Government & Public Services Compliance in Australia

Australia is open to digital identity providers, but the trusted government network is still being phased in. As at 2 November 2026 all 40 entities on the AGDIS register are public bodies; private relying parties and private identity providers can apply from 1 December 2026. Outside AGDIS, private providers may seek accreditation voluntarily and are then bound by the same privacy and biometric safeguards; three private companies held accreditation at that date. State and territory agencies add their own identity schemes and privacy laws, which differ markedly between jurisdictions.

The principal regulators are the Australian Competition and Consumer Commission (ACCC), acting as Digital ID Regulator, and the Office of the Australian Information Commissioner (OAIC), which enforces the privacy safeguards. The Attorney-General's Department runs the separate Document and Face Verification Services that most remote proofing relies on.

The biggest obstacle for a new entrant is the accreditation burden: protective security, fraud control, privacy impact assessment, accessibility testing and, for biometric binding, independent laboratory testing of presentation attack detection before the regulator will accredit.

1. Who regulates this sector

Digital identity is governed at the Commonwealth level: the Digital ID Act 2024 names the regulator and system operator (ss 90 and 94), and the Identity Verification Services Act 2023 governs the government document and face matching services.

myID is administered by the Australian Taxation Office (ATO) and is accredited under s 15 of the Digital ID Act. State and territory departments, and companies they own, may join AGDIS under the Phasing-in Determination 2024; they also issue the driver licences and other documents that the DVS checks.

State and territory layer

State and territory agencies follow their own identity schemes and privacy laws, which differ materially. Victoria has its own four-level assurance framework (LOA1 to LOA4); New South Wales is piloting a Digital ID at IP3; digital driver licences have legal footing in New South Wales, Victoria, Queensland and South Australia only. Agencies in every jurisdiction act as AGDIS relying parties. For DVS and FVS access, the IVS Rules 2024 recognise every state privacy law except those of Western Australia and South Australia, whose agencies must agree to the Australian Privacy Principles instead. Tax file number breaches by any state agency are notifiable to the OAIC (Privacy Act 1988 ss 11 and 26WE(1)(d)).

2. Licensing and authorisation

Accreditation [In force]

Under s 14 of the Digital ID Act 2024 (Compilation No. 2, 21 February 2025), Australian bodies corporate, registered foreign companies, Commonwealth entities and state or territory departments may apply to the ACCC for accreditation as an identity service provider (ISP), attribute service provider or identity exchange provider. Accreditation is voluntary unless the provider wants to operate inside AGDIS. Applicants must meet the Digital ID (Accreditation) Rules 2024 (Compilation No. 1, 19 November 2025), which require a privacy impact assessment, protective security and fraud control capabilities, penetration testing, useability and accessibility (WCAG) testing, and an assessor's report. Accredited entities then file annual reports and repeat testing. The ACCC register lists five accredited entities as at 2 November 2026: the Commissioner of Taxation (myID), Services Australia, ConnectID Pty Ltd, Makesure Consulting Pty Ltd and OCR Labs Pty Ltd (IDVerse). Holding out that an entity is accredited when it is not carries a civil penalty of 1,000 penalty units (s 31).

Approval to participate in AGDIS

Section 59 allows an entity to provide or receive services within AGDIS only if it holds an approval under s 62 and its participation start day has arrived. A relying party must be an Australian entity or a registered foreign company; identity and attribute providers must also be accredited. Operating in the system without meeting these conditions attracts 1,000 penalty units.

Section 61 controls who may apply. Commonwealth relying parties and accredited non-corporate Commonwealth entities may apply now; state and territory bodies are admitted by the Phasing-in Determination 2024 (F2024L01437), made under s 60. Any accredited entity, accreditation applicant, Australian relying party or registered foreign company may apply once more than two years have passed since the Act commenced on 30 November 2024, that is from 1 December 2026 (s 61(d)) [Adopted, effective 1 Dec 2026]. The Minister for Finance announced on 26 June 2026 that higher-risk government services will not accept private provider Digital IDs and that business relying parties will pay from 1 January 2027 at the latest.

Government verification services

Access to the DVS and FVS requires a participation agreement under the IVS Act 2023 (Compilation No. 1, 11 December 2024). Businesses reach the DVS only through an approved gateway service provider, which sets its own charges. The Attorney-General's Department's agreements register lists 2,431 agreements in force (2,266 private sector); only two are face matching agreements, both with Commonwealth agencies (the ATO and the Department of Foreign Affairs and Trade).

3. Identity framework (AML rules do not apply)

Public bodies delivering public services are not reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Compilation No. 63, 1 October 2026), because the Act applies to persons providing the financial, bullion, gambling, real estate, professional and prescribed "designated services" listed in s 6.

