reverse the action as a matter of urgency the first time the affected person raises the safety risk, unless reversal is impractical or would contravene another law (s 13(3)-(5)). If reversal is impractical the provider must offer an equivalent telecommunications service (s 13(4)). The provider must also, before taking credit management action within 60 days of assistance sought, take into account DFV impacts, whether another person contributed to the debt, and check records to ensure agreed actions have been performed (s 13(6)).

No evidence requirement, with limited exceptions. Providers must not require evidence or supporting material proving a consumer is an affected person (s 14(1)). Two exceptions permit a provider to request evidence where the provider is under a legal obligation to obtain it, or obtaining it is reasonably necessary to protect the interests of the affected person (s 14(2)). If evidence is sought under these exceptions, the provider must rely on evidence already in its system where possible and request only the minimum amount necessary (s 14(3)).

Prohibitions on coercive interactions. Providers must not require an affected person to contact or engage with the perpetrator or the perpetrator's authorised representative (s 15(1)). Providers cannot require disclosure of the circumstances of abuse as a precondition to accessing support (s 15(2)).

Warm transfer obligation. Where transfer between personnel is needed during a call or online chat, the transferor must offer a warm transfer and, if accepted, must undertake the warm transfer to an individual transferee (s 15(3)-(4)). The transferor may be an automated system but the transferee must be an individual (s 5 definition of warm transfer).

Information availability and accessibility. Providers must publish DFV support information on their website on commencement of the relevant provision and, if they offer products to consumers, must publish a DFV statement containing specified content including a commitment to keep affected persons connected and, where reconnection is not practical, to offer an equivalent service (ss 16-17). The DFV statement must be clear, plain language, accessible, and made clearly available on the home page and, where applicable, in a mobile application (s 17(3)-(4)).

Channels and staffing. Providers must provide at least two contact channels for affected persons, chosen from categories listed in s 18(1), and at least one channel must allow connection to a member of personnel who is an individual (s 18(2)). Providers must have personnel accessible during business hours to directly assist affected persons (s 18(4)).

Privacy and security obligations. Providers must not disclose identifying, contact or financial information about an affected person without consent unless required by law (s 25(1)). Providers must provide quick exit functions on support webpages, ensure support telephone calls to specified support numbers are not recorded on bills or other materials, and access affected person information only for legitimate account management purposes (s 25(2)-(4)). Carriers must provide reasonable assistance to enable providers to meet the no-bill-record requirement (s 26). Providers must implement measures to protect retained information from misuse and unauthorised disclosure, including arrangements agreed and the fact of identification as an affected person (s 27).

Record-keeping and disclosure. Providers must keep records sufficient to demonstrate compliance and only collect necessary information, protect it from misuse, and dispose of it securely when no longer needed (ss 30-31). Records must be kept for at least two years or as long as assistance continues (s 31(1)). Relevant records must be made available to ACMA on written request (s 31(1)(b)). Where evidence was obtained under legal obligations, providers must retain only what is required by law and dispose securely after the obligation ends, while keeping a record of the type of evidence sighted (s 31(2) and (4)).

Training and oversight duties. Providers must deliver DFV policy training to all personnel and specialised DFV training to specified customer-facing personnel and specialist support staff, within the timelines set for large and small providers and annually thereafter (ss 21-22). Providers must monitor and review policies at least every 24 months and monitor personnel through an internal monitoring program approved by the most senior responsible executive, acting on non-compliance within ten business days (ss 23-24).

Dispute resolution and oversight. The TIO is conferred functions and powers to handle complaints about matters referred to in the industry standard including making determinations and giving directions (s 33). ACMA receives notifications of unauthorised privacy access and can request records (ss 29, 31).

The industry standard itself does not set out monetary fines or criminal penalties within its text. Instead, enforcement and oversight mechanisms expressed in the instrument focus on administrative oversight, complaint jurisdiction and reporting responsibilities.

