Free business resources · Australia
Australia’s digital reforms: a business website guide
The Digital Duty of Care Bill was introduced on 15 October 2026. This guide, reviewed on 17 October 2026, does not treat the proposal as law. Other digital reforms have their own status and scope.
A useful website should help people feel informed, confident and safe. Australia’s digital reforms make this a good time to look at the features you offer, the information you collect and how you respond when something goes wrong.
Your website risk worksheet
Map features, people, evidence and the next action. Download a blank working copy.
02 · Understand the limitsWhere AI can help
What an assisted assessment and emailed report could do, and what needs a person.
03 · Go to the sourceOfficial documents
Government links, dates, proposal status and reuse information in one place.
Ten reforms, with their status kept separate
The list below combines several initiatives. They do not share one legal status, commencement date or business scope.
- 01
A proactive online-safety duty
Proposed: covered providers would take reasonable steps to reduce serious online harm.
Official source ↗ - 02
Choice over recommended feeds
Proposed social-media rules would give users more choice over algorithmic recommendations.
Official source ↗ - 03
Additional protection for children
The proposed duty addresses harmful material, conduct and features affecting under-18s.
Official source ↗ - 04
Stronger removal and complaint powers
The proposal includes nudify-service removal powers and a 24-hour response period for certain abuse complaints.
Official source ↗ - 05
Significant potential penalties
The announced maximum penalty is A$109.2 million if the legislation passes; it is not a standard fine for every website.
Official source ↗ - 06
Fair and reasonable use of information
Separate privacy proposals address consent and whether personal-information handling is fair and reasonable.
Official source ↗ - 07
Requests to erase personal information
A proposed erasure right would apply to large digital platforms. It is not yet a universal new deletion rule for every website.
Official source ↗ - 08
Controls on personal-information trading
The privacy proposals also target trading personal information without clear permission.
Official source ↗ - 09
A wider Digital ID system
Private-sector participation is planned to expand from December 2026. Digital ID remains voluntary for individuals. Read the expansion announcement ↗
Official source ↗ - 10
More connected government services
The myGov roadmap aims to improve access and coordination across government services.
Official source ↗
What does this mean for a small business?
A brochure site, an online shop and a service with public comments, messaging or an AI companion can create very different risks. Business size alone does not tell you how an online-safety duty would apply. A risk review should start with your actual service and users, then confirm the applicable law.
The Privacy Act currently generally exempts businesses with annual turnover of A$3 million or less, but exceptions include certain health services and businesses trading personal information. That privacy test is separate from the proposed Digital Duty of Care. Check the OAIC’s coverage guidance ↗
Useful action while the law develops
- Keep an inventory of website features, suppliers and the people likely to use them.
- Make reporting a problem straightforward, with a person responsible for responding.
- Review form fields, access permissions and how long you keep information.
- Record risks, evidence, gaps and planned improvements in the worksheet.
- Revisit the official sources before launch, when features change and when legislation progresses.
These are practical preparation steps, not a declaration that a particular law applies or that your site complies.
Three distinctions that matter
Online safety, privacy and cyber security overlap but are different. A vulnerability scan cannot assess every risk from content, messaging, recommendations or business processes.
Under-18 safety and social-media age restrictions are separate. Do not treat the proposed duty or the Children’s Online Privacy Code as the same rule as social-media account restrictions. Follow the code’s development ↗
Guidance is not certification. Neither this guide nor a generated report is government approval. Get qualified advice when deciding legal applicability or addressing a serious risk.