Identity in this sector is governed instead by three layers:

Digital ID Act 2024

Accreditation, AGDIS participation, extra privacy safeguards, voluntary use and redress.

Accreditation Rules and Data Standards

Proofing levels, biometric binding, authenticators and biometric testing.

IVS Act 2023

Consent and privacy conditions for DVS and FVS checks.

4. Identity verification and onboarding

Identity proofing levels

Rule 5.10 of the Accreditation Rules sets six identity proofing (IP) levels: IP1, IP1 Plus, IP2, IP2 Plus, IP3 and IP4. Every level above IP1 requires uniqueness checks, checks against known fraudulent identities, and verification of name and date of birth only by source verification (with the issuer or a service such as the DVS) or technical verification (public key cryptography). The main steps up:

An Australian passport can satisfy both the commencement-of-identity and photo ID requirements at IP3, but only one of them at IP4 (rule 5.11). Technical verification of an Australian passport or foreign ePassport must follow ICAO Doc 9303 and check the issuer's certificate revocation list (rule 5.12). A foreign passport used for biometric binding must first be linked to a source-verified visa (rule 5.16). An ISP must not create a Digital ID for anyone under 15 (rule 5.2).

How myID applies the levels

myID, the Australian Government's Digital ID app, presents three identity strengths: Basic, Standard and Strong. Strong requires at least two verified documents and a verified photo, matched to an Australian passport (or, in combination with other documents, a Western Australian driver licence). Each government online service sets its own minimum; the myID service list shows Standard for myGov, Centrelink and director ID, and Strong for a tax file number application.

Reliance on government verification services

The DVS returns only a match or no-match result against issuer records, and the FVS (one-to-one face matching) returns only a match result to non-government users; facial images are never sent to them (IVS Act ss 15 and 19). Each check needs the individual's express consent under the participation agreement (s 9), and the DVS should not be the sole basis for a decision to provide a service. In 2024-25 the DVS was used 133,140,077 times by 2,228 entities, 2,109 of them private sector; the FVS was used by one government agency only.

5. Digital channels: what's different

Bottom line: the privacy and biometric safeguards are channel-neutral, but online biometric binding carries extra technical duties (single session, liveness, independently tested presentation attack detection), and the highest level, IP4, is available only in person.

Online biometric binding

Rule 5.17 requires online binding to capture an image, apply an image quality profile informed by ISO/IEC 29794-5, and run technical, source or (at IP2 Plus only) eIDVT matching. The whole process must run in a single continuous workflow, with liveness detection as part of presentation attack detection (PAD) at the point of capture, using technology that meets ISO/IEC 30107-1.

Document authenticity checks from a phone camera

Biometric matching through electronic identity document verification technology (eIDVT), permitted only at IP2 Plus, may use only a driver licence, a state or territory proof-of-age card or an Australian passport physically presented to a camera. Rule 5.20 requires document liveness testing, checks of at least five security features, at least 300 dpi, at most five attempts, no manual review and immediate destruction of the images.

Testing standard

Under s 2.3 of the Digital ID (Accreditation) Data Standards 2024, PAD for online binding must be tested by an independent laboratory with at least six low-effort and six moderate-effort attack types and ten test subjects, and an attack presentation classification error rate (APCER) of 0%.

Voluntary use

Section 74 bars participating relying parties from requiring a Digital ID; the alternative must be reasonably accessible and not substantially less favourable. Private relying parties may seek an exemption, for example if they operate solely online; Commonwealth entities, Commonwealth companies and agencies under the Freedom of Information Act 1982 cannot (s 74(6)).

6. Data protection and biometrics

The Privacy Act 1988 applies to agencies and most businesses; the Digital ID Act adds safeguards for accredited entities, some of which consent cannot override.

• Biometrics (ss 48 to 51). Collection only with express consent, only to verify identity or authenticate the user, and only if the accreditation conditions authorise it. One-to-many matching, and using biometrics to detect multiple Digital IDs, are prohibited. Data collected only to verify identity must be destroyed immediately after verification; testing and fraud-investigation copies within 14 days at most.
• Prohibited attributes (s 44). Providers must not collect information about racial or ethnic origin, political or religious views, philosophical beliefs or sexual orientation.
• No profiling (s 53). Information about which services a person accessed, how or when, cannot be used or disclosed even with consent, except for system performance, compliance with the Act or as required by law.
• Records. AGDIS identity and attribute providers keep prescribed records for three years from creation or last use, whichever is later (Digital ID Rules 2024, rule 6.2).

FVS users must destroy facial images created for a request once no longer needed (IVS Act s 10). For state agencies, the state privacy law in section 1 applies instead of the Privacy Act. The OAIC's guide on facial recognition (updated 29 July 2026) confirms that biometric templates and facial images used for automated verification are sensitive information and recommends a privacy impact assessment before deployment.