TIO complaint functions. The instrument confers on the Telecommunications Industry Ombudsman functions and powers to receive, investigate, facilitate resolution of, make determinations in relation to, give directions in relation to, and report on complaints about matters referred to in the standard (s 33). That conferral is the standard’s explicit route for redress and dispute resolution. The instrument notes section 114 of the Act in connection with the TIO, which the instrument references as context (s 33 Note), but the text of the instrument itself confines its enforcement mechanisms to the powers conferred on the TIO.

ACMA oversight and record access. The instrument requires providers to make records available to ACMA upon written request (s 31(1)(b)). Providers must notify ACMA of unauthorised access or disclosure of affected person information within two days of becoming aware (s 29(1)(b)). These duties enable ACMA to obtain information necessary for regulatory oversight and investigation.

Obligations to act on non-compliance. The standard places internal compliance obligations on providers. Providers must implement internal monitoring programs to assess personnel compliance with DFV policies and procedures, and if non-compliance is detected the provider must commence action to ensure compliance within ten business days (s 24(2)). The most senior responsible executive must approve the monitoring program and review outcomes at least every six months, with variations for large and small providers (s 24(3)-(4)). These internal mechanisms create administrative accountability within providers and a documented audit trail ACMA can request.

Notification obligations as soft enforcement tools. The requirement to notify affected persons and ACMA of privacy breaches (s 29(1)) creates a mandatory reporting regime. The instrument states that if notifying the affected person would be inconsistent with the agreed communication method, providers must wait until the next opportunity consistent with that method (s 29(2)). Notification must include contact details of a national or state-based DFV support service (s 29(3)). These obligations increase the likelihood of detection and external oversight where privacy protections fail.

Record-making and availability. Providers must keep records sufficient to demonstrate compliance, limit collection to what is necessary, protect records from misuse and dispose of them securely (s 30). The retention requirement (minimum two years; s 31(1)(a)) and the duty to make records available to ACMA (s 31(1)(b)) provide ACMA and TIO practical means to scrutinise provider conduct and compliance.

No express pecuniary penalties in the standard. The standard does not include express monetary penalties, infringement regimes, or criminal offences within its text. It does not specify automatic sanctions for breaches. Enforcement therefore appears to rely on existing regulatory frameworks under the Telecommunications Act and on the TIO’s complaint and determination powers as channels for corrective action. The instrument obliges providers to cooperate with oversight bodies through record production and notifications and places internal duties on providers to identify and remedy non-compliance quickly.

Limits where other law intervenes. The standard contains multiple “subject to law” constraints. For example, reversal of a service limiting action does not apply where reversal would contravene another law of the Commonwealth (s 13(5)). The prohibition on requiring evidence does not apply when the provider is under a legal obligation to obtain evidence (s 14(2)). These carve-outs channel enforcement interaction between this standard and other legal obligations.

Implementation risk and practical enforcement pathways. Given the absence of explicit monetary penalties in this instrument, enforcement will primarily proceed through complaint handling via the TIO, administrative scrutiny and potentially through ACMA’s regulatory tools under the Telecommunications Act where the Act provides such powers. The instrument strengthens oversight through record-keeping, reporting and notification obligations that make non-compliance more discoverable. Providers should expect investigations initiated by complaints to the TIO, audits or requests from ACMA relying on the record and notification duties set out in this standard.

The instrument expressly links to several other legal instruments and frameworks and contains cross-references that constrain its operation where other laws apply.

Made under the Telecommunications Act 1997. The industry standard is made under subsection 125AA(1) of the Telecommunications Act 1997 (s 3). It explicitly applies for the purposes of s 125AA(1) and is drafted to give effect to objectives in the Telecommunications (Domestic, Family and Sexual Violence Consumer Protections Industry Standard) Direction 2024 (s 4(1)(b)). Where the Act confers powers on ACMA or TIO, those powers interact with the standard. The instrument’s conferral of functions on the TIO references section 114 of the Act (s 33 Note), indicating the dispute-handling mechanism operates within the statutory telecommunications dispute regime.

