The regulation operationalises a small set of concepts that control handling of identity information and confidential documents in the context of the NSW witness protection regime. The key concepts are: identity record retention requests, non-disclosure certificates, confidential documents and their sharing, authorised handlers, and prescribed permissions (templates).

Identity record retention requests. Section 4 implements the Act’s provisions that permit an authorised person or interstate entity to request that a removed identity record be kept (Act, s 19B(2); cross-referenced in regulation heading). The regulation imposes two specific 20-business-day windows: one to make the request after removal of the identity record, and a second to provide the identity record to the Commissioner of Police after making the request (s 4(a)-(b)). The regulation also requires that the giving of the identity record be carried out “in accordance with section 6(2)” (s 4(b)(i)), so the defined sharing channels apply.

Non-disclosure certificates. Section 5 prescribes the mechanics for non-disclosure certificates referenced in the Act (ss 31B(2), 38A(2)(b) per the heading). The certificate must be given in person, by a witness protection officer, to a judicial officer with carriage of the proceedings or to a person nominated in writing by the court’s chief judicial officer (s 5(1)). At the end of the proceeding the certificate must be returned in person to a witness protection officer (s 5(2)), and courts are directed not to keep a record or copy of the certificate or other confidential documents (s 5(3)). The regime thus creates a limited, tightly managed access route to the certificate for the court’s decision-maker while prohibiting court retention.

Confidential documents and authorised handlers. Section 6(1) defines who in an agency (other than a court) may keep and handle confidential documents: either a person with at least a baseline security clearance from the Australian Government Security Vetting Agency (s 6(1)(a)), or, if no one holds that clearance, the head of the agency, the General Counsel, the chief risk officer or a person performing the functions of those offices (s 6(1)(b)(i)-(iv)). The regulation therefore links handling authority to an external vetting standard, and provides a fallback list of senior positions where clearance is absent.

Sharing channels. Section 6(2) restricts how confidential documents may be shared between an agency and the Commissioner of Police: in person, by registered post, or via a secure file sharing platform with end-to-end encryption. The regulation explicitly defines “sharing” to include both delivery and receipt (s 6(4)), which carries implications for chain-of-custody.

Recordkeeping and standards. Section 6(3) requires agencies to maintain a record that contains names of persons (other than witness protection officers) involved in the activity, a description of the activity, and the dates and times during which the activity was carried out (s 6(3)(a)). Agencies must also “consider” the NSW Government Information Classification, Labelling and Handling Guidelines (April 2021) as in force from time to time (s 6(3)(b)). The instruction to “consider” the Guidelines is prescriptive but stops short of mandating particular classifications.

Prescribed forms and permissions. Section 7 prescribes Form 1 and Form 2 in Schedule 1 for the Act’s section 24 permissions not to disclose former identity. Schedule 1 provides detailed template text, including signature and date fields and explanatory notes. The notes attached to the forms state the permission remains valid while the participant retains the new identity even if participation in the program is terminated, and identify surrender obligations where the Commissioner takes action to restore the former identity (Schedule 1 notes).

Definitions and external instruments. Section 3 defines “the Act” as the Witness Protection Act 1995 and defines “witness protection officer” as a member of NSW Police exercising a function relating to the program (s 3). The section also contains a note pointing to the Act and the Interpretation Act 1987 for further definitions and interpretive provisions, signalling that the regulation is dependent on those foundational instruments.

Together, these concepts create an operational matrix that controls time limits, personnel authorised to handle sensitive material, permitted transmission methods, recordkeeping obligations, and the exact wording of permissions not to disclose former identities. The regulation uses external vetting standards and government guidance as normative anchors (baseline security clearance and the NSW Guidelines), and it directs specific handling behaviour for courts that differs from agency handling (courts must not retain copies of certificates).

The regulation identifies a compact group of principals and affected parties, each with discrete duties or entitlements under the instrument. The principal actors named in the text are: participants in the witness protection program, witness protection officers (members of NSW Police acting in program functions), the Commissioner of Police, authorised persons and interstate entities that remove identity records, courts and judicial officers, chief judicial officers or their nominees, and agencies other than courts that possess confidential documents. Secondary roles include agency heads, general counsel and chief risk officers (or persons performing those functions) who may be authorised handlers where baseline security-cleared personnel are absent.

