Every legal requirement, date and compliance claim traces to a primary source.

What counts as a source

Legal requirements, dates and compliance claims are grounded in primary or official sources only: the legislation registers (legislation.gov.au, legislation.govt.nz), the regulators (the OAIC and the Office of the Privacy Commissioner, Home Affairs, the Cyber and Infrastructure Security Centre, DPMC, the GCSB and the NCSC), and the standards and framework bodies (the ACSC, ISO/IEC, Standards Australia and Standards New Zealand). Law-firm articles, vendor pages and news are useful for orientation but are never the source a date or an obligation rests on. Community sources — forums and discussion threads — appear in some guides, but only to document the real-world questions, experiences and concerns businesses raise; they are never the basis for a requirement, a date or a compliance claim.

VERIFIED and INFERRED

Every claim carries one of two labels, and we show it:

• VERIFIED — the statement is directly supported by the official source cited, in its own words. 1,497 of 1,826 claims are verified.
• INFERRED — the statement is a reasonable reading of sourced material, but the source does not state it in exactly those terms, or the timing is imprecise. 329 claims are inferred. We label these so you can weigh them, not hide them.

The same discipline applies to the 108 tracked regulatory changes: 107 are verified against a primary source, and where an exact date could not be confirmed on an official source we leave it out rather than estimate it.

How a fact gets onto the site

1. Research against the official sources for that topic and jurisdiction.
2. Re-check — each date and claim is opened again on the source it came from and confirmed before it is published.
3. Independent re-check — the regulatory change data has additionally been re-checked against the primary and official sources by a separate review, with corrections applied (see the audit trail below).
4. Correct in the open — when a source says something different, we change the record and note it here. Unverifiable items are dropped, not guessed.

Reviewed, versus changed

These are two different dates and we keep them apart. Reviewed is when we last checked a guide against its sources. Source last amended is when the underlying law or framework itself last moved. On every law and framework guide you will also find a What's changing timeline: the dated history of that instrument and any officially-scheduled next change, each entry linked to its official source. Where nothing is officially scheduled, we say so, rather than imply a change is coming.

Audit trail

A dated record of what has been researched, checked and corrected. Guides were reviewed between 2026-07-12 and 2026-10-29.

1. 12 July 2026

   Guide corpus researched and published

   The 44 guides (22 Australian, 22 New Zealand) were built from 1,629 individually sourced claims across 440 questions. Every claim was labelled VERIFIED or INFERRED and linked to a source.

2. 15 July 2026

   Regulatory change tracking added

   For every law and framework guide, dated change events (amendments, commencements, guidance updates and officially-scheduled future changes) were researched from official sources and each date re-checked against the source it came from before being included. 71 events across 17 guides.

3. 15 July 2026

   Independent source re-check of the change events

   The change events were independently re-checked against the primary and official sources. The majority were confirmed as recorded; a number were corrected — mostly reclassifying a registration or compilation date to the date the law actually changed — and further sourced events were added. The change set now stands at 83 events across 18 guides, 82 verified against a primary source.

4. 16 July 2026

   Glossary published

   64 security, privacy and compliance terms used across the guides defined in plain English — tagged Australia, New Zealand or both, with statutory terms linked to their official source and each term cross-linked to the guides that use it. Guide pages also link terms inline — dotted-underlined, first occurrence only — with a hover definition and a jump to the glossary.

5. 16 July 2026

   Articles section launched

   Three launch articles published, every date and obligation drawn from the verified change events and cited to its official source: the two 10 December 2026 Privacy Act deadlines (AU), the Biometric Code transition ending 3 August 2026 (NZ), and the Cyber Security Act 2024 obligations now in force (AU).

6. 8 October 2026

   Change-timeline refresh against official sources

   Twelve new or re-classified change events, each confirmed against the regulator's own page: the NZ Biometric Code transition is recorded as ended (3 August 2026); the AU tranche 2 privacy exposure draft (31 August 2026, consultation closed 18 September); ASD's Essential Eight → Essentials consultation (closed 12 July 2026, no successor published); Home Affairs' second-tranche SOCI consultation (closed 31 July 2026); the NZISM v3.9 November 2025 release; and the OAIC's final APP 1.7–1.9 automated decision-making guidance (30 September 2026). SMB1001:2027 was then confirmed on DSI's own licence and programme pages: version 1.0 published 1 September 2026 in early access and labelled "Pre-release", generally available from 1 January 2027 — recorded as a change event with the 2026 edition kept as the generally available one, and the Gold/Platinum/Diamond and email-authentication changes attributed to licensed holders' comparisons. Following an external review, site copy was also corrected: the About page said "22 templates each" (it is 22 guides, five downloadable templates); the methodology page now states that community sources document questions and concerns only; and the starter-pack updates opt-in is a separate, optional checkbox.