Privacy Act 1988. The instrument contains a specific interaction clause for privacy. Where a provider is not subject to the Privacy Act 1988, the standard requires the provider to ensure that personal information collected under the industry standard is not disclosed or used except in limited circumstances and is disposed of securely (s 28). Where a provider is subject to the Privacy Act, Australian Privacy Principle 6 (APP 6) applies to use or disclosure of personal information collected under the instrument (s 28 Note). The instrument therefore defers to the Privacy Act’s APPs where applicable and imposes standalone privacy duties where the Privacy Act does not reach a provider.

Telecommunications (Financial Hardship) Standard 2024. The DFV statement must recognise that DFV and non-domestic sexual violence can be a reason for non-payment and that such consumers may be entitled to financial hardship assistance under the Telecommunications (Financial Hardship) Standard 2024 (s 17(2)(c)). This creates an express cross-reference to the financial hardship standard as a source of potential relief and indicates an expectation that providers will coordinate DFV support with financial hardship processes.

C525 Handling of Life Threatening and Unwelcome Communications Industry Code. The instrument imports meanings for "life threatening communications" and "unwelcome communications" from the C525 code (s 5 definitions and notes), signalling that handling of certain communications must be consistent with the C525 code’s definitions and potentially operational practices.

Broadcasting Services Act 1992. The definitions for subscription broadcasting services and subscription television narrowcasting services are taken from the Broadcasting Services Act 1992, indicating that some definitions used in the standard rely on existing broadcasting law definitions (s 5).

Other Commonwealth laws. The standard contains express carve-outs where compliance would contravene another law. For example, reversal of suspension or disconnection does not apply where reversal would contravene another law of the Commonwealth (s 13(5)). Similarly, the exception to the no-evidence rule permits providers to obtain evidence where the provider is under a legal obligation to do so (s 14(2)(a)). These clauses require providers to reconcile DFV obligations with any competing statutory obligations such as law-enforcement or emergency call service determinations cited illustratively in a note to s 13(5).

Records and ACMA powers. Providers must make records available to ACMA upon written request (s 31(1)(b)) and must notify ACMA of unauthorised disclosures of affected person information within two days of becoming aware (s 29(1)(b)). Those obligations link the standard’s compliance regime to ACMA’s regulatory oversight and any powers ACMA has under the Telecommunications Act, even though the standard itself does not spell out enforcement measures beyond documentation and notification duties.

TIO jurisdiction and consumer complaint mechanisms. The conferral of functions and powers on the TIO (s 33) integrates the industry standard into the Australian telecommunications dispute resolution architecture. Complaints arising under the standard are therefore intended to be handled within the TIO’s established procedures and powers to make determinations and give directions (s 33).

Statutory instrument references. The instrument contains general interpretation provisions that references to other legislative instruments are to be read as those instruments stand from time to time (s 6). That means referenced codes, standards and Acts will operate as amended and the standard’s application will reflect changes in those other instruments.

In sum, the standard is intended to operate within an existing legal ecosystem: it builds on the Telecommunications Act, overlays privacy expectations consistent with the Privacy Act where applicable, cross-references a financial hardship standard, imports definitions and handling norms from industry codes, situates oversight with ACMA and the TIO, and defers to other Commonwealth laws when conflicts arise.

The instrument, as provided, records its original making date and staged commencement but contains no later amendment schedule within the text. Key temporal facts from the instrument are:

