         Update protective security requirements to the latest release of the Protective Security Policy Framework (PSPF), incorporate the PSPF directly by reference, limit use of the PSPF to Australian non-corporate Commonwealth entities (NCE’s), mandate the use of other frameworks for non-NCE's, and introduce a 3 month transition period for future PSPF updates (Schedule 1).

         Provide a separate maximum duration of express consent when given to an accredited Attribute Service Provider for or on behalf of a business (Schedule 2).

         Extend by 12 months the implementation period for transitioned accredited entities to comply with digital ID voluntary suspension and resumption obligations (Schedule 3).

1.1.            The name of this instrument is the Digital ID (Accreditation) Amendment (PSPF and Other Measures) Rules 2025 (Amendment Rules).

1.2.            This instrument commences the day after this instrument is registered on the Federal Register of Legislation.

1.3.            This section provides that this instrument is made under section 168 of the Digital ID Act 2024 (Digital ID Act).

1.4.            Section 168 of the Digital ID Act enables the Minister to make legislative instruments, such as the Amendment Rules. The purpose of this section is to set out the authority under which this instrument is made.

1.5.            This section provides that each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.

1.6.            The purpose of this section is to provide for how the amendments in this instrument operate.

1.7.            This Schedule incorporates certain controls of the Protective Security Policy Framework (PSPF). The purpose of these amendments is to ensure the latest release of PSPF is applied in the Accreditation Scheme at the relevant time. These amendments are designed to enhance precision and alignment with the PSPF by the Accreditation Scheme, and consistency with the broader whole-of-government protective security policy framework.

1.8.            The PSPF is owned and maintained by the Department of Home Affairs and sets out the Australian Government’s protective security policy across six security domains. The PSPF provides for what Australian Government entities must do to protect their people, information and resources, both domestically and internationally. The PSPF is published online and is freely available online at: https://www.protectivesecurity.gov.au.

1.9.            The PSPF is subject to annual review to ensure that it continues to reflect current threats. The Department of Home Affairs consults with the relevant impacted bodies before changes are made to the PSPF. This ensures that impacted bodies are aware of the new upcoming changes and understand their compliance obligations.

1.10.        The purpose of these amendments is to introduce several policy changes that support a more responsive protective security framework compliance model under the Rules:

         Incorporation of PSPF directly by reference: Previously, relevant requirements within the PSPF were replicated in the Rules. This change enables timely adoption of future PSPF updates, ensures alignment with whole-of-government protective security policy, improves regulatory responsiveness, and ensures that protective security obligations under the Rules remain fit-for-purpose and consistent with government expectations. Additionally, this change reduces confusion for accredited entities by clearly distinguishing what PSPF controls entities must comply with, and the reduced period to adopt the latest changes from 12 months to 3 months reinforces the commitment to timely adoption of PSPF updates in consideration of evolving protective security standards. 3 months reinforces the commitment to timely adoption of PSPF updates in consideration of evolving protective security standards.

         Application to Non-Corporate Commonwealth Entities: In line with broader whole-of-government security policy, all non-corporate Commonwealth entities (NCEs) subject to the Public Governance, Performance and Accountability Act 2013 (PGPA Act) are required to comply with the PSPF. This obligation ensures that NCEs meet their responsibilities under the PGPA Act and maintain consistent protective security standards across government.

         Application period: A 3 month period is provided for entities to comply with any changes to the PSPF that occur after these amendments commence. This allows NCEs time to make changes to their digital ID systems or documents to comply with any updates to the PSPF, noting they are also required to comply with any updates to the PSPF under the PGPA Act.

         Other frameworks for other entities: Entities that are not NCEs may choose to comply with the ISO/IEC 27001 or an alternative equivalent framework, if they can demonstrate compliance with all required controls under ISO/IEC 27001. This provides flexibility while maintaining regulatory assurance. It is important to note that non-NCEs cannot use the PSPF unless they are subject to rule 8.3.

1.11.        The Amendment Rules distinguish between a protective security framework and protective security framework controls. This amendment improves the precision of the relevant legislative provisions and reflects the policy of requiring entity to comply with specific controls, rather than implementing a framework as was previously the case.

1.12.        This item inserts a new definition of non-corporate Commonwealth entity into subrule 1.4(2). The new definition adopts the same meaning as in the PGPA Act.

1.13.        Under the PGPA Act, both NCE’s and non-NCEs are entities that form part of the Commonwealth and can be subject to the financial and corporate governance arrangements of the PGPA Act. However, only NCEs are required to comply with the PSPF in accordance with whole-of-government security policy.

1.14.        The purpose of this amendment is to distinguish accredited entities that are NCEs from other types of accredited entities, particularly in relation to their protective security framework requirements. NCEs are required to implement the PSPF, consistent with their obligations as Commonwealth entities under the PGPA Act.

1.15.        Items 2 to 4 of the Amendment Rules amend and introduce new definition terms relating to the protective security framework requirements within the Rules. Collectively, the purpose of these changes is to clarify the scope and structure of protective security framework obligations. The amendments are also intended to assist in distinguishing between the protective security framework that applies to an accredited entity and the individual protective security controls within each framework and align terminology to reflect a compliance-based approach. This approach provides greater certainty to accredited entities by clearly articulating their obligations and enabling more consistent implementation and assessment of protective security requirements.