7. 8 October 2026

   Responsible AI Use Policy added; starter packs grow to seven templates

   Two new policy guides — Responsible AI Use Policy for Australia and for New Zealand — join the library and the free starter packs as editable templates, built from the regulators' own AI guidance (OAIC commercial-AI guidance and the 30 September 2026 APP 1.7–1.9 materials; the Privacy Commissioner's generative-AI expectations and IPP guidance; ASD and NCSC 'Engaging with AI'). Remote Work and BYOD is promoted from guide to template in both countries. Five existing templates gained clauses that are good practice now and line up with the changes licensed holders report in SMB1001:2027: an exercised incident/breach plan, phishing-resistant MFA for privileged accounts, an asset register covering physical as well as IT assets, end-of-life systems replaced or formally risk-accepted, and mobile-device-management enrolment. Every SMB1001:2027 reference stays attributed to licensed-holder reports until DSI publishes the text on 1 January 2027. All 106 framework-map rows re-verified against ISO/IEC 27001:2022 Annex A.

8. 23 October 2026

   Guide library search you can link to

   Searches on the guide library now carry into the page address (/guides/?q=…), so a search can be bookmarked or shared. A search that finds nothing points to the glossary and the starter pack, with a button to clear the filters. The not-found page now has a search box that hands off to the library. Searches are counted, without cookies, by the same first-party analytics as the rest of the site.

9. 26 October 2026

   Article: website analytics without cookies; analytics named on the cookie and privacy pages

   A new article on what the Privacy Act asks of a website's analytics, prompted by the OAIC's June 2026 tracking-pixel findings: the problem is rarely counting visitors, it is handing the count to a third party nobody disclosed. It sets out three design choices that answer it, including where tag-manager containers fit. The cookie policy and privacy policy now name the analytics tool this site uses (Matomo, self-hosted, served from this domain with cookies switched off) and say what it records.

10. 26 October 2026

    Starter-pack download: optional box fixed, reworded and matched in the privacy policy

    Correction: until 26 October 2026, ticking the optional box on the download form was not recorded, so nobody who downloaded before then is on file as having opted in, and none of them will be emailed on that basis. The tick is now recorded. The box now covers two things: an email if a template you downloaded changes materially, and one follow-up a few weeks later with a free way to check the policy is being followed. The privacy policy describes the same two uses. It also no longer says every email carries an unsubscribe link: the email with your download link is a one-off, the optional emails each carry one, and replying "unsubscribe" to any email works. On 27 October the form was changed to hand over the pack even when the server behind it fails.

11. 27 October 2026

    Two Australian guides: invoice and payment fraud policy, and digital asset register

    Two new Australian policy guides cover gaps against SMB1001. The invoice and payment fraud policy covers verifying bank-detail changes by call-back, dual approval, red flags, and what to do if money goes. The digital asset register covers what to include, the minimum fields, keeping it current, and how it supports patching and breach response. They were built from 99 newly sourced claims (83 VERIFIED, 16 INFERRED), each checked against its live source, and both are mapped to ISO/IEC 27001:2022 Annex A. The Australian library now holds 25 guides and New Zealand 23. Neither has a New Zealand version yet, and neither is in the free starter pack.

12. 29 October 2026

    Eight guides re-reviewed against later source changes

    Eight guides listed a source change dated after their own review date: the October timeline refresh recorded the change but the guide was not re-reviewed. Each was re-read against the regulator's current page and its review date moved to 29 October 2026. Answers now cover the Biometric Processing Privacy Code applying to all biometric processing since 3 August 2026 (NZ Privacy Act 2020, NZ AI and client data), the APP 1.7–1.9 automated decision-making privacy-policy obligation from 10 December 2026 (AU AI and client data), the SMB1001:2027 early-access release (choosing a framework) and the proposed second tranche of SOCI Act reforms, which closed for consultation on 31 July 2026 and has no Bill yet (SOCI Act). Status lines were re-checked and re-dated: neither the privacy tranche 2 Bill nor a SOCI amending Bill had been introduced, and the Children's Online Privacy Code was not yet registered. The SOCI consultation's close date is now recorded to the day from the consultation paper. No text change was needed for SMB1001, and CyberCert's listed prices were unchanged.

13. 30 October 2026

    Invoice fraud policy and digital asset register added to the Australian starter pack

    Correction: from 27 October the invoice and payment fraud policy and digital asset register guide pages offered their templates as part of the free starter pack, but the Australian pack did not contain them. Both are now in it, so the Australian pack holds nine editable Word templates and the New Zealand pack seven. Three other policy guides (incident response policy, in both countries, and the security policy adoption, training and review guide) also described themselves as starter-pack templates without being in the pack; their pages now say the model clauses are on the page and the template is not in the pack yet. Pages can no longer offer a template the pack does not contain.