Participants under the witness protection program are directly affected by the prescriptive templates (Form 1 and Form 2) used to grant permission not to disclose former identities (s 7; Schedule 1). The Schedule’s notes state that the permission is effective while the participant retains the new identity even if the participant’s program participation has been terminated (Schedule 1 notes), and that Form 1 must be surrendered when participation is terminated and the Commissioner acts to restore the former identity (Schedule 1 note under Form 1). Those provisions affect the ongoing legal status of the participant’s identity in proceedings and legal obligations to disclose.

Witness protection officers have operational obligations. They must give non-disclosure certificates in person to the specified court recipients and retrieve them in person at the end of the relevant proceeding (s 5(1)-(2)). They also act as the point of contact for receiving identity records from authorised persons or interstate entities, since s 4 requires the identity record to be given to the Commissioner of Police in accordance with s 6(2), and the Commissioner will act through police channels.

The Commissioner of Police is the repository for identity records and the recipient of confidential document sharing (s 4(b), s 6(2)). The Commissioner’s office will therefore shoulder the logistical responsibility of receiving identity records within the 20-business-day window and managing confidential documents in compliance with the handling and recordkeeping rules (s 6).

Authorised persons and interstate entities that remove identity records must act within the two 20-business-day time limits set out in s 4: they must make the request within 20 business days after removing the identity record and must give the identity record to the Commissioner within 20 business days after making the request (s 4). These time constraints impose operational deadlines on entities that remove identity records.

Courts and judicial officers are affected by the in-person delivery rule for non-disclosure certificates and by the explicit prohibition on keeping a record or copy of the certificate or other confidential documents (s 5(1)-(3)). Courts will need internal procedures to accept a certificate and to ensure it is not retained in registries, transcripts, or other court files, while ensuring the judicial officer with carriage has access for decision-making.

Agencies other than courts that possess confidential documents are affected in several ways. They must limit handling to persons with baseline security clearances or, if none are available, to a short list of senior officers (s 6(1)). They must use prescribed sharing channels when sending documents to the Commissioner (s 6(2)). They must maintain specific records of activities relating to keeping and handling confidential documents (s 6(3)(a)) and must consider the NSW Government Information Classification, Labelling and Handling Guidelines (s 6(3)(b)). These obligations impose compliance and possible expense burdens on agencies especially where baseline security-cleared personnel are not available.

Heads of agencies, general counsel and chief risk officers (or persons performing those functions) are specifically named as authorised handlers where baseline-cleared staff are absent (s 6(1)(b)(i)-(iv)). That draws senior executives into operational custody roles for confidential documents, or requires them to delegate to acting persons who will perform those functions.

Finally, because Form 2 is explicitly tied to complementary witness protection laws (Schedule 1 Form 2), operators and legal advisers engaged with interstate or other complementary regimes must manage interactions between the NSW permission and parallel permissions under other jurisdictions’ laws.

In short, the regulation assigns duties and operational burdens to NSW Police (through witness protection officers and the Commissioner), to authorised persons/interstate entities that remove identity records, to courts and judicial officers, and to non-court agencies that possess confidential documents, with secondary involvement of senior agency officers where baseline-cleared staff are absent.

This regulation translates provisions of the Act into specific, enforceable duties and identifies rights attached to participants that are formalised through prescribed templates.

Duties

• Time-limited requests and transfer of identity records. An authorised person or interstate entity removing an identity record must make any request under the Act, s 19B(2), within 20 business days after removing the identity record, and must give the identity record to the Commissioner of Police within 20 business days after making the request. The giving must be in accordance with s 6(2) (s 4(a)-(b)). These are sequential duties: first the request then the delivery with prescribed delivery channels.

• In-person delivery and return of non-disclosure certificates. A witness protection officer must give a non-disclosure certificate in person to either the judicial officer with carriage of the proceeding or a person nominated in writing by the chief judicial officer (s 5(1)(a)-(b)). At the end of the relevant proceeding the certificate must be returned in person to a witness protection officer (s 5(2)). The Court must not keep a record of, or a copy of, the certificate or another confidential document (s 5(3)). These are precise custody duties intended to limit circulation and retention.