1.16.        Item 2 repeals and substitutes the definition of protective security framework. Previously, the term was defined by reference to Division 2 of Part 4.1 of Chapter 4, which provides for the protective security frameworks in the Rules. The revised definition now explicitly identifies three protective security frameworks in the Rules, which are the PSPF, ISO/IEC 27001 or an alternative framework. This provides greater precision in the references to the relevant or specified controls in provisions across the Rules.

1.17.        Item 3 inserts a new definition of protective security framework control into subrule 1.4(2), which is defined to mean a relevant PSPF control, a control specified in ISO/IEC 27001 or a control specified in an alternative framework in rule 4.5. The purpose of this change is to create a clearer distinction between a “protective security framework” as a whole and the individual controls within a protective security framework.

1.18.        This definition supports the revised structure in Chapter 4, which focuses on specific protective security controls rather than the adoption of an entire protective security framework. To reflect this shift, the language used in the Amendment Rules has also been refined.  Accredited entities are now required to comply with individual controls, recognising that compliance with a framework is best achieved through meeting these relevant specific controls.

1.19.        Item 4 repeals and substitutes the notes under the definition of PSPF.

1.20.        New Note 1 under the definition of PSPF provides the web address for where the PSPF could be accessed in 2025.

1.21.        The purpose of the new Note 1 is to assist the reader by providing for the web address where the PSPF could be accessed in 2025 and at the time of commencement.

1.22.        The new Note 2 under the definition of PSPF clarifies that, at the time subrule 1.7(2) commenced, the current version of the PSPF was the PSPF published on 24 July 2025.

1.23.        The purpose of the new Note 2 is to clarify which version of the PSPF was in force at the time subrule 1.7(2) commenced. Broadly, subrule 1.7(2) is the relevant provision that deals with the delayed effect of changes to the PSPF.

1.24.        This item defines the term relevant PSPF control by reference to rule 4.3.

1.25.        The term ‘relevant PSPF control’ is used throughout these rules to refer to the individual requirements in the PSPF that have been incorporated by these rules (refer rule 4.3).

1.26.        The use of the term ‘control’ rather than the term ‘requirement’ is deliberate and reflects the terminology adopted in the Rules. Although the PSPF refers to requirements, the Rules use the term ‘controls’ to describe the specific controls entities must meet and comply with. The use of the term control does not alter the meaning of the PSPF requirements themselves but ensures that those PSPF requirements are to be interpreted and applied within the context of the Rules.

1.27.        This item repeals and substitutes subrule 1.7(2) with a new subrule which sets out the application of amendments to incorporated instruments.

1.28.        New subrule 1.7(2) provides for the time period for compliance with any changes to incorporated instruments. For changes made to the PSPF after the Amendment Rules commence, accredited entities will have a 3 month period after the change takes effect. For other incorporated instruments, a 12 month period applies.

1.29.        The effect of paragraph 1.7(2)(a) is that, unless the contrary intention appears, an accredited entity is not required to comply with changes to the PSPF until 3 months after that change takes effect. It is limited to changes to the PSPF that occur after the commencement of the Amendment Rules. Therefore, the PSPF issued on 24 July 2025 by the Department of Home Affairs will apply immediately from the commencement date of the Amendment Rules.

1.30.        A change to the PSPF is taken to take effect on the date it is published on the PSPF website by the Department of Home Affairs, unless specified otherwise. Following the date of publication, entities have a 3 month period to comply with any changes.

1.31.        Previously, the Rules did not directly incorporate external frameworks like the PSPF by reference. Instead, compliance with the PSPF was through complying with the controls listed in Schedule 5 of the Rules. As a result, any updates to the PSPF would not automatically apply until the Rules themselves were amended.

1.32.        The Amendment Rules take a new approach to how the relevant PSPF controls apply. The relevant PSPF controls are now incorporated directly by reference. This means that future updates to the relevant PSPF controls will be, by operation of law, incorporated by the Amendment Rules. This will provide greater alignment between the PSPF and the Rules.

1.33.        The PSPF will now be updated after annual reviews to ensure it reflects the current threat environment.

1.34.        Given the changes to the release cycle to an annual schedule, a 3 month period has been introduced which provides entities with a reasonable period to comply with any changes to PSPF controls in rule 4.3. This timeframe is considered appropriate to provide entities time to take the necessary actions to comply with the PSPF controls in rule 4.3, such as updating relevant documentation. This timeframe also takes into account that changes to those controls from one annual release of the PSPF to the next are expected to be minor in nature.

1.35.        Paragraph 1.7(2)(b) prescribes that accredited entities are not required to comply with changes to other incorporated instruments until 12 months after that change takes effect.

1.36.        There is no change to the period when a change to any other incorporated instruments applies. Consistent with current arrangements, entities will not be required to comply with a change to any other incorporated instruments until 12 months after that change takes effect. This recognises that an accredited entity may not be able to immediately comply with a change to an incorporated instrument and ensures that entities are provided sufficient time to implement, where required, IT system upgrades or other arrangements to comply with the requirements.

