Identity Protection and Recovery Act 2025

This Act is the Identity Protection and Recovery Act 2025.

This Act commences on the date of assent to this Act.

The objects of this Act are as follows—

to enable the Secretary to—

carry out and facilitate the protection and recovery of personal information of individuals from personal data compromises, and

facilitate the remediation of compromised personal information of individuals, and

carry out and facilitate the protection of organisations from personal data compromises, and

adopt and recommend best practice standards in the protection and recovery of personal information,

to permit the collection, holding, use and disclosure of information for the purpose of protecting organisations and the personal information of individuals from personal data compromises.

The dictionary in Schedule 4 defines words used in this Act.

Note—

The Interpretation Act 1987 contains definitions and other provisions that affect the interpretation and application of this Act.

In this Act, compromised, in relation to personal information, means personal information known or suspected to have been—

used, accessed, disclosed or lost unlawfully or without authorisation, or

lost or disclosed unintentionally.

In this Act, identity document means the following—

a document specified in Schedule 1,

Examples—

driver licence birth certificate

medicare card

a DVS document within the meaning of the Identity Verification Services Act 2023 of the Commonwealth that is not otherwise specified in Schedule 1,

another document that is—

issued by a government to an individual containing personal information relating to the individual, and

prescribed by the regulations.

A reference in this Act to an identity document includes information in relation to an individual—

contained in an identity document related to the individual, or

associated, or reasonably expected to be associated, with an identity document related to the individual.

In this Act, a personal data compromise means a known or suspected—

unauthorised or unlawful use, access, disclosure or loss of personal information, or

unintentional disclosure or loss of personal information.

This Act binds the Crown in right of New South Wales and, to the extent the legislative power of the Parliament of New South Wales permits, the Crown in all its other capacities.

The Secretary has the following functions (identity protection functions)—

identity protection and recovery functions,

identity fraud control functions,

another function specified to be an identity protection function by this Act or another Act.

The Secretary must not exercise an identity protection function unless—

in accordance with this Act, and

consistent with the objects of this Act.

The identity protection and recovery functions are as follows—

to advise on and recommend actions—

to detect, prevent and mitigate the likelihood of personal data compromises, and

to mitigate the risk of harm to individuals and impacted individuals in relation to personal data compromises,

to increase resilience and protection of persons from personal data compromises, including by advising on the appropriate kind and use of information technology,

in response to a personal data compromise—

to advise on and recommend actions to take, including to replace or reissue identity documents and other actions to protect and recover personal information, and

to advise on and assess the risk of harm to impacted individuals, and

to notify and disclose information to impacted individuals and other persons, including to assist persons in notifying impacted individuals,

other functions prescribed by the regulations.

The identity fraud control functions are as follows—

to advise on and recommend actions for the detection, prevention and mitigation of the likelihood of identity fraud,

to establish and keep the compromised ID register,

to disclose information on the compromised ID register to certain persons,

to determine and disclose information about the life status of individuals to certain persons,

other functions prescribed by the regulations.

The Secretary must not exercise an identity protection function unless the exercise of the function is—

at the request of the following—

a person who the Secretary is satisfied is, or may be, affected by a personal data compromise,

a law enforcement agency,

a fraud check user, or

in response to the following—

a personal data compromise for which the source of the personal data cannot reasonably be determined,

compromised personal data made available on the internet, whether on the clear or dark web, or

to establish, keep and disclose information on and in relation to the compromised ID register, or

to determine and disclose information about the life status of an individual, or

to advise on and recommend actions for the detection, prevention and mitigation of the likelihood of personal data compromises, or

in other circumstances prescribed by the regulations.