• Authorised handling of confidential documents in agencies. Confidential documents held by an agency, other than a court, must be kept and handled only by a person with at least a baseline security clearance issued by the Australian Government Security Vetting Agency (s 6(1)(a)), or if no such person exists, by the head of the agency, the agency’s General Counsel, the chief risk officer, or persons performing those functions (s 6(1)(b)(i)-(iv)). This prescribes the universe of authorised custodians.

• Prescribed sharing channels with the Commissioner. If confidential documents are shared between an agency and the Commissioner of Police, sharing must be carried out in person, by registered post, or using a secure file sharing platform with end-to-end encryption (s 6(2)). The regulation also clarifies that “sharing” includes both delivery and receipt (s 6(4)). Agencies must therefore ensure both sides of the transaction are controlled.

• Recordkeeping and standards. Agencies must maintain a record of names of persons (other than witness protection officers) involved in relevant activities, a description of the activity, and the dates and times during which the activity was carried out (s 6(3)(a)). Agencies must also “consider” the NSW Government Information Classification, Labelling and Handling Guidelines (April 2021) as in force from time to time (s 6(3)(b)). These impose document trail and governance duties.

• Use of prescribed forms. Permissions under the Act to not disclose former identities must use the prescribed Form 1 and Form 2 in Schedule 1 for the relevant Act sections s 24(1)(b) and s 24(5) respectively (s 7). The forms include standard language, signature blocks and notes specifying duration and surrender obligations.

Rights and legal effects

• Permission not to disclose former identity. The key right created or formalised by the regulation is the permission that allows a participant to assert that their new identity is their only identity in any proceedings or for any purpose relating to the law requiring disclosure, where the Commissioner’s delegate gives permission under the Act and the prescribed form is used (Schedule 1 Form 1 and Form 2). The form text explicitly states the delegate gives permission not to disclose the participant’s former identity for the purpose specified in the form.

• Persisting protection while new identity retained. The forms’ notes state that the permission remains valid while the participant retains the new identity, even if the participant’s participation in the witness protection program has been terminated (Schedule 1 notes for both forms). That creates a continuing legal effect tied to the participant’s retention of the new identity rather than to ongoing program participation.

• Right to surrender and restoration mechanisms. Form 1’s note specifies that the document must be surrendered in accordance with a notice issued under the Act, s 21(5), if the participant’s participation in the program is terminated and the Commissioner takes action to restore the former identity (Schedule 1 note under Form 1). This identifies a legal mechanism by which the protective permission can be ended and the participant’s former identity restored, although the regulation itself does not set the terms of s 21(5) which lie in the Act.

Other operational effects

• Courts’ restricted retention. Courts are explicitly denied the right to keep records or copies of non-disclosure certificates and other confidential documents connected to the certificate (s 5(3)). This affects evidentiary handling and archival practices for courts.

• Fallback senior-officer handling. Where an agency lacks baseline-cleared personnel, the duty to handle confidential documents falls to senior officers or their acting substitutes (s 6(1)(b)). That creates a duty for senior management to accept custody responsibilities or to arrange acting officers who will undertake the functions.

In sum, the regulation converts statutory permissions and high-level protections in the Act into exact procedural duties and a narrowly defined set of participant rights. The operative obligations are mainly logistical and custodial: who may touch material, how it must be transmitted, the timeframe for transfer, and how permissions must be documented.

The regulation itself contains no express offence provisions or monetary penalties. Its operative enforcement is therefore administrative and procedural rather than criminal within the instrument. Compliance relies on parties performing the duties the regulation prescribes: witness protection officers delivering and retrieving certificates in person (s 5), agencies limiting handling to authorised persons and using the prescribed sharing channels (s 6(1)-(2)), and authorised persons/interstate entities meeting the 20-business-day windows for requests and transfers of identity records (s 4).

Because the instrument is procedural, practical enforcement mechanisms will be internal governance and administrative controls inside agencies and the police. Examples of administrative controls that the text either requires or implies include: maintaining the record of persons involved, activity descriptions and timestamps (s 6(3)(a)); using secure file-sharing platforms with end-to-end encryption where digital transfer is used (s 6(2)); and adhering to in-person delivery and return protocols for certificates (s 5(1)-(2)). These controls enable audit and internal enforcement.