1.37.        This approach balances the need for timely implementation of changes to protective security frameworks and the practical realities faced by entities in achieving compliance with these obligations in a fast-evolving environment.

1.38.        This item inserts new rules 1.7A and 1.7B, which provide for the modification of the PSPF and ISO/IEC 27001 standard for the purposes of incorporation or application of the PSPF or the ISO/IEC 27001 standard by the Amendment Rules, respectively.

1.39.        Subrule 1.7A(a) provides that references in the PSPF to ‘Australian Government Resources’ or ‘Australian Government people and resources’ are taken to be references to ‘DI data environment’ in the Rules.

1.40.        Subrule 1.7A(b) provides that references to ‘risk’ in the PSPF are taken to mean ‘cyber security risk’ within the meaning of the Rules.

1.41.        The effect of new rule 1.7A is to deem certain terms in the PSPF to mean another term within the meaning of the Rules. The purpose of these provisions is to tailor the PSPF within the Rules to prevent ambiguity and support effective operation of PSPF obligations in a DI data environment.

1.42.        The effect of new rule 1.7B is to deem certain terms in a specified ISO/IEC 27001 standard to mean another term within the meaning of the Digital ID Act. The purpose of this provision is to tailor ISO/IEC27001 within the scope of the Rules.

1.43.        Subrules 1.7B(a) and (b) refer to terms that must be referenced in accordance with their meaning under the Act. Subrule 1.7B(c) refers to a term that must be referenced in accordance with its meaning under these rules.

1.44.        The purpose of this amendment is also to prevent ambiguity and support effective operation of ISO/IEC27001 in a DI data environment.

1.45.        This item repeals and substitutes subparagraph 3.3(1)(a)(i).

1.46.        This amendment uses the new defined term protective security framework controls.

1.47.        Previously, this provision referred to implementation of, and compliance with, the controls in the protective security framework the entity uses or will use if accredited.

1.48.        This provision continues to relate to protective security assessments for accredited entities or accreditation applicants but narrows the scope to compliance only.

1.49.        The only substantive change to this provision is to specifically refer to rule 4.2, which provides for the protective security framework controls which an entity must comply with, or will comply with if accredited. The provision is also amended to include more precise language by using the new defined term ‘protective security framework controls’ and to clarify that entities must comply with, or will comply with if accredited, those controls for the purposes of rule 4.2.

1.50.        The purpose of this amendment is to ensure the protective security assessment focuses on the relevant controls listed under subrule 4.3(1) rather than assessing an entire framework.

1.51.        This item omits ‘Division 2’ and substitutes ‘Division 3’ in subparagraph 3.31(1)(a)(iii).

1.52.        The purpose and effect of this item is to correct a typographical error in the provision reference.

1.53.        Subparagraph 3.3(1)(a)(iii) is intended to require the protective security assessment of an accredited entity to include the additional protective security controls in new Division 3 of Part 4.1 of Chapter 4.

1.54.        For completeness, the protective security controls in Division 3 of Part 4.1 of Chapter 4 are required to be reviewed and assessed as part of the protective security assessment by existing subparagraph 3.3(1)(a)(i).

1.55.        This item omits “a particular protective security control in the framework it implements” and substitutes “a particular protective security framework control”.

1.56.        This change reflects the insertion of the new definition of protective security framework control and the associated implications around complying with a control.

1.57.        These items amend subrule 3.5(1), subparagraph 3.5(1)(c)(i) and subrule 3.5(2), substituting references to “implement” with “comply with”. This creates consistency with the revised language around controls with the rules.

1.58.        This change reflects the terminology introduced in the new definition of protective security framework control. The effect is to clarify that entities must comply with controls, not solely implement frameworks.

1.59.        This item repeals and substitutes the heading to “Division 2 – Protective security framework controls”.

1.60.        The effect of this heading change is to reflect the revised terminology and structure of the chapter.

1.61.        This item repeals and substitutes rules 4.2 to 4.4.

1.62.        Rule 4.2 provides for the protective security framework controls which apply to an accredited entity.

1.63.        Accredited entities that are NCEs must comply, in respect of their accredited services and DI data environment, with the relevant PSPF controls in accordance with the PSPF. This is consistent with broader Australian government security policy that NCEs must comply with the PSPF.

1.64.        Accredited entities that are not an NCEs must comply with either all of the controls specified in ISO/IEC 27001 or the controls of an alternative framework in accordance with rule 4.5. This change means that an accredited entity that is not an NCE will not be able to select the PSPF as their protective security framework.

1.65.        This change has been made to reflect the Directive on the Security of Government Business issued by the Minister for Home Affairs. This directive establishes the PSPF as Australian Government policy and mandates compliance with the PSPF for NCEs in accordance with section 21 of the PGPA Act.

1.66.        The PSPF provides direction and guidance for Accountable Authorities of NCEs and contains detailed requirements for the protection, handling, and disposal of Australian Government information and resources. These requirements are tailored to the classification and handling of Australian Government information and do not extend to non-government information. For the purposes of these rules, the PSPF will only be available to, and compliance mandated for NCEs.

1.67.        The phrase “in accordance with” in rule 4.2 ensures controls are applied within the context of the relevant protective security framework. This means that entities must apply the controls in a way that reflects how they are intended to operate within the structure of the applicable framework.

