Resources · Regulatory watch: Australia and New Zealand
Regulatory watch: Australia and New Zealand
Compliance regulations in Australia in 2026, and New Zealand’s privacy law, in one place: where each rule stands today.
Where things stand
Three dates matter this year for privacy and prudential rules on both sides of the Tasman.
APRA’s targeted amendments to CPS 230 took effect on 1 July 2026, New Zealand’s IPP 3A on indirect collection commenced on 1 May 2026, and Australian privacy policies must describe significant automated decisions from 10 December 2026.
None of these rules comes with a certificate: regulators supervise them, and your evidence is what counts. Sterling’s consultants in Sydney help you build it, often on the ISO/IEC 27001 system you already run.
Regulations and schemes
Seven rules, each with its own guide and current status
Start with the rule your regulator or customers ask about first.
- Privacy Act 1988 (Australia) and the Australian Privacy PrinciplesMost 2024 amendments commenced on 11 December 2024; automated-decision content in privacy policies applies from 10 December 2026.
- Essential EightThe Maturity Model was last updated on 27 November 2023; Maturity Level Two is the mandatory baseline for non-corporate Commonwealth entities under the PSPF.
- APRA CPS 234 and CPS 230CPS 234 has applied since 1 July 2019; CPS 230 commenced on 1 July 2025, with targeted amendments in force from 1 July 2026.
- Privacy Act 2020 (New Zealand)In force since 1 December 2020; the new IPP 3A on indirect collection commenced on 1 May 2026.
- Modern Slavery Acts (UK / Australia)Australia's 2018 Act had a statutory review reported in 2023 and a government consultation on strengthening it in July 2025.
- Regulatory registration (SFDA, MOHAP/EDE, CDSCO, TGA, Health Canada)In Australia, a local sponsor applies for ARTG inclusion, backed by manufacturer evidence such as TGA conformity assessment.
- PCI DSS compliance in AustraliaPCI DSS is not a law: card brands and your acquirer set the validation route, alongside APRA CPS 234 and the Notifiable Data Breaches scheme.
Status lines are as each guide confirms at its last update; only dates checked against the regulator’s own pages are shown.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Regulatory watch: common questions
Short answers; the detail is in each guide.
Is there a certificate for Privacy Act, Essential Eight or APRA compliance?
No. Regulators supervise the Privacy Acts and APRA’s standards, and the Essential Eight is assessed against ASD’s Maturity Model. An ISO/IEC 27001 certificate supports your evidence but does not replace these obligations.
Which Australian rules apply to a bank, insurer or super fund?
APRA CPS 234 and CPS 230, alongside the Privacy Act 1988 and its Notifiable Data Breaches scheme. If you take card payments, PCI DSS applies through your acquirer.
What should a New Zealand organisation do first under the Privacy Act 2020?
Appoint a privacy officer, who can be external; check collection notices against IPP 3A; and be ready to notify the Privacy Commissioner and affected people of a breach likely to cause serious harm.
Talk to a consultant
Plan your Australian and New Zealand compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice