Compliance playbook for retail and e-commerce businesses

Plain English summary

Obligation checklist

Every obligation cites the Act and section. Source URLs link to the regulator's portal — Rules Mate does not republish statutory text.

1. 1

   Australian Consumer Law (Sch 2, Competition and Consumer Act 2010), Pt 3-2 Div 1 — consumer guarantees

   Every supply of goods or services to a consumer (under $100K or for personal/domestic/household use) must comply with the consumer guarantees: acceptable quality, fit for disclosed purpose, match description/sample, supplied within reasonable time, free of undisclosed encumbrances, due care and skill (services). Major failure entitles refund + damages; minor failure entitles repair/replace.

   Who's responsible

   Operator / Owner + Customer Service

   Frequency

   Continuous; per sale

   Penalty

   Up to $50M / 3× benefit / 30% turnover (corporate) for false-or-misleading conduct around guarantees.

   Source

   Regulator-direct link

   Full obligation page →
2. 2

   Australian Consumer Law, ss 18 + 29 — misleading or deceptive conduct + false representations

   Do not engage in conduct that is misleading or deceptive (or is likely to mislead or deceive) in trade or commerce. Do not make false or misleading representations about goods, services, country of origin, testimonials, sponsorship, price.

   Who's responsible

   Marketing + Operator

   Frequency

   Continuous

   Penalty

   Up to $50M / 3× benefit / 30% turnover (corporate); ACCC enforcement.

   Source

   Regulator-direct link

3. 3

   Australian Consumer Law, Pt 3-1 Div 1 + Country of Origin Food Labelling Information Standard 2016

   Use country-of-origin labels truthfully and consistently with the safe-harbour rules. For Australian-grown / Australian-made / Product of Australia / Made in Australia: meet the substantial-transformation + cost-of-production tests.

   Who's responsible

   Buying / Marketing

   Frequency

   Continuous

   Penalty

   Same ACL penalty regime; ACCC enforcement.

   Source

   Regulator-direct link

   Full obligation page →
4. 4

   Australian Consumer Law, Pt 3-3 — product safety mandatory standards + bans + recalls

   Comply with all mandatory product safety standards (e.g. button batteries, baby walkers, prams, basketball rings, water beads from 1 March 2024). Do not supply banned products. Report serious injury / death within 2 days under s 131. Cooperate with mandatory recalls.

   Who's responsible

   Operator + Buying + Compliance

   Frequency

   Continuous; mandatory reports event-driven

   Penalty

   Up to $50M / 3× benefit / 30% turnover (corporate); criminal offences for serious breaches.

   Source

   Regulator-direct link

   Full obligation page →
5. 5

   Australian Consumer Law, s 47 — multiple pricing rule

   If a product is displayed with more than one price, the seller must charge no more than the lowest price (or withdraw the product from sale). Also: don't advertise a price unless the total price including all unavoidable charges (GST, surcharges) is also displayed (component pricing rule, s 48).

   Who's responsible

   Operator + Store / Web Manager

   Frequency

   Continuous

   Penalty

   Up to $50M / 3× benefit / 30% turnover (corporate); ACCC enforcement.

   Source

   Regulator-direct link

6. 6

   Australian Consumer Law, Pt 2-3 — unfair contract terms (standard form)

   Standard-form consumer and small-business contracts must not contain unfair terms. From 9 November 2023, unfair terms attract civil penalties up to $50M (corporate). Common UCT risks in retail: unilateral variation, automatic renewal, limitation of liability, exclusive remedies, restrictive cancellation.

   Who's responsible

   GC / Operator

   Frequency

   Continuous; review on material change

   Penalty

   Civil penalty up to $50M / 3× benefit / 30% turnover per term.

   Source

   Regulator-direct link

7. 7

   Australian Consumer Law, Pt 3-2 Div 4 — gift cards (3-year minimum expiry)

   Gift cards supplied at retail must be valid for at least 3 years from supply. Display expiry date prominently. Do not charge post-purchase fees that erode value (some exceptions for activation, foreign transaction, etc).