The regulation’s cross-references to the Act and to other instruments indicate that statutory enforcement could arise through the Act’s mechanisms, but the regulation does not itself state any supervisory agency, penalty, or enforcement process. The regulation also refers to baseline security clearances issued by the Australian Government Security Vetting Agency (s 6(1)(a)), which indicates that external vetting and its compliance certificate process underpin who may lawfully handle confidential documents. Failure to meet those vetting standards will therefore be a factual non-compliance issue but not one for which the regulation prescribes a specific sanction.

Courts are given a procedural duty not to retain records or copies of the non-disclosure certificate (s 5(3)). The instrument does not itself specify remedies if a court registry or staff retain a copy in error; such consequences will need to be addressed through court practice directions, internal court administration, or the Act if it includes breach or enforcement mechanisms (the regulation is silent on that point).

Where agencies are obliged to “consider” the NSW Government Information Classification, Labelling and Handling Guidelines (s 6(3)(b)), the regulation does not prescribe the outcome of that consideration. That lack of prescriptive mandate means enforcement of that requirement is necessarily subjective and likely to be reviewable through administrative oversight rather than criminal sanction.

In practice, enforcement risks fall into these categories:

• Administrative non-compliance detectable through required records. Because agencies must keep a contemporaneous record of persons involved and the activity details (s 6(3)(a)), internal audits can detect failures to follow s 6(1)-(2) and s 5(1)-(2). The regulation thereby builds an audit trail that can be used by agencies or oversight bodies to enforce compliance administratively.

• Procedural failure in courts. The prohibition on courts keeping copies (s 5(3)) is a procedural command that will need to be enforced by court administrative practice; the regulation itself does not lay down remedial steps.

• Timeframe breaches. The 20-business-day timing rules in s 4 create measurable deadlines that, if missed, may affect the legal status of an identity record request. The regulation does not specify the legal consequence of a missed deadline; those consequences will be determined by the Act or by administrative practice.

• Security breaches. The requirement to use baseline security-cleared personnel or senior officers (s 6(1)) and secure sharing channels (s 6(2)) establishes a standard of care. The regulation does not set out a penalty for breaches in storage or sharing, but a failure that results in an exposure could trigger internal disciplinary, administrative, or other legal responses under other laws or policies.

Because the regulation is procedural and prescriptive rather than punitive, enforcement will most likely be effected through operational controls, internal audits and, where relevant, any enforcement or penalty provisions in the Act or in other statutes or administrative instruments. Readers should therefore consult the Act and agency governance instruments for the complete enforcement picture beyond this regulation.

The regulation expressly cross-references and depends on the Witness Protection Act 1995 (the Act) and on other instruments and norms. Section 3 defines “the Act” as the Witness Protection Act 1995 and notes that the Act and the Interpretation Act 1987 contain definitions and other provisions that affect interpretation and application of the regulation (s 3 note). Each substantive provision of the regulation is tied to particular sections of the Act by headings and cross-references: s 4 implements aspects of the Act’s ss 19B(4) and 38A(2)(b) as indicated in the heading; s 5 implements parts of the Act’s ss 31B(2) and 38A(2)(b); s 6 implements ss 38A(2)(b); and s 7 prescribes forms for the Act’s s 24(1)(b) and s 24(5) (see the section headings and s 7). Those cross-references indicate the regulation operates as the subordinate instrument that gives content to procedural provisions in the Act.

Complementary witness protection laws. Form 2 is expressly designed for participants who have been provided with a new identity under a complementary witness protection law (Schedule 1 Form 2). The form’s note states the permission is subject to the complementary law referred to in the form. That creates an interface between NSW’s permission regime and permissions granted under other jurisdictions’ witness protection laws. The regulation therefore anticipates multi-jurisdictional arrangements and requires the text of the Form 2 permission to be used where another jurisdiction’s complementary law applies. The regulation itself does not define “complementary witness protection law”; that term’s operational meaning will be informed by the Act or inter-jurisdictional arrangements outside the regulation.