1.68.        For example, a key component of requirement 0018 of the PSPF is compliance with mandatory elements in table 1 of the PSPF. Although table 1 of the PSPF has not been incorporated, entities must implement requirement 0018 in accordance with the context of the PSPF, including Table 1.

1.69.        Similar to current subrule 4.3(2), new subrule 4.2(3) prescribes that rule 4.2 is subject to rule 4.6. Briefly, rule 4.6 generally provides that an accredited entity is not required to comply with a particular control if the entity’s most recent protective security assessment report concludes that a control is irrelevant due to the entity’s particular circumstances.

1.70.        New rule 4.3 sets out the relevant PSPF controls that an NCE must comply with in respect of its accredited services and DI data environment, for the purposes of rule 4.2. The relevant PSPF controls must be complied with in accordance with the PSPF.

1.71.        The rationale for this change is to align protective security controls with the specific risks and operational contexts of the digital ID system, focusing on the relevant controls that are most relevant to the digital ID system.

1.72.        The effect of this change is that accredited entities must remain aligned with the most current version of the PSPF. This improves consistency with whole-of-government policy and ensures that protective security obligations for accredited NCEs reflect contemporary standards.

1.73.        The table at rule 4.3 prescribes the relevant PSPF controls that an entity must comply with. Column 1 sets out the item number. Column 2 prescribes the relevant PSPF requirement that an entity must meet to implement each PSPF control for the purposes of rule 4.2.

1.74.        As a result of the operation of subrule 1.7(2), an accredited entity is not required to comply with a change to the PSPF controls as incorporated by rule 4.3 until 3 months after the change to the PSPF has taken effect.

1.75.        This item repeals subrule 4.3(4). This is due to Schedule 5 becoming obsolete and the relevant requirements of the PSPF are now listed in the table at rule 4.3.

1.76.        Item 16 repeals and substitutes subrules 4.5(1) to (3).

1.77.        Previously, under subrule 4.5(1), any accredited entity may implement an alternative protective security framework if they meet certain requirements, which generally is to demonstrate compliance with all of the same kinds of controls that would be required if the entity were to implement either PSPF or ISO/IEC 27001 for the purposes of previous rule 4.2.

1.78.        New subrule 4.5(1) provides that an accredited entity (other than an NCE) may only comply with the controls of an alternative framework if they demonstrate, in accordance with subrule 4.5(2), that the entity complies with all the same kinds of controls specified in ISO/IEC 27001.

1.79.        The effect of this amendment is to:

         limit the types of entities that may comply with an alternative framework to any entity that is not an NCE; and

         require relevant entities to demonstrate compliance with all the same kinds of controls specified in ISO/IEC 27001; and

         ensure that an alternative framework must not include a relevant PSPF control.

1.80.        The purpose of this amendment is to give effect to the overarching policy intention of allowing only NCEs to comply with PSPF.

1.81.        Previously, subrule 4.5(2) provided for an entity’s compliance with the PSPF. This provision is repealed and not replicated as it does not reflect the policy intention.

1.82.        New subrule 4.5(2) replicates the effects of previous subrule 4.5(3), which provides for an entity’s compliance with all the same kinds of controls as ISO/IEC 27001. Under new subrule 4.5(2), an accredited entity that complies with an alternative framework must prepare and maintain an up-to-date document that maps each control in the alternative framework that must be complied with against controls in ISO/IEC 27001. The document must specify any ISO/IEC 27001 controls that are not covered because the alternative framework does not require compliance with those controls.

1.83.        This ensures that, for entities seeking to comply with an alternative framework, the framework is equivalent in substance to ISO/IEC 27001 and continues to support the policy intention that the entity meets appropriate security requirements.

1.84.        Additionally, it ensures that entities seeking to comply with an alternative framework cannot include a relevant PSPF control to achieve compliance.

1.85.        This item omits “If an accredited entity implements an alternative framework for the purposes of rule 4.2” and substitutes it with “If an accredited entity complies with the controls of an alternative framework for the purposes of paragraph 4.2(1)(b)”.

1.86.        This amendment removes references to ‘implement’ and substitutes it with ‘complies with’ in order to clarify that entities must comply with specific controls and not merely implement frameworks.

1.87.        As discussed above, the purpose of this terminology update is to reinforce a compliance-based approach to the rules.

1.88.        While the effect of Item 16 is to remove existing subrule 4.5(3), the numbering of this provision remains subrule 4.5(4) to reflect common drafting practice not to renumber in these instances.

1.89.        This item omits “, and manage and monitor” to ensure coherency with terminology within this Division.

1.90.        The purpose and effect of this amendment is to simplify this provision and clarify that entities must comply with the requirements of this provision. This could, in practice, include actions such as constant monitoring, to ensure continuous compliance with the relevant requirements.  

1.91.        This item omits “or (3)(b)” and substitutes it with “of this rule”.

1.92.        This is a consequential amendment to reflect the amendments of subrule 4.5(3) in Item 16 as paragraph 4.5(3)(b) has been repealed.

1.93.        This item repeals subrule 4.5(6).

1.94.        This item omits “a particular control in the framework it implements” and substitutes it with “a particular protective security framework control”, to reflect the new term protective security framework control.