7. Sector-specific obligations

Incident reporting

Entities in AGDIS must notify cyber security and Digital ID fraud incidents to the System Administrator as soon as practicable and no later than one business day after becoming aware or suspecting one; an oral notice must be confirmed in writing within three business days (Digital ID Rules 2024, rule 4.2).

Redress for affected users

Chapter 4A of the Digital ID Rules requires AGDIS identity and attribute providers to make reasonable attempts to notify each individual affected by an incident and to give information, support and assistance. Since 30 September 2026 the System Administrator may also direct a provider to apologise or explain, and recommend compensation.

Accessibility and inclusion

Accredited entities must take reasonable steps to make services accessible to people facing barriers (s 30). Where its accreditation conditions allow, an ISP may use an alternative proofing process, such as other credentials or a verified trusted referee (rule 5.23).

8. Risk indicators and red flags

Identity fraud indicators in remote proofing

• Presentation attacks: printed photos, screen replays or masks presented to the camera instead of a live face.
• Second-generation document images: photos of a screen or photocopy, or previously captured images, submitted as an original ID.
• Duplicate identities: the same person or the same documents used to create more than one Digital ID.
• Deceased-person identities: credentials of a deceased individual (check mandatory from IP3).
• Name or date of birth variance: details that differ across documents without a linking credential.
• Unlinked foreign passports: a foreign passport not tied to a verified visa.
• Cancelled passports: an ePassport listed on the issuer's certificate revocation list.
• Repeated attempts: more than five eIDVT attempts to authenticate the same photo ID.

9. Enforcement and penalties

The Digital ID Act is enforced through civil penalties, infringement notices, enforceable undertakings, directions and suspension or revocation of accreditation; the ACCC applies for most penalties and the Information Commissioner for the privacy safeguards (s 123). Penalties are set per contravention in penalty units, and a court may order a body corporate to pay up to five times the stated amount (Regulatory Powers (Standard Provisions) Act 2014, s 82(5)). The Commonwealth penalty unit, indexed under s 4AA of the Crimes Act 1914, is $364 from 1 July 2026 (previously $330); the dollar figures below use $364.

The ACCC's first Digital ID Regulator annual report (period to 30 June 2025) records 19 investigations commenced, four closed and three matters resolved administratively; two of these required relying parties to restore a reasonably accessible non-Digital ID route under s 74. The System Administrator received 194 fraud incident notifications affecting 763 Digital IDs. As at November 2026 the Federal Court had published no judgment under the Digital ID Act or the IVS Act.

Oversight of the government verification services runs through the OAIC's annual assessments under s 40 of the IVS Act. Its first report (20 December 2024) found the FVS managed in line with privacy requirements apart from two medium-risk gaps, and made two recommendations.

10. Recent changes and what to watch

• 1 January 2027, Western Australia breach scheme[Adopted, effective 1 Jan 2027]: WA public entities must notify notifiable information breaches under the Privacy and Responsible Information Sharing Act 2024.
• 10 December 2026, automated decision disclosures[Adopted, effective 10 Dec 2026]: privacy policies must explain where computer programs make or substantially inform significant decisions, which can include automated identity checks.
• 1 December 2026, AGDIS opens to private applicants[Adopted, effective 1 Dec 2026]: businesses and accredited private providers can apply under s 61(d); business charges start by 1 January 2027.
• 15 October 2026, Service Victoria standards version 7[In force]: revised Victorian identity verification standards (LOA1 to LOA4).
• 30 September 2026, Redress Framework Rules 2026[In force]: tighter user notification duties and System Administrator powers to direct apologies and recommend compensation.
• 29 July 2026, OAIC facial recognition guide[Published guidance]: updated consent, necessity and privacy impact assessment guidance.
• 1 July 2026, penalty unit, incident policies and WA privacy principles[In force]: the penalty unit rose to $364, AGDIS incident and complaint policy duties began, and WA's information privacy principles took effect.

11. What this means for identity verification

• Design to a named level. Map each service to an IP and authenticator level; claiming a higher level's equivalence is not permitted.
• Source or cryptographic verification. Name and date of birth must be verified with the issuer (DVS) or by ePassport chip, not by optical reading alone, at every level above IP1.
• Liveness for remote binding. Capture, quality scoring, liveness and PAD in one session, backed by an ISO/IEC 30107-3 test report.
• One-to-one only. Duplicate detection by face search is prohibited for accredited entities.
• Zero retention by default. Destroy biometric data and processed document images immediately after the check, keeping only fraud or testing copies for up to 14 days where the rules allow.
• Keep a non-digital route. Commonwealth services in AGDIS cannot be exempted from offering an accessible alternative.