Security vetting and Commonwealth standards. Section 6(1)(a) requires a baseline security clearance issued by the Australian Government Security Vetting Agency for persons in agencies (other than courts) handling confidential documents. That imports a Commonwealth standard into a NSW administrative rule, tying NSW agencies’ custody rules to a Commonwealth vetting regime. Agencies must therefore align personnel vetting and clearance policies with Commonwealth security vetting standards where handling confidential documents under this regulation.

NSW Government Information Classification Guidelines. Section 6(3)(b) requires agencies, when carrying out activities related to keeping and handling confidential documents, to consider the NSW Government Information Classification, Labelling and Handling Guidelines published by the Department of Customer Service in April 2021 and as in force from time to time. This imports a state administrative guidance document into the regulation’s compliance framework. The obligation to “consider” stops short of mandating compliance but creates an expectation that agencies will evaluate document handling against recognised NSW classification standards.

Subordinate Legislation Act saving/commencement interplay. The commencement note states the regulation repeals and replaces the 2017 regulation, which would otherwise be repealed on 1 September 2026 by the Subordinate Legislation Act 1989, s 10(2) (s 2 note). That situates the regulation within the broader lifecycle of subordinate instruments under NSW administrative law.

Court practice and evidence rules. Section 5(3) instructs that the Court must not keep a record of, or a copy of, the non-disclosure certificate or another confidential document. This requirement interacts with court practice directions, registry retention protocols and possibly with rules of evidence and court records management. The regulation does not itself amend rules of evidence, but the command not to retain copies will affect how courts handle exhibits, exhibits lists and transcripts. The regulation permits a person nominated in writing by the chief judicial officer to receive the certificate, which creates an internal court channel that must be reconciled with existing court administrative practice.

Actual legal consequences beyond this regulation. The regulation is subordinate to the Act; many substantive rights and procedural consequences remain governed by the Act (the regulation refers to several Act sections in its headings). The regulation does not purport to alter or repeal any statute other than the 2017 regulation (s 8), and it does not itself enact criminal offences. Consequently, the regulation’s interaction with other laws is largely as an operational implementer of the Act, a conduit to Commonwealth vetting standards and NSW government information-handling guidance, and as an instrument that affects court practice and inter-jurisdictional witness protection arrangements by prescribing forms for complementary laws.

The instrument establishes a clear and limited amendment history within its operative text. It expressly repeals the Witness Protection Regulation 2017 (s 8(1)) and contains a savings provision preserving the effect of acts, matters or things that had effect under the 2017 regulation immediately before repeal (s 8(2)). The commencement provision states the regulation commences on publication on the NSW legislation website (s 2), and contains a note explaining the new regulation repeals and replaces the 2017 regulation, which would otherwise have been repealed on 1 September 2026 by operation of the Subordinate Legislation Act 1989, s 10(2) (s 2 note). Those are the only express textual indications of prior versions or transitional treatment.

Because the regulation itself is the replacement instrument, the amendment history visible in the text is limited to the point-in-time repeal of the 2017 regulation and the continuity clause in s 8(2) preserving the effect of existing acts, matters or things. No other amendments, transitional arrangements, or modification of the Act are included in the regulation.

Schedule 1 prescribes forms and contains notes that clarify the ongoing effect of permissions granted under the forms: both Form 1 and Form 2 include notes that the permission remains valid while the participant retains the new identity even if program participation has been terminated (Schedule 1 notes under both forms). Form 1 adds a further note that the document must be surrendered in accordance with a notice issued under the Act, s 21(5), if participation is terminated and the Commissioner acts to restore the former identity. Those notes operate as transitional or enduring-status statements relative to the participant’s identity status and therefore form part of the instrument’s operational history insofar as they set the duration of permissions granted under prescribed templates.

No earlier or later amendments are recorded within the text provided. The regulation does not include a staged commencement or delayed provisions, nor does it list any sunset clauses apart from the historical note about the Subordinate Legislation Act. Users seeking a complete legislative amendment trail should consult the NSW legislation database for version history and any subsequent amending instruments beyond this text.

The regulation text contains no references to cases, judicial decisions or prior litigation. It does not name any litigation history, nor does it cite judicial interpretations of any of the prescribed procedures. The instrument is procedural and prescriptive and is framed as subordinate legislation implementing practices under the Act. Any litigation that might arise from the regulation would therefore come from disputes about application of the Act or about compliance with the procedural requirements laid down here, but the regulation itself does not record any such litigation.