Date of making and signatories. The standard is dated 6 June 2025 and is signed by members of ACMA (front matter).
Commencement staging. Section 2 contains a commencement table with two items. Item 1 lists Part 1, subsections 13(3)-(5), 15(1), and sections 16, 19, 21, 22 and 32 as commencing on 1 July 2025. Item 2 states that anything not covered by item 1 commences on 1 January 2026. The table also notes that the provisions in item 2 do not apply to small providers until the date specified in subsection 4(2). A Note clarifies that the table relates only to provisions as originally made and will not be amended to deal with later amendments of the industry standard (s 2 Note 1). A separate Note 3 reiterates the delayed application to small providers for item 2 provisions (s 2 Note 3).
Large vs small provider timelines. The text defines large providers as those with at least 30,000 services in operation on 1 July in a financial year and small providers as those with fewer than 30,000 services (s 5). Several obligations have different implementation windows: DFV policies and procedures must be in place within six months for large providers and nine months for small providers after the commencement of s 19(2) (s 19(2)). DFV policy training for all personnel must be delivered within nine months after commencement for large providers and within 12 months for small providers (s 21(2)). Specialised DFV training for customer-facing personnel follows the same timing (s 22(2)).
No amendment entries. The instrument does not list any prior amendments, transitional modifications beyond the staged commencement table, or historical versions. The instrument’s own note (s 2 Note 1) indicates the table will not be amended for subsequent amendments, implying that amendment history will be recorded elsewhere, typically on the Federal Register of Legislation.

Practical implications of the stated amendment framework. Because the instrument does not itself contain an amendment history, practitioners must rely on the Federal Register of Legislation for subsequent changes. The instrument’s staging and differentiation between provider sizes creates a built-in implementation timetable and suggests that those dates are the initial compliance milestones. The instrument’s note that the commencement table relates only to the original making indicates that later amendments would be reflected in the formal legislative history external to this text.

The instrument contains no case law citations, dispute examples, or judicial decisions. It does not record prior litigation relating to its provisions. The provision that confers functions and powers on the TIO (s 33) notes "See section 114 of the Act" but does not cite any cases. The absence of litigation history in the instrument is unsurprising given it is a newly made industry standard dated 6 June 2025.

Where disputes are likely to arise. The instrument creates obligations that are likely to generate complaints to the TIO (s 33) and notifications to ACMA (s 29). In practice, enforcement and interpretation of the standard will be driven initially through administrative complaint handling, ACMA oversight and prospective determinations by the TIO rather than litigation. The instrument’s emphasis on records, notifications, and TIO jurisdiction suggests the first-stage enforcement model will be regulatory and administrative.

What to watch for. Legal practitioners should monitor TIO determinations and ACMA actions that interpret, apply, or test the obligations in the standard, since those administrative rulings will form the primary body of interpretive authority short of judicial review. The instrument’s text itself makes no assertion about litigation, so any later cases, TIO determinations or ACMA enforcement actions will be external to this document and need to be collected from administrative records, the TIO’s published determinations and ACMA releases.

This standard introduces a number of operational traps and points where provider practices may inadvertently breach the instrument or create safety risks for affected persons. These are practical "gotchas" grounded in the text.

Evidence prohibition with narrow exceptions. Providers must not require evidence that a consumer is an affected person (s 14(1)). However, two exceptions allow evidence: where the provider is under a legal obligation to obtain it, and where obtaining evidence is reasonably necessary to protect the affected person (s 14(2)). Providers who misread the ban and refuse to obtain evidence needed to comply with other laws will be non-compliant with those other statutes, while providers who ask for excessive evidence in routine DFV cases risk breaching s 14(1). The instrument instructs providers to rely on evidence already in their systems and to request only the minimum necessary (s 14(3)). Practitioners must design narrowly tailored evidence-request workflows and document legal bases for any mandatory evidence checks.

Agreed communication method risks. The agreed communication method (s 10) constrains provider communications on DFV matters. Providers must ensure that communications follow the agreed method unless legal obligations require otherwise or the affected person consents to a different method (s 10(2)-(3)). A provider that inadvertently sends communications to a perpetrator or uses a non-agreed channel could compromise safety and breach s 25(1) and s 27. Systems must enforce agreed channel selection and logging.