1.95.        This item repeals the Note under rule 4.9.

1.96.        This is to remove any confusion from referencing obsolete policies that are no longer in circulation or no longer exist.

1.97.        This item repeals and substitutes subrule 4.12(2).

1.98.        Rule 4.12 sets out the requirements for system security plans. Currently, subrule 4.12(2) provides for the system security plan requirements if an accredited entity implements the PSPF. Relevantly, the entity’s system security plan is to be the security plan referred to in PSPF Policy 11 (Robust IT systems).

1.99.        PSPF Policy 11 is from an outdated PSPF Release and is not the current PSPF policy, as published by the Department of Home Affairs.

1.100.    New subrule 4.12(2) provides that if an accredited entity complies with the relevant PSPF controls for the purposes of rule 4.2, the entity’s system security plan is the plan referred to in section 3.1 of the PSPF, which deals with security planning. It also provides that the plan must contain any other information required by these Amended Rules to be included in the entity’s system security plan.

1.101.    New rule 4.2 confines the compliance of PSPF to only NCEs. The effect of this provision is that an accredited NCE’s system security plan must comply with section 3.1 in the PSPF, which is incorporated by reference from time to time.

1.102.    This item omits “If an accredited entity implements ISO/IEC 27001” and substitutes it with “If an accredited entity complies with ISO/IEC 27001 for the purposes of rule 4.2”, to reflect the revised terminology of “complying with” ISO/IEC 27001.

1.103.    This is consistent with the language that will be used throughout the Rules once amended.

1.104.    This item inserts new Chapter 8, which contains the application, saving and transitional provisions.

1.105.    Rule 8.1 provides for the defined terms used in this part, which are amending instrument, commencement day and old rules. Broadly, these definitions provide for the necessary transitional provisions by clarifying the instrument that applies.

1.106.    Subrule 8.2(1) broadly provides that this rule applies to an application for accreditation made, but not finally determined, before the commencement day.

1.107.    Subrule 8.2(2) broadly provides that such applications will continue to be assessed under the previous rules notwithstanding amendments introduced by the Amendment Rules.

1.108.    This rule means that any applications made but not yet finally determined (including applications to vary or revoke conditions imposed on an accreditation) immediately before the commencement day, will continue to be assessed against the Rules that were in force immediately before commencement. This ensures procedural fairness and avoids the retrospective application of the new requirements.

1.109.    Rule 8.3 provides for the transitional arrangements for certain accredited entities that were adopting the PSPF as their protective security framework before the commencement of the Amendment Rules. This rule only applies to entities that are accredited NCEs and were implementing PSPF requirements for their accredited services and DI data environment.

1.110.    Broadly, subrule 8.3(2) provides for a 12 month period post commencement of the Amendment Rules for certain affected accredited entities. During this period, subrule 4.2(1) does not apply to these entities. Instead, these entities are provided with 12 months to move from PSPF to the ISO/IEC 27001 requirements or an alternative framework in accordance with rule 4.5. For example, an entity covered by this provision will need to comply with the relevant controls as outlined in rule 4.3 and subrule 4.12(2) of the Amendment Rules.

1.111.    This item repeals Schedule 5 as the relevant PSPF controls have now been incorporated by reference within these amendments.

1.113.    This item repeals and substitutes paragraph 4.41(3)(d) in the Rules.

1.114.    Section 45 of the Digital ID Act broadly prohibits an accredited entity from disclosing certain attributes of an individual to a relying party without the express consent of the individual when verifying that individual’s identity, digital ID, or information about them. The information could include the individual’s current name or former name, address, date of birth, phone number or email address. The Digital ID Act does not specify an expiry period for an individual’s express consent.

1.115.    Rule 4.41 relevantly sets out the duration of express consent given by an individual. Broadly, it provides for the requirements around any express consent given by an individual for the future collection, use or disclosure of their personal information.

1.116.    Rule 4.41 also provides strong safeguards around that express consent. Subrule 4.41(2) relevantly requires an accredited entity to provide the individual with a clear and simple process to vary or withdraw any consent. In addition, subrule 4.41(4) relevantly prohibits an accredited entity from relying on consent given in accordance with subrule 4.41(1) if that consent has been withdrawn or expired.

1.117.    Subrule 4.41(3) broadly sets out the period when the consent expires. The effect of that provision is that consent expires at the earliest of the periods described in that provision. Paragraph 4.41(3)(a) broadly provides that consent must expire at the end of the period specified by the individual (which could be shorter than the maximum period). Current paragraph 4.41(3)(d) broadly provides for consent to expire 12 months after the consent was initially given.

1.118.    The effect of Item 1 is to provide for two different periods of consent, which apply depending on the circumstances.

1.119.    New subparagraph 4.41(3)(d)(i) relevantly provides that if the accredited entity is an Attribute Service Provider (ASP) and the individual declares in their consent that their use of the entity’s accredited service is for or on behalf of a business (including a business carried on by that individual) – the consent expires 7 years after the consent was initially given.

1.120.    New subparagraph 4.41(3)(d)(ii) generally provides for a 12 month consent period in any other circumstances.

1.121.    An ASP is an entity that provides, or proposes to provide, a service that verifies and manages an attribute of an individual, as defined in section 9 of the Digital ID Act. In some circumstances an individual may choose to use a digital ID provided by an Identity Service Provider (ISP), in combination with an additional attribute/s provided by an ASP, in order to access an online service provided by a relying party.