   Who's responsible

   Operator + Marketing

   Frequency

   Continuous

   Penalty

   Civil penalty up to $30,000 (corporate) per breach.

   Source

   Regulator-direct link

8. 8

   Australian Consumer Law, Pt 3-2 Div 2 — unsolicited consumer agreements

   Unsolicited consumer agreements (door-to-door, telemarketing-initiated, party-plan) attract a 10-business-day cooling-off period and explicit disclosure rules. Most pure-online retail is not unsolicited — but outbound telesales, in-mall recruitment, social-DM-initiated sales can be.

   Who's responsible

   Sales + Operator

   Frequency

   Per sale

   Penalty

   Civil penalty + the agreement is unenforceable during cooling-off period.

   Source

   Regulator-direct link

9. 9

   Spam Act 2003 (Cth), s 16

   Do not send commercial electronic messages without consent (express or inferred); include sender identification + a functional unsubscribe in every message. Applies to email, SMS, push notifications, in-app messages with commercial content.

   Who's responsible

   Marketing

   Frequency

   Every campaign

   Penalty

   Up to $2.355M per day for serious breaches; ACMA enforcement.

   Source

   Regulator-direct link

   Full obligation page →
10. 10

    Do Not Call Register Act 2006 (Cth)

    Do not make unsolicited telemarketing calls to numbers on the Do Not Call Register. Wash lists at least every 30 days. Existing-customer relationship exemption is narrow — defaults are unlikely to cover cold outreach.

    Who's responsible

    Sales + Marketing

    Frequency

    Every campaign; register check at least every 30 days

    Penalty

    Up to $2.355M for serious repeated breaches; ACMA enforcement.

    Source

    Regulator-direct link

    Full obligation page →
11. 11

    Privacy Act 1988 (Cth), Sch 1 — Australian Privacy Principles

    If turnover is at or above $3M (or you handle health information, contract to Government, or trade personal information), comply with all 13 APPs. Publish a Privacy Policy (APP 1) covering ADM from 10 December 2026; provide collection notices (APP 5); secure customer data (APP 11); apply APP 8 for offshore disclosure (Stripe, AWS, Shopify).

    Who's responsible

    Privacy Officer + CTO + Marketing

    Frequency

    Continuous

    Penalty

    Up to $50M / 3× benefit / 30% turnover for serious or repeated interferences.

    Source

    Regulator-direct link

    Full obligation page →
12. 12

    Privacy Act 1988 (Cth), Pt IIIC — Notifiable Data Breach scheme

    Notify the OAIC and affected individuals of eligible data breaches likely to result in serious harm. Assessment within 30 days. Retail customer-database breaches (Optus, Medibank, ATO-style) are high-risk.

    Who's responsible

    Privacy Officer + Incident Response Lead

    Frequency

    Event-driven

    Penalty

    Up to $50M / 3× benefit / 30% turnover.

    Source

    Regulator-direct link

    Full obligation page →
13. 13

    Privacy Act 2026 amendments — ADM transparency + Children's Online Privacy Code from 10 December 2026

    From 10 December 2026: where ADM is used to make decisions that significantly affect individuals (price personalisation, credit decisioning, fraud-block decisions), disclose in the APP 1 Privacy Policy. Children's Online Privacy Code applies if you target users under 16.

    Who's responsible

    Privacy Officer + CTO + Marketing

    Frequency

    From 10 December 2026; ongoing

    Penalty

    Same Privacy Act penalty regime; OAIC enforcement.

    Source

    Regulator-direct link

    Full obligation page →
14. 14

    Competition and Consumer (Industry Codes — Consumer Data Right) Regulations + CDR Rules

    If operating in Banking, Energy, or Non-Bank Lending sectors as a data holder or accredited data recipient: comply with CDR Rules + 13 Privacy Safeguards. Most pure retail is out of scope — but retail BNPL providers, cash-back / open-banking apps, and energy retailers are captured.

    Who's responsible

    CTO + Compliance

    Frequency

    Continuous (if applicable)

    Penalty

    Civil penalty up to $50M / 3× benefit / 30% turnover.

