Policy Briefing — Australia’s Digital ID Act Receives Royal Assent

Executive briefing: The Digital ID Act 2024 (No. 45, 2024) received Royal Assent on 22 May 2024, giving Australia’s Government Digital ID System a legislative footing. The Act designates a Digital ID Regulator, builds an accreditation and licensing scheme for providers, and hard-codes privacy and biometric safeguards that complement the Privacy Act 1988. Staged commencements begin within six months, so participating agencies and accredited private-sector providers must publish conformance roadmaps before the regime opens to voluntary use.

Key obligations

Accreditation and participation controls. Identity services must satisfy assurance, security, fraud mitigation, and operational resilience benchmarks before the Digital ID Regulator issues accreditation or participation authorisations.
Privacy and biometric safeguards. Part 5 restricts collection, use, and disclosure of personal and biometric information to defined purposes, mandates prompt destruction of biometric samples, and prohibits secondary use without explicit statutory gateways.
Regulator oversight. The Act empowers the Digital ID Regulator (initially the Australian Competition and Consumer Commission) to issue binding rules, conduct investigations, suspend accreditation, and publish infringement notices for systemic non-compliance.

Implementation timeline

Early commencement. Core governance provisions commence within six months of Royal Assent, activating rule-making powers and audit rights for the regulator.
Full scheme launch. Accreditation, licensing, and privacy safeguard obligations commence by 2025 once the Digital ID rules are registered—organisations must complete internal readiness assessments before applying.
Transitional arrangements. The companion Digital ID (Transitional and Consequential Provisions) Act 2024 migrates existing Trusted Digital Identity Framework accreditations and grants enforcement continuity.

Program actions

Risk management. Stand up cross-functional working groups (privacy, cyber, fraud, legal) to map Act requirements against ISO/IEC 18013, NIST 800-63, and existing TDIF controls.
Evidence packs. Document biometric handling, consent flows, and incident response playbooks now so accreditation audits can reuse artefacts without rework.
Stakeholder alignment. Coordinate with the Office of the Australian Information Commissioner on privacy impact assessments and rehearse regulator engagement protocols before applications open.

Sources

Zeph Tech is guiding agencies and providers through Digital ID accreditation, privacy safeguard implementation, and regulator readiness assessments.