Reconnection and legal conflicts. Providers must reverse a restriction, suspension or disconnection as a matter of urgency the first time an affected person requests reversal for a DFV-related safety risk (s 13(3)). However, reversal is not required if it would contravene another law of the Commonwealth (s 13(5)). Providers must therefore have processes to quickly check whether legal obligations (for example, emergency call service configuration rules referenced illustratively in s 13(5) note) prevent reconnection and to offer an equivalent service when reconnection is impractical (s 13(4)). Failure to do a compliant legal check or to offer an equivalent service risks non-compliance.

Recording of support calls and billing. The instrument requires that calls to specified support telephone numbers must not be recorded on any bill or other material issued to a customer (s 25(3)). Carriers must provide reasonable assistance to enable providers to comply (s 26). In practice, billing and call-recording systems may require configuration changes. If providers fail to coordinate with carriers, sensitive call activity may be wrongfully exposed on bills.

Quick exit functionality and accessibility. Providers must give a quick exit function on all webpages that relate to support for affected persons (s 25(2)). The standard also requires DFV statements to be accessible and made clearly available on the provider’s home page and mobile application where applicable (s 17(3)-(4)). Implementing both accessibility and quick-exit features, while ensuring discoverability of support information, can be technically challenging. Poor implementation can both fail accessibility obligations and create safety risks if quick exit does not reliably hide support content or breaks agreed communication methods.

Warm transfers and automated systems. Warm transfers must be offered when a transfer is needed and must be undertaken if accepted (s 15(3)-(4)). The transferor may be automated but the transferee must be an individual (s 5 warm transfer definition). Providers relying on bots or automated routing must ensure an individual is available to receive the warm transfer and that the transfer preserves the affected person’s confidentiality and avoids re-disclosure of sensitive details in unsafe contexts.

Record minimisation vs auditability tensions. Providers must limit record collection to what is necessary to demonstrate compliance (s 30(2)(a)) and, where practicable, records must not contain personal information of an affected person (s 31(3)). At the same time, providers must retain sufficient records to respond to ACMA and TIO requests (s 31(1)(b)) and to demonstrate compliance. Balancing the need to retain evidence of compliance with the minimisation and security obligations requires careful design of redacted audit trails and secure metadata records that track the fact of assistance without embedding unnecessary personal detail.

Training and senior executive accountability. The most senior responsible executive must approve DFV policy and statement and be responsible for implementation (s 19(4)). Providers that delegate approval without clear sign-off risk non-compliance with the governance obligations. Training schedules vary for large and small providers and for personnel subsequently engaged; failure to meet the timing (nine months for large providers, 12 months for small providers for initial training in s 21(2)) will constitute procedural non-compliance.

Consultation expectations. Providers must consult specified DFV services and either a lived-experience panel or representative organisations in developing and reviewing policies and training (s 32). For large providers the consultation must be undertaken directly; for small providers an industry group may consult on their behalf (s 32(1), (2)). Providers who treat consultation as perfunctory risk failing the requirement that they “take into account” responses to consultations (s 32(4)).

Privacy breach notification timing. Providers must notify affected persons and ACMA within two days of becoming aware of unauthorised access or disclosure, subject to safety-based communication constraints (s 29(1)-(2)). The tight two-day window requires rapid incident response processes that align with agreed communication methods. Failure to coordinate with the affected person’s safety needs may render the provider non-compliant with s 29(2).

Small provider phased application. Many substantive obligations come into effect for small providers later than for large providers (s 2; s 19(2); s 21(2); s 22(2); s 23). Small providers must track phased commencement to ensure obligations are implemented by the applicable dates. Assuming immediate applicability for all providers is a common operational misstep.

This compliance roadmap is a practical checklist keyed to the instrument’s provisions. It identifies immediate implementation steps, governance, operational, technical and training controls, and monitoring and documentation activities providers should adopt to demonstrate compliance.