There are several practical litigation-related points that can be drawn from the regulation’s text without invoking external cases. First, s 5(3)’s command that the Court must not keep a record or copy of the non-disclosure certificate could bear on evidentiary and appellate issues: the judicial officer with carriage will have access to the certificate during the relevant proceeding, but the absence of a retained copy may complicate later review or appeals if the certificate’s content becomes material. The regulation does not provide for a sealed court record or an alternative record retention mechanism. Second, the prescribed forms (Schedule 1) create standardised documents whose contents and stated legal effects (for example, that the participant may lawfully claim their new identity is their only identity) could be contested in litigation about identity, disclosure obligations or surrender notices, but the regulation provides the templates and notes rather than litigation procedures.

Because the regulation cross-references the Act for core legal authorisations and for surrender procedures (for example, Form 1’s note referencing the Act, s 21(5)), any judicial consideration of the regulation’s application will almost certainly be embedded within litigation that turns on the Act’s substantive provisions. The regulation itself is silent on dispute-resolution pathways, sanctions, or review rights that would give rise to a litigation history.

Practitioners advising parties likely to be affected should therefore treat the absence of litigation references in this text as indicating that litigated interpretation of the specific operational commands in this regulation is either not yet developed or not recorded in the instrument. Legal advisers will need to track case law under the Act and any court practice directions or administrative rulings that emerge in response to the regulation’s procedural obligations, particularly on custody and retention of non-disclosure certificates and on cross-jurisdictional recognition of Form 2 permissions.

The regulation contains several precise procedural rules and cross-dependencies that create operational pitfalls for agencies, courts, participants and persons removing identity records. These are concrete points of risk or friction to watch for when implementing the instrument.

Two sequential 20-business-day deadlines. Section 4 requires an authorised person or interstate entity to make its request within 20 business days after removing the identity record and to give the identity record to the Commissioner within 20 business days after making the request, and requires the giving to be in accordance with s 6(2) (s 4). Practically, this creates two short, sequential windows that must both be met. Missing either window may affect the legal status of the request; the regulation does not specify consequences for a missed deadline. Operationally, entities must build processes that track the removal date and ensure the physical transfer is scheduled within the second 20-business-day window.

“Give in accordance with s 6(2)” ties timing to delivery methods. Because s 4(b)(i) requires giving in accordance with s 6(2), the only permitted delivery channels for identity records to the Commissioner are in person, by registered post, or by a secure file sharing platform with end-to-end encryption (s 6(2)). If an authorised person attempts to transfer an identity record by a method outside those three, the transfer would be non-compliant with the regulation. The requirement to use registered post or a secure E2E platform can create logistical delays; for example, registering posted material and ensuring digital platforms meet E2E standards may take time that must be accommodated within the 20-business-day limit.

Court retention prohibition and evidentiary consequences. Section 5(3) commands that the Court must not keep a record or copy of the non-disclosure certificate or another confidential document. That prohibition might be interpreted to require courts to avoid placing any notations, internal logs or electronic copies in court files. The regulation does not set out an alternative mechanism for post-judgment review or archival. Practitioners should note that while the judicial officer with carriage can see the certificate during proceedings (s 5(1)), there will be no court-retained copy for future reference. This raises risks for appellate practice and for litigants seeking to challenge decisions where the certificate’s content is potentially relevant.

Narrow recipient rules for certificates. Non-disclosure certificates must be given in person by a witness protection officer to the judicial officer with carriage of the proceedings or to a person nominated in writing by the chief judicial officer (s 5(1)). If the judicial officer is unavailable, the text allows a person nominated in writing by the chief judicial officer to receive the certificate, but that nomination must be in writing. Failure to ensure a valid, contemporaneous written nomination could prevent lawful delivery. Additionally, s 5(2) requires return in person to a witness protection officer at the end of the proceeding, which imposes custody logistics on courts and police.