1.122.    For example, a person responsible for a business wants to access government online services to lodge business activity statements on behalf of the business. They use their personal digital ID issued by an accredited ISP to verify their identity. To demonstrate their authority to act for or on behalf of the business, the person uses an accredited ASP service that verifies and manages the attribute/s, confirming their business relationship. The government agency (the relying party) accepts both the personal digital ID and the business authority attribute/s to grant the person access to the service.

1.123.    The express consent given to an ASP in these circumstances involves the use and disclosure of limited types of personal information, including the person’s name, contact email (which may be a business email), business name, and the nature of their authority to act on behalf of the business.

1.124.    Without the proposed amendment, consent for the use of attributes managed by an accredited ASP is limited to a 12 month period in all circumstances. The amendment allows for two different maximum consent periods: a 7 year period where the individual declares in their consent that their use of the ASP’s accredited service is for or on behalf of a business (as illustrated in the example above), and a 12 month period in all other cases.

1.125.    The 12 month expiry period for express consent for individuals reflects a privacy-protective approach consistent with the Office of the Australian Information Commissioner’s Australian Privacy Principles Guidelines, which provide that express consent should not be enduring. The shorter period is appropriate in the context of personal use, which requires regular renewal to ensure that consent remains valid and informed.

1.126.    By contrast, businesses often operate under contractual and internal governance frameworks that support long term or ongoing relationships with individuals acting on their behalf. The 7 year consent duration is intended to apply to a range of relationships that a person may have with a business. Scenarios may include individuals who are employees, contractors, unpaid volunteers, or sole traders operating their own business. It also includes individuals who are authorised to act as agents for a business, such as tax agents or other professional representatives. These individuals often have relationships with multiple businesses.

1.127.    Requiring authorised representatives and agents to renew their express consent every 12 months creates an unnecessary administrative and regulatory burden and may impact business productivity and services. The 7 year maximum period takes into account these differences, while ensuring that the express consent given is not enduring and can be withdrawn at any time.

1.128.    Item 1 does not change any other existing requirements under rule 4.41, including the requirements on accredited entities with public-facing accredited services to have clear and simple processes in place for an individual to vary or withdraw their consent. In particular, the proposed amendment does not affect other consent periods set out under subrule 4.41(3), which means that a consent given under subrule 4.41(1) can have a different expiry period to 12 months or 7 years, if the individual specifies a different period.

1.129.    This amendment introduces flexibility to support efficient and sustainable business use of accredited services while continuing to reinforce the broader intent of rule 4.41, which is to ensure that express consent is meaningful, time-bound, and tailored to the context in which it is given.

1.130.    Item 1 omits “starting on the day that is 12 months after the day on which these Amendment Rules commence” and substitutes “on and after 30 November 2025” in subrule 1.8(1) of the Rules.

1.131.    Rule 1.8 broadly provides for the application of certain provisions to a transitioned accredited entity.

1.132.    A transitioned accredited entity is defined in rule 1.4 as an entity taken to be accredited immediately after commencement of the Act, in accordance with item 2 of Schedule 1 to the Digital ID (Transitional and Consequential Provisions) Act 2024.

1.133.    Subrule 1.8(1) generally provides that the provisions listed in a table under subrule 1.8(1) apply to transitioned accredited entities starting on the day that is 12 months after the day on which the Rules commence. The Rules commenced on 30 November 2024.

1.134.    The effect of Item 1 is to provide for the provisions in that table to apply on and after 30 November 2025. Specifying a date provides more clarity and certainty to accreditation applicants and accredited entities on the application of these provisions.

1.135.    Item 2 repeals table items 11 and 12 in the table under subrule 1.8(1).

1.136.    Items 11 and 12 of the table provides for the application of rule 5.7 and subrule 5.9(2) to transitioned accredited entities.

1.137.    These provisions are now relocated in new subrule 1.8(1A), inserted by Item 3.

1.138.    This amendment is a consequential amendment to Item 3.

1.139.    Item 3 inserts new subrule 1.8(1A) after subrule 1.8(1).

1.140.    This Item provides that rule 5.7 and subrule 5.9(2) apply to a transitioned accredited entity on and after 30 November 2026.

1.141.    Rule 5.7 broadly requires ISPs to implement an individual's request to temporarily suspend the use of their digital ID as soon as practicable after confirming the legitimacy of the request, and notify the individual of the suspension and how to resume the use of the digital ID.

1.142.    Rule 5.8 separately provides for suspension in cases of suspected fraud or cyber security incidents.

1.143.    Rule 5.9 generally provides for resuming the use of a digital ID. Broadly, subrule 5.9(2) prescribes the steps an ISP must take to resume use of a digital ID suspended under subrule 5.8, including ensuring the individual completes identity proofing at the same identity proofing level (IP level) as prior to suspension.

1.144.    IP levels, ranging from IP1 to IP4, reflect the strength and confidence of identity verification required for different services. The higher the IP level, the more robust and reliable the identity verification process becomes, with higher levels necessitating more comprehensive checks, such as biometric verification and at the highest IP level an in-person verification.

