Plain-English guidance on Australian data sovereignty, email security laws, Privacy Act compliance, and ASD Essential Eight — written by our security team.
The Privacy Act 1988 imposes specific, enforceable obligations on most Australian businesses. With penalties now reaching $50 million, many SMEs are unknowingly exposed. This is the complete guide to what you must do and what happens if you don't.
When you use Gmail, Outlook, or most global email providers, your emails are stored on overseas servers. For Australian businesses handling client data, this is a serious legal and competitive risk most owners don't know about.
Australia's legal landscape around email security has expanded dramatically. From the NDB scheme to the 2024 Privacy Act reforms, here's a plain-English guide to every law Australian businesses must know.
A definitive 47-point checklist covering every Australian email compliance requirement — Privacy Act 1988, NDB scheme, ASD Essential Eight, DMARC enforcement, and data sovereignty obligations. Use this as your annual compliance audit framework.
ASD Essential Eight Maturity Level 3 is increasingly a prerequisite for Australian government work. Here's what it means for your email systems, which ISM controls apply, and what to look for in a compliant email provider.
Healthcare reported 104 NDB notifications in a single quarter. Finance reported 63. The majority were email-related. Here's exactly what triggers notification, what the 30-day clock means, and what happens if you miss it.
The ACMA issues infringement notices of up to $2.78 million per day for Spam Act violations. Most Australian businesses are non-compliant in at least one respect — usually the consent record-keeping or unsubscribe mechanism.
Every email you send through Gmail or Microsoft 365 is a potential APP 8 breach. Here's the legal reality behind Australia's most misunderstood privacy principle — and a practical compliance path.
If you have a single EU customer, employee, or website visitor, the GDPR may apply to your Australian business. Here is exactly where the two frameworks overlap, where they differ, and how to satisfy both with one email strategy.
CPS 234 holds APRA-regulated boards personally accountable for information security. Email is explicitly in scope. Here is the control framework and how to satisfy the board-level assurance requirements.
Most Australian healthcare providers know about My Health Records. Far fewer know that the Act creates specific email security obligations — including requirements that are effectively incompatible with Gmail and Microsoft 365.
Australia's AUKUS obligations are driving the most significant overhaul of defence contractor security requirements in a generation. Email is ground zero for compliance gaps — here is exactly what's required.
A tax audit can request emails from 5 years ago. A court subpoena can demand emails from 7 years ago. A healthcare complaint can reach back even further. Here are the exact Australian email retention requirements by industry.
Australian-hosted email, military-grade encryption, zero data offshore. Start free — no credit card required.
Create Your Free Account