Handling within agencies where baseline clearance absent. Section 6(1) authorises handling only by persons with at least a baseline security clearance, or, if no one holds such clearance, by senior officers, namely the head, General Counsel, chief risk officer, or persons performing those functions (s 6(1)(b)(i)-(iv)). Agencies that lack baseline-cleared staff must therefore rely on senior executives to handle confidential documents. This can create a bottleneck or governance tension where those senior officers are not operationally available or are reluctant to assume custodial responsibility. The regulation allows “a person performing the functions” of those officers to act, but agencies must document and justify acting delegations to ensure compliance.

Recordkeeping obligation excludes witness protection officers’ names. Section 6(3)(a) requires agencies to maintain a record containing names of persons other than a witness protection officer involved in the activity, a description of the activity, and dates and times. The explicit exclusion of witness protection officers from the names to be recorded may create an audit gap where the presence of witness protection officers is material to custody. Agencies must therefore ensure their recordkeeping captures required information without violating the exclusion. The exclusion itself suggests a confidentiality interest in witness protection officers’ identities that may complicate transparency in inter-agency dealings.

“Consider” the NSW Guidelines is a low-standard obligation. Section 6(3)(b) requires agencies to “consider” the NSW Government Information Classification, Labelling and Handling Guidelines (April 2021). That duty to consider does not require adoption of specific classifications or handling measures, which may lead to inconsistent practice across agencies and potential legal argument about whether “consideration” was adequate. It is a potential compliance gap that agencies should manage by documenting how they considered the Guidelines.

Digital security standard is stated but not defined. The regulation allows secure file sharing platforms “with end-to-end encryption” (s 6(2)(c)) but does not define acceptable verification steps or accreditation. Agencies must therefore make their own assessments about what qualifies as end-to-end encryption and must document those assessments. Absent clear technical standards in the regulation, differing interpretations could expose agencies to operational risk.

Form 1 surrender obligation tied to the Act. The Schedule 1 note for Form 1 states the document must be surrendered where the participant’s participation is terminated and the Commissioner acts to restore the former identity in accordance with the Act, s 21(5). The regulation does not itself set out s 21(5); practitioners must consult the Act for the mechanics of surrender. Failure to surrender as required could leave a participant holding a document whose legal status depends on the Act’s surrender rules.

Form 2 subject to complementary laws. Form 2 is explicitly subject to the complementary witness protection law identified in the form. Where complementary laws differ from NSW practice, cross-jurisdictional inconsistency in how permissions operate may arise. The regulation does not resolve conflicts between jurisdictions’ rules.

Overall, the regulation contains precise and short timeframes, narrow recipient and transmission rules, a limited authorised-handler list, a modest recordkeeping prescription and a reliance on external vetting and guidance. Those features create discrete operational traps that agencies, courts and users must address through policy, technical controls and clear delegation and custody procedures.

Compliance with the Witness Protection Regulation 2025 requires agencies, courts, witness protection officers and authorised persons to put in place process, technical and governance measures that align with the regulation’s prescriptive duties. The following is a practical compliance checklist linked to the regulation’s provisions.

1. Track removal dates and meet the 20-business-day windows (s 4)

   • Establish a log for all identity records removed by the agency or interstate entity. Record the date of removal as the trigger for the first 20-business-day window.
   • Ensure authorised persons submit any request under the Act, s 19B(2), within 20 business days after the removal date (s 4(a)).
   • On making that request, schedule delivery of the identity record to the Commissioner of Police within 20 business days of the request date (s 4(b)). Note that the physical delivery must use a permitted channel (see step 2).

2. Use authorised sharing channels for identity records and confidential documents (s 6(2); s 4(b)(i))

   • For transfers to the Commissioner of Police, use only the permitted methods: in person, by registered post, or via a secure file sharing platform with end-to-end encryption (s 6(2)).
   • For registered post, use verifiable tracking and retention of proof of posting and receipt to demonstrate compliance with the 20-business-day deadline.
   • For digital transfers, ensure the chosen platform demonstrably provides end-to-end encryption and document that assessment. Maintain technical logs showing the transfer and receipt timestamps.

3. Authorise and document custodians for confidential documents (s 6(1))

   • Maintain a roster of agency personnel who hold at least a baseline security clearance issued by the Australian Government Security Vetting Agency. Verify and document clearances.
   • If no baseline-cleared person exists, document the designation of the head of agency, General Counsel, chief risk officer, or the person performing those functions as the authorised handler (s 6(1)(b)). If someone is acting in those roles, document the delegation that makes them “a person performing the functions” of that office.
   • Ensure authorised handlers understand their custody responsibilities and have agreed to accept them.