Governance and policy

Senior executive accountability. Ensure the most senior responsible executive is identified, records approval of the DFV policy and DFV statement, and is assigned responsibility for implementation and operation of DFV procedures (s 19(4)).
Draft and approve DFV policy and procedures. Prepare a written DFV policy that prioritises safety, sets out support and personnel support, record-keeping tailored to protect affected persons, inclusive design and an intersectional approach (s 20(1)). Draft DFV procedures that are trauma informed and set out personnel responsibilities, escalation channels, how to engage with perpetrators safely, record keeping and minimisation processes, and how to reduce repetition for affected persons (s 20(2)-(3)).
Timelines. For large providers complete policy and procedures within six months of s 19 commencing; for small providers within nine months (s 19(2)). Track the instrument’s commencement dates in s 2 to allocate time for implementation.

Contact channels and website content

Publish DFV statement. Prepare and publish a DFV statement with the required express commitments, accessibility and placement on the homepage and mobile application where applicable (s 17(1)-(3)). Ensure plain language, clear font and accessibility features for disabilities and diverse backgrounds (s 17(3)(a)-(e)).
Interim support information. If specific provider support is not yet available, publish contact details for third-party DFV organisations and a statement that further support will be in place when s 17 applies (s 16(2)).
Quick exit function. Implement a reliable quick exit button on webpages that relates to support for affected persons (s 25(2)).
Avoiding billing of support calls. Ensure billing systems do not record calls to listed support telephone numbers on bills or other issued materials; coordinate with carriers to ensure technical support for this obligation (s 25(3); s 26).

Operational procedures and communication

Safety confirmation and agreed communication method workflow. Implement scripts and CRM flags to ask whether it is safe to communicate and to record the agreed communication method and time. Ensure all DFV-related communications use the agreed method by default (ss 8(1), 10(1)-(3)).
Warm transfer process. Implement procedures to offer warm transfers for calls and chats and to effect them when accepted, ensuring the transferee is an individual and the transfer avoids forced repetition of sensitive details (s 15(3)-(4); warm transfer definition in s 5).
No contact with perpetrators and authorised representative management. Implement processes to ensure affected persons are not required to contact perpetrators and to explain and manage authorised representative access where relevant (s 15(1); s 11(1)(b)).
Account protections. Ensure mechanisms exist to set up new unlinked accounts and to apply account-level privacy controls such as PINs, passwords, verification codes to safe numbers, or app-based protections (s 12).

Privacy, security and records

Limit collection and secure storage. Design data collection forms and CRM fields to collect only necessary information (s 30(2)(a)). Segregate DFV markers and minimize inclusion of personal information in operational records where practicable (s 31(3)). Apply physical and technical controls to prevent disclosure to perpetrators (s 27).
Incident response and notification. Build an incident response playbook to detect unauthorised access and to notify affected persons and ACMA within two days as required, using the agreed communication method where necessary (s 29(1)-(2)). Include provision to provide contact details for DFV support in notifications (s 29(3)).
Retention and disposal. Retain compliance records for a minimum of two years or for the period assistance continues (s 31(1)). For evidence obtained under legal obligation retain only what is required and dispose of copies securely afterward, keeping a record of the type of evidence sighted (s 31(4)).

Training and personnel monitoring

Deliver DFV policy training to all personnel within the timelines in s 21, and specialised DFV training to customer-facing personnel per s 22. Ensure annual refresher training.
Training content. Ensure specialised DFV training covers nature and impacts of DFV in relation to telecommunications services, identification of affected persons, intersectional issues, engagement, de-escalation and safety prioritisation (s 22(2)).
Internal monitoring and remediation. Implement an internal monitoring program, obtain approval from the most senior responsible executive, and set processes to act on non-compliance within ten business days (s 24(1)-(4)). Review monitoring outcomes at least every six months as required (s 24(4)).

Consultation and stakeholder engagement

Consult with DFV support services and either a lived-experience panel or a representative organisation when developing and reviewing policies and training (s 32(1)-(2)). For small providers consider engaging an industry body to perform consultation where permitted (s 32(2)).
Document consultations and how responses were taken into account to demonstrate compliance with s 32(4).

