Changelog
What's changed, and when.
A dated record of what has been researched, checked, corrected and added across the guides, templates and regulatory data. Guides were last reviewed between 2026-07-12 and 2026-10-29. For how each fact is sourced and verified, see how we verify.
- 30 October 2026
Invoice fraud policy and digital asset register added to the Australian starter pack
Correction: from 27 October the invoice and payment fraud policy and digital asset register guide pages offered their templates as part of the free starter pack, but the Australian pack did not contain them. Both are now in it, so the Australian pack holds nine editable Word templates and the New Zealand pack seven. Three other policy guides (incident response policy, in both countries, and the security policy adoption, training and review guide) also described themselves as starter-pack templates without being in the pack; their pages now say the model clauses are on the page and the template is not in the pack yet. Pages can no longer offer a template the pack does not contain.
- 29 October 2026
Eight guides re-reviewed against later source changes
Eight guides listed a source change dated after their own review date: the October timeline refresh recorded the change but the guide was not re-reviewed. Each was re-read against the regulator's current page and its review date moved to 29 October 2026. Answers now cover the Biometric Processing Privacy Code applying to all biometric processing since 3 August 2026 (NZ Privacy Act 2020, NZ AI and client data), the APP 1.7–1.9 automated decision-making privacy-policy obligation from 10 December 2026 (AU AI and client data), the SMB1001:2027 early-access release (choosing a framework) and the proposed second tranche of SOCI Act reforms, which closed for consultation on 31 July 2026 and has no Bill yet (SOCI Act). Status lines were re-checked and re-dated: neither the privacy tranche 2 Bill nor a SOCI amending Bill had been introduced, and the Children's Online Privacy Code was not yet registered. The SOCI consultation's close date is now recorded to the day from the consultation paper. No text change was needed for SMB1001, and CyberCert's listed prices were unchanged.
- 27 October 2026
Two Australian guides: invoice and payment fraud policy, and digital asset register
Two new Australian policy guides cover gaps against SMB1001. The invoice and payment fraud policy covers verifying bank-detail changes by call-back, dual approval, red flags, and what to do if money goes. The digital asset register covers what to include, the minimum fields, keeping it current, and how it supports patching and breach response. They were built from 99 newly sourced claims (83 VERIFIED, 16 INFERRED), each checked against its live source, and both are mapped to ISO/IEC 27001:2022 Annex A. The Australian library now holds 25 guides and New Zealand 23. Neither has a New Zealand version yet, and neither is in the free starter pack.
- 26 October 2026
Starter-pack download: optional box fixed, reworded and matched in the privacy policy
Correction: until 26 October 2026, ticking the optional box on the download form was not recorded, so nobody who downloaded before then is on file as having opted in, and none of them will be emailed on that basis. The tick is now recorded. The box now covers two things: an email if a template you downloaded changes materially, and one follow-up a few weeks later with a free way to check the policy is being followed. The privacy policy describes the same two uses. It also no longer says every email carries an unsubscribe link: the email with your download link is a one-off, the optional emails each carry one, and replying "unsubscribe" to any email works. On 27 October the form was changed to hand over the pack even when the server behind it fails.
- 26 October 2026
Article: website analytics without cookies; analytics named on the cookie and privacy pages
A new article on what the Privacy Act asks of a website's analytics, prompted by the OAIC's June 2026 tracking-pixel findings: the problem is rarely counting visitors, it is handing the count to a third party nobody disclosed. It sets out three design choices that answer it, including where tag-manager containers fit. The cookie policy and privacy policy now name the analytics tool this site uses (Matomo, self-hosted, served from this domain with cookies switched off) and say what it records.
- 23 October 2026
Guide library search you can link to
Searches on the guide library now carry into the page address (/guides/?q=…), so a search can be bookmarked or shared. A search that finds nothing points to the glossary and the starter pack, with a button to clear the filters. The not-found page now has a search box that hands off to the library. Searches are counted, without cookies, by the same first-party analytics as the rest of the site.
- 8 October 2026
Responsible AI Use Policy added; starter packs grow to seven templates
Two new policy guides — Responsible AI Use Policy for Australia and for New Zealand — join the library and the free starter packs as editable templates, built from the regulators' own AI guidance (OAIC commercial-AI guidance and the 30 September 2026 APP 1.7–1.9 materials; the Privacy Commissioner's generative-AI expectations and IPP guidance; ASD and NCSC 'Engaging with AI'). Remote Work and BYOD is promoted from guide to template in both countries. Five existing templates gained clauses that are good practice now and line up with the changes licensed holders report in SMB1001:2027: an exercised incident/breach plan, phishing-resistant MFA for privileged accounts, an asset register covering physical as well as IT assets, end-of-life systems replaced or formally risk-accepted, and mobile-device-management enrolment. Every SMB1001:2027 reference stays attributed to licensed-holder reports until DSI publishes the text on 1 January 2027. All 106 framework-map rows re-verified against ISO/IEC 27001:2022 Annex A.
- 8 October 2026
Change-timeline refresh against official sources
Twelve new or re-classified change events, each confirmed against the regulator's own page: the NZ Biometric Code transition is recorded as ended (3 August 2026); the AU tranche 2 privacy exposure draft (31 August 2026, consultation closed 18 September); ASD's Essential Eight → Essentials consultation (closed 12 July 2026, no successor published); Home Affairs' second-tranche SOCI consultation (closed 31 July 2026); the NZISM v3.9 November 2025 release; and the OAIC's final APP 1.7–1.9 automated decision-making guidance (30 September 2026). SMB1001:2027 was then confirmed on DSI's own licence and programme pages: version 1.0 published 1 September 2026 in early access and labelled "Pre-release", generally available from 1 January 2027 — recorded as a change event with the 2026 edition kept as the generally available one, and the Gold/Platinum/Diamond and email-authentication changes attributed to licensed holders' comparisons. Following an external review, site copy was also corrected: the About page said "22 templates each" (it is 22 guides, five downloadable templates); the methodology page now states that community sources document questions and concerns only; and the starter-pack updates opt-in is a separate, optional checkbox.
- 16 July 2026
Articles section launched
Three launch articles published, every date and obligation drawn from the verified change events and cited to its official source: the two 10 December 2026 Privacy Act deadlines (AU), the Biometric Code transition ending 3 August 2026 (NZ), and the Cyber Security Act 2024 obligations now in force (AU).
- 16 July 2026
Glossary published
64 security, privacy and compliance terms used across the guides defined in plain English — tagged Australia, New Zealand or both, with statutory terms linked to their official source and each term cross-linked to the guides that use it. Guide pages also link terms inline — dotted-underlined, first occurrence only — with a hover definition and a jump to the glossary.
- 15 July 2026
Independent source re-check of the change events
The change events were independently re-checked against the primary and official sources. The majority were confirmed as recorded; a number were corrected — mostly reclassifying a registration or compilation date to the date the law actually changed — and further sourced events were added. The change set now stands at 83 events across 18 guides, 82 verified against a primary source.
- 15 July 2026
Regulatory change tracking added
For every law and framework guide, dated change events (amendments, commencements, guidance updates and officially-scheduled future changes) were researched from official sources and each date re-checked against the source it came from before being included. 71 events across 17 guides.
- 12 July 2026
Guide corpus researched and published
The 44 guides (22 Australian, 22 New Zealand) were built from 1,629 individually sourced claims across 440 questions. Every claim was labelled VERIFIED or INFERRED and linked to a source.