1.145.    The effect of the amendment in Item 3 is that transitioned accredited entities have until 30 November 2026 before the requirements under rule 5.7 and subrule 5.9(2) apply. As these requirements are about the voluntary suspension and resumption of digital IDs by an ISP, it will only affect accredited ISPs.

1.146.    As at the date of this amendment, the transitioned accredited entities that are ISPs, as prescribed in Table 1 of Schedule 1 to the Digital ID (Transitional and Consequential Provisions) Rules 2024, include the Commissioner of Taxation, Makesure Pty Ltd, and OCR Labs Pty Ltd trading as IDVerse.

1.147.    Accordingly, as at the date of this amendment, it applies to the Commissioner of Taxation and Makesure Pty Ltd in relation to the obligations under rule 5.7 and subrule 5.9(2) of the Digital ID Rules. It does not apply to apply to OCR Labs Pty Ltd trading as IDVerse which supports only one-off identity verification and does not involve the issuance of reusable digital IDs to which these obligations would apply.

1.148.    The purpose of this amendment is to provide the relevant transitioned accredited entity with an additional 12 months to comply with these requirements. This is in response to feedback from select transitioned accredited entities that these requirements have proven operationally and technically challenging to implement into their existing digital ID services. This includes the prospect, in some circumstances, of inadvertently preventing individuals from resuming the use of their suspended digital ID where the individual cannot re-verify their identity to the original IP level.

1.149.    The deferred application of these provisions allows transitioned accredited entities additional time to comply with the law, including implementing technically demanding requirements, particularly around identity proofing requirements relating to digital ID suspension and resumption operation.

1.150.    Rule 5.7 and subrule 5.9(2) have been retained due to their importance in providing individuals with choice and control over their digital ID. Although these rules may require more technically demanding enhancements to ICT systems of accredited entities, these provisions empower individuals to temporarily suspend their digital ID if they suspect fraud or misuse. Resumption can only occur if entities have their explicit consent and where the entity is satisfied that the original suspension request was legitimate.

1.151.    A practical example of rule 5.7 is where an individual suspects their digital ID has been compromised and requests a temporary suspension. The entity must provide a mechanism for the individual to take immediate action to suspend their digital ID and later resume it once ownership is confirmed under subrule 5.9(2).

1.152.    This is distinct from rule 5.8, which requires an entity to suspend or revoke a digital ID where there is evidence of fraud, misuse, or other security risks, regardless of whether the individual requests it.

1.153.    Subrule 5.9(1) applies only where resumption of a digital ID is required due to a suspension under rule 5.7. If a digital ID is not suspended under rule 5.7, subrule 5.9(1) will not apply by default.

1.154.    Item 4 omits “subrule 1” and substitutes it with “subrules (1) or (1A)”.

1.155.    This is a consequential amendment to the amendments in Items 2 and 3.

         Update protective security requirements to the latest release of the Protective Security Policy Framework (PSPF), incorporate the PSPF directly by reference, limit use of the PSPF to Australian non-corporate Commonwealth entities (NCEs), mandate the use of other frameworks for non-NCE's, and introduce a 3 month transition period for future PSPF updates (Schedule 1).

         Provide a separate maximum duration of express consent when given to an accredited Attribute Service Provider for or on behalf of a business (Schedule 2).

         Extend by 12 months the implementation period for transitioned accredited entities to comply with digital ID voluntary suspension and resumption obligations (Schedule 3).

2.2              Schedule 1 to the Amendment Rules incorporates the PSPF by reference and mandates its adoption by accredited entities that are NCEs while requiring other accredited entities to adopt ISO/IEC 27001 or alternative frameworks under subrule 4.2(1). This amendment establishes a 3 month transition period for implementing future PSPF updates.

2.3              The principal human right engaged by Schedule 1 to the Amendment Rules is the protection against arbitrary or unlawful interference with privacy under Article 17 of the International Covenant on Civil and Political Rights (ICCPR), which generally states that:

         No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation.

         Everyone has the right to the protection of the law against such interference or attacks.

2.4              Schedule 1 to the Amendment Rules engages the prohibition from arbitrary or unlawful interference with privacy contained in Article 17 of the ICCPR as they regulate the protective security standards that accredited entities must apply when handling personal and sensitive information.

2.5              Additionally, Schedule 1 promotes the protection of privacy under Article 17 of the ICCPR by mandating strong and consistent protective security standards, recognising equivalent international frameworks for flexibility, and providing reasonable transition periods for compliance. By mandating compliance with the PSPF for NCEs and recognising equivalent international standards for other entities, this Schedule strengthens privacy protections and ensure consistency across the system. 

2.6              For entities that are not NCEs, the option to comply with ISO/IEC 27001 or an alternative framework ensures that effective privacy protective controls can be maintained. ISO/IEC 27001 is an internationally recognised standard for information security management systems and includes robust requirements for the protection of personal data. 

2.7              The introduction of a 3 month transition period for future PSPF updates further supports the right to privacy by balancing the need to provide entities sufficient time to implement necessary changes in a considered and effective manner while avoiding any delay that could compromise timely privacy protection. This avoids abrupt or impractical compliance obligations that could otherwise undermine the consistent protection of personal information. 