Systems and carrier coordination

Billing and network changes. Coordinate with carriers to ensure billing systems do not list support calls and that carriers provide reasonable assistance to meet the no-billing requirement (s 25(3); s 26).
CRM tagging and security. Build secure flags for DFV matters that limit visibility to authorised personnel, prevent inadvertent disclosure in ordinary customer communications, and record agreed actions without embedding unnecessary personal data (s 27; s 30).

Complaint handling and regulatory cooperation

TIO complaint readiness. Prepare to respond to TIO investigations and determinations for complaints under the standard (s 33). Maintain auditable records to demonstrate compliance and resolution efforts.
ACMA cooperation. Be ready to provide records to ACMA upon written request (s 31(1)(b)) and to accept privacy breach notifications and inquiries (s 29).

Testing and auditing

Conduct tabletop exercises that simulate urgent reversal requests, privacy breaches with agreed communication-safety constraints, and warm transfer failures.
Undertake technical testing of quick-exit functionality and billing system redaction for support telephone numbers.
Periodic reviews. Review DFV policy and procedures every 24 months or sooner if deficiencies arise (s 23(1)). Update training and operational processes in response to monitoring outcomes.

Documentation and demonstrable compliance

Keep a compliance register mapping each obligation to policy, procedure, training, system controls, and records. Ensure records are sufficient to demonstrate compliance but redact personal information where practicable (s 30; s 31(3)).
Maintain evidence of senior executive approvals, consultations, training attendance and internal monitoring reviews to respond to ACMA or TIO requests.

Timelines recap

Immediate priorities for large providers: publish DFV statement and have relevant sections effective from 1 July 2025 for items specified in s 2; ensure policies and training delivered within nine months as required by ss 19 and 21.
Small providers: note phased commencement; many sections commence 1 January 2026 but do not apply to small providers until 1 April 2026 (s 2 and s 4).

Following this roadmap with documented evidence will place a provider in a position to demonstrate compliance with the specific duties and protections set out in the industry standard.

Deep Dive

What it does

Current sections

Telecommunications (Domestic, Family and Sexual Violence Consumer Protections) Industry Standard 2025

meta-content-style-type: text/css meta-content-type: application/xhtml+xml; charset=utf-8

Part 1—Preliminary

1 Name

2 Commencement

3 Authority

4 Application of industry standard

5 Definitions

6 References to other instruments

Part 2—Sexual violence outside a domestic and family violence situation

7 Requirement where a consumer has experienced sexual violence outside a domestic and family violence situation

Part 3—Providing support

8 Requirement to advise affected persons of available support

9 Application of sections 10 and 11

10 Requirement to agree on a preferred communication method

11 Requirement to discuss support options

12 Minimum requirements for support

13 Providing support to affected persons

14 A provider must not require evidence

15 Communications with an affected person

Part 4—Requirements relating to availability of DFV support information

16 Requirement to publish, on commencement of this provision, information relating to available support for affected persons

17 Requirement to publish a DFV statement

18 Requirements regarding access to DFV support services

Part 5—General requirements relating to policies and procedures

19 Develop domestic and family violence policies and procedures

20 Minimum requirements for DFV policies and procedures

Part 6—Training

21 Training for all personnel

22 Training of customer facing personnel

Part 7—Monitoring and review

23 Requirement to review policy and procedures

24 Requirement to monitor personnel

Part 8—Security and privacy

25 Requirements relating to the security and privacy of an affected person

26 Requirement on carriers to provide assistance

27 Security of personal and sensitive information

28 Privacy

29 Where privacy is breached

Part 9—Record keeping

30 Requirements to keep records

31 Record retention

Part 10—Consultation

32 Requirement to consult

Part 11—Conferral of functions and powers

33 Conferral of functions and powers on the TIO

Source text: opening excerpt

meta-content-style-type: text/css meta-content-type: application/xhtml+xml; charset=utf-8

Main concepts

Who it affects

Key duties and rights

Penalties and enforcement

How it interacts with other laws

Amendment history

Litigation history

Gotchas

How to comply