Free business resources · Australia
Australian digital safety reforms, explained for website owners
The Digital Duty of Care Bill was introduced on 15 October 2026. This guide, reviewed on 17 October 2026, does not treat the proposal as law. Other digital reforms have their own status and scope.
You do not need to turn a small business website into a legal textbook. Start by understanding what your site lets people do, where a visitor could be harmed and who will put things right. This guide gives you a practical starting point.
Your website risk worksheet
Map features, people, evidence and the next action. Download a blank working copy.
02 · Understand the limitsWhere AI can help
What an assisted assessment and emailed report could do, and what needs a person.
03 · Go to the sourceOfficial documents
Government links, dates, proposal status and reuse information in one place.
Ten reforms, with their status kept separate
The list below combines several initiatives. They do not share one legal status, commencement date or business scope.
- 01
A proactive online-safety duty
The proposal asks covered services to prevent serious harm, with safety considered in how the service works.
Official source ↗ - 02
Choice over recommended feeds
My Feed, My Way concerns social-media feed choices; it is not a requirement to add a feed to your business website.
Official source ↗ - 03
Additional protection for children
Services used by under-18s need particular attention in the proposed safety framework.
Official source ↗ - 04
Stronger removal and complaint powers
The Bill proposes stronger eSafety powers, including action against nudify services and faster responses for certain complaints.
Official source ↗ - 05
Significant potential penalties
A$109.2 million is the announced proposed maximum, not a bill that every small-business owner faces.
Official source ↗ - 06
Fair and reasonable use of information
Privacy reform proposals would strengthen consent and place further limits on collecting and using personal information.
Official source ↗ - 07
Requests to erase personal information
The announced deletion proposal focuses on large digital platforms. Check the final scope before assuming it applies to your site.
Official source ↗ - 08
Controls on personal-information trading
Proposed privacy changes would place stronger controls on trading information about people without their permission.
Official source ↗ - 09
A wider Digital ID system
Digital ID expansion is a separate programme. The government says use by individuals remains voluntary.
Official source ↗ - 10
More connected government services
The myGov roadmap concerns how people use government services. It does not itself create a website risk-assessment obligation.
Official source ↗
What does this mean for a small business?
Begin with the site you actually have. A hairdresser’s service pages raise different questions from a children’s community with profiles and private messages. Record the features you use, including third-party bookings, reviews and chat tools. A small turnover does not answer every online-safety question.
The Privacy Act currently generally exempts businesses with annual turnover of A$3 million or less, but exceptions include certain health services and businesses trading personal information. That privacy test is separate from the proposed Digital Duty of Care. Check the OAIC’s coverage guidance ↗
Useful action while the law develops
- Keep an inventory of website features, suppliers and the people likely to use them.
- Make reporting a problem straightforward, with a person responsible for responding.
- Review form fields, access permissions and how long you keep information.
- Record risks, evidence, gaps and planned improvements in the worksheet.
- Revisit the official sources before launch, when features change and when legislation progresses.
These are practical preparation steps, not a declaration that a particular law applies or that your site complies.
Three distinctions that matter
Online safety, privacy and cyber security overlap but are different. A vulnerability scan cannot assess every risk from content, messaging, recommendations or business processes.
Under-18 safety and social-media age restrictions are separate. Do not treat the proposed duty or the Children’s Online Privacy Code as the same rule as social-media account restrictions. Follow the code’s development ↗
Guidance is not certification. Neither this guide nor a generated report is government approval. Get qualified advice when deciding legal applicability or addressing a serious risk.