2.8              Additionally, a transitional arrangement has been established for entities other than NCEs that are currently applying the PSPF. Such entities will be granted a 12 month transition period to achieve compliance with the ISO/IEC 27001 requirements or an alternative framework under subrule 4.2(1).

2.9              Schedule 1 to the Amendment Rules is compatible with human rights and does not limit the right to privacy. It achieves this by requiring all accredited entities to apply robust, consistent, and proportionate protective security standards when handling personal and sensitive information.

2.10          Schedule 2 to the Amendment Rules introduces a new duration for express consent when a person declares in their consent that their use of the accredited Attribute Service Provider’s (ASP) services is for or on behalf of a business (including a business carried on by that individual). If these requirements are met, consent can be given for up to 7 years, while the existing 12 month duration will continue to apply in all other cases.

2.11          Schedule 4 to the Amendment Rules engages the right of prohibition against arbitrary or unlawful interference with privacy under Article 17 of the ICCPR.

2.12          Similar rights are contained in Article 16 of the Convention on the Rights of the Child (CROC) and Article 22 of the Convention on the Rights of Persons with Disabilities (CRPD).

2.13          Schedule 2 to the Amendment Rules engages the right to protection from arbitrary or unlawful interference with privacy by introducing a separate maximum duration for express consent in specific circumstances.

2.14          Broadly, section 45 of the Digital ID Act 2024 (Digital ID Act) prohibits accredited entities disclosing certain attributes of an individual to a relying party when verifying that individual’s identity, digital ID, or information about them, without the individual’s express consent. The Rules set out the duration of express consent and broadly, the consent expires at the earliest of a range of specified periods. Currently, subrule 4.41(3) generally provides that every express consent expires 12 months after being given, or earlier if varied.

2.15          Schedule 2 to the Amendment Rules introduces a separate expiry period of 7 years for express consent given to an ASP where the individual declares that they are using the service for or on behalf of a business, including a business they personally carry on.

2.16          Importantly, the 12 month expiry period remains unchanged for express consent given in a personal capacity, maintaining a privacy-protective approach. Additionally, individuals have the choice to elect a shorter consent period if desired, and may vary or withdraw their consent at any time. Existing safeguards in the Rules continue to apply in both contexts. This includes requirements on entities with public-facing accredited services to have clear and simple processes in place for an individual to vary or withdraw their consent.

2.17          Consent is a cornerstone of privacy protection, and this measure strengthens that foundation by ensuring that consent remains time-bound and revocable, even in business contexts. The longer duration reflects the practical needs of business continuity and reduces unnecessary administrative burden, while maintaining the requirement that consent be voluntary, informed, current and specific.

2.18          The distinction between personal and business-related consent is proportionate and reasonable, recognising the different operational needs while maintaining robust privacy safeguards. By setting clear, time-limited parameters for consent validity in both contexts, the Amendment Rules maintain privacy protections and prevent indefinite use of personal information.

2.19          Schedule 2 to the Amendment Rules is compatible with human rights, because any limitations arising from the measure are reasonable and proportionate to its legitimate aim of protecting individuals’ personal information while supporting practical service delivery.

2.20          Schedule 3 to the Amendment Rules extends by 12 months the period within which transitioned accredited entities must comply with rule 5.7 and subrule 5.9(2), which set out obligations relating to digital ID suspension and resumption. As a result of this amendment, rule 5.7 and subrule 5.9(2) will apply to transitioned accredited entities on and after 30 November 2026.

2.21          Schedule 3 to the Amendment Rules engages prohibition from arbitrary or unlawful interference with privacy contained in Article 17 of the International Covenant on Civil and Political Rights (ICCPR) as they relate to an individual’s ability to temporarily suspend and resume the use of their digital identity.

2.22          Schedule 3 to the Amendment Rules extends the period for transitioned accredited entities to comply with obligations relating to the suspension and resumption of digital IDs in rule 5.7 and subrule 5.9(2) by 12 months so these obligations apply on and after 30 November 2026.

2.23          The effect of the amendments is to defer, but not remove, the application of obligations on transitioned accredited entities to allow for an individual to suspend and resume their digital ID upon request.

2.24          The amendments do not affect an individual’s ability to deactivate their digital ID under section 29 of the Digital ID Act, or the requirement on an Identity Service Provider to suspend the use of a digital ID where it is affected by a fraud or cyber security incident.

2.25          These amendments are compatible with the right to protection from unlawful or arbitrary interference with privacy by retaining the choice each individual has to deactivate their digital ID and the requirement for entities to take action appropriately where an individual’s privacy could be compromised by an incident under rule 5.8.

2.26          The 12 month extension is a proportionate and reasonable measure. It responds to operational and technical challenges identified by transitioned accredited entities, ensuring that suspension and resumption processes are implemented securely and effectively, and reducing the risk of technical or operational failures that could otherwise undermine an individual’s ability to exercise control over their digital identity. This supports the integrity of the system.

2.27          Schedule 3 to the Amendment Rules is compatible with human rights, and any limitations arising from providing entities a further 12 months to comply are reasonable, necessary and proportionate to ensure those obligations are implemented securely and effectively.