4. Maintain required records of handling activities (s 6(3)(a))

   • Create and preserve a contemporaneous record for each activity involving keeping and handling confidential documents that includes: names of persons involved (excluding witness protection officers), a description of the activity, and the dates and times during which the activity was carried out.
   • Ensure records are secure, auditable and preserved according to your agency’s records retention policy and relevant information security protocols.

5. Consider the NSW Information Classification Guidelines (s 6(3)(b))

   • Document how the agency “considered” the NSW Government Information Classification, Labelling and Handling Guidelines (April 2021): note the classification decisions, any deviation from recommended handling practices, and the reasons for those decisions.
   • Where the Guidelines recommend particular controls, map those controls to agency practice and record any gaps and mitigation measures.

6. Implement custody procedures for non-disclosure certificates in courts (s 5)

   • For witness protection officers: deliver the non-disclosure certificate in person to the judicial officer with carriage of the proceedings or to a person nominated in writing by the chief judicial officer (s 5(1)). Ensure the written nomination is in place and accessible to the delivering officer.
   • At the conclusion of the proceeding, retrieve the certificate in person and deliver it to a witness protection officer (s 5(2)). Use a signed handover log to record delivery and return events even though the court must not keep a copy.
   • For courts: establish internal procedures to accept the certificate for the judicial officer’s use without retaining a record or copy of the certificate or other confidential documents (s 5(3)). Ensure registry staff are trained in the requirement not to retain copies and that storage or electronic archiving processes do not inadvertently capture the certificate.

7. Use the prescribed forms for permissions (s 7; Schedule 1)

   • Use Form 1 where the participant was provided a new identity under the NSW witness protection program (s 7(1); Schedule 1 Form 1).
   • Use Form 2 where the participant was provided a new identity under a complementary witness protection law (s 7(2); Schedule 1 Form 2).
   • When completing forms, include the specified fields (date, new identity, law requiring disclosure, purpose, name rank and position of the Commissioner’s delegate, signature and date).
   • Document the continued validity of the permission while the participant retains the new identity, and be prepared to follow surrender obligations under the Act, s 21(5) where applicable (Schedule 1 Form 1 note).

8. Coordinate with the Commissioner of Police and NSW Police witness protection officers

   • Establish contact points and agreed processes with the Commissioner’s office to receive identity records and confidential documents and to deliver and retrieve non-disclosure certificates.
   • Clarify practical arrangements for in-person delivery and receipt, including security arrangements, locations, and identification requirements.

9. Ensure digital platform security and chain-of-custody integrity

   • For digital sharing, implement a platform that provides robust end-to-end encryption. Maintain vendor documentation that explains encryption standards and retention policies.
   • Preserve electronic logs that demonstrate delivery and receipt times and the identity of recipients to meet the s 6(3)(a) recordkeeping obligation.

10. Train staff and document policies

• Provide operational training for witness protection officers, court staff who may receive certificates, records officers, General Counsel, chief risk officers and any authorised handlers.
• Maintain written policies and standard operating procedures that map statutory requirements to agency practice, including checklists for the two 20-business-day deadlines, custody and transfer steps, digital transfer verifications, and the required records to be kept.

11. Audit and review

• Conduct periodic internal audits to verify compliance with s 4, s 5 and s 6, including spot checks of transfer logs, custody handover records, and the presence of required baseline clearances.
• Where the agency lacks baseline-cleared personnel, audit the decision to rely on senior officers and document steps taken to mitigate any governance risks.

12. Cross-jurisdictional coordination

• If dealing with complementary witness protection laws, ensure Form 2 is correctly completed and that the scope of the complementary law is documented in the form. Establish mechanisms to resolve practical differences that may emerge between jurisdictions’ processes.

This checklist is directly grounded in the regulation’s operative provisions. Because the regulation is procedural and does not itself set penalties, agencies should embed these measures within existing governance, security and records-management frameworks in order to evidence compliance and to be prepared for administrative review or audit by oversight bodies or by the Commissioner of Police.