    Source

    Regulator-direct link

    Full obligation page →
15. 15

    ePayments Code (ASIC)

    Subscribers to the ePayments Code (most retailers issuing or accepting electronic payments via PCI-DSS providers) must comply with chargeback and unauthorised-transaction provisions. Investigate disputes within stipulated timeframes.

    Who's responsible

    Customer Service + Finance

    Frequency

    Per dispute

    Penalty

    Code is voluntary but breach can be a misleading-conduct contravention; ASIC enforcement.

    Source

    Regulator-direct link

16. 16

    National Consumer Credit Protection Act 2009 (Cth) — BNPL from 10 June 2025

    If you offer Buy Now Pay Later directly (vs. embed Afterpay / Zip / Klarna): from 10 June 2025, operate under the BNPL modified credit licence regime + Low Cost Credit Contract rules. Lite responsible-lending obligations + hardship + dispute resolution + design and distribution.

    Who's responsible

    GC / Operator

    Frequency

    Continuous (if BNPL offered)

    Penalty

    Civil penalty up to $15.65M (individual); $156.5M (corporate); ASIC enforcement.

    Source

    Regulator-direct link

17. 17

    Designs Act 2003 (Cth) + Trade Marks Act 1995 (Cth) — IP enforcement

    Don't infringe registered designs or trade marks. Use TMs for branded products; respect competitor designs. Monitor copy-cat product imports through ABF Notice of Objection scheme.

    Who's responsible

    GC + Buying

    Frequency

    Continuous

    Penalty

    Civil — damages, account of profits, injunctions; criminal under Trade Marks Act for counterfeiting.

    Source

    Regulator-direct link

18. 18

    A New Tax System (Goods and Services Tax) Act 1999 + Treasury Laws Amendment (GST Low Value Goods) Act 2017

    Register for GST when annual turnover is or will be $75,000+. Collect GST on low-value imported goods (under $1,000) sold to Australian consumers if you are a non-resident merchant + GST turnover above $75,000 from Australian sales. Lodge BAS.

    Who's responsible

    Finance / Bookkeeper

    Frequency

    Quarterly (or monthly)

    Penalty

    Failure-to-lodge + General Interest Charge; ATO audit review.

    Source

    Regulator-direct link

19. 19

    Food Standards Code, Standard 1.2.3 + PEAL labelling — allergens (if selling food)

    If selling food (packaged or unpackaged), declare all 10 nominated allergens (gluten, crustacea, egg, fish, milk, peanut, sesame, soy, tree nuts, lupin) per Standard 1.2.3 + Plain English Allergen Labelling rules.

    Who's responsible

    Buying + Compliance

    Frequency

    Continuous; per SKU launch

    Penalty

    Civil penalty under state Food Act; product recall.

    Source

    Regulator-direct link

    Full obligation page →
20. 20

    Modern Slavery Act 2018 (Cth), s 5 — reporting entity

    Where consolidated revenue is AUD $100M or more: lodge an annual Modern Slavery Statement on the Modern Slavery Statements Register within 6 months of the end of the reporting period. Retail global supply chains (apparel, electronics, homewares) are high-risk and require deep diligence.

    Who's responsible

    CFO + Company Secretary

    Frequency

    Annual

    Penalty

    Public listing on register; civil penalties proposed under Modern Slavery Amendment Bill 2024.

    Source

    Regulator-direct link

    Full obligation page →
21. 21

    Cyber Security Act 2024 (Cth) — ransomware payment reporting

    From 30 May 2025: entities with annual turnover above $3M (or critical-infrastructure entities) must report ransomware payments to the Department of Home Affairs within 72 hours of the payment.

    Who's responsible

    CISO + GC

    Frequency

    Event-driven

    Penalty

    Civil penalty (60 penalty units, ~$19,800).

    Source

    Regulator-direct link

Deadlines

Pulled from the Rules Mate compliance calendar. Click through for the full deadline page.

• 10 December 2026

  ADM transparency obligation in force

  APP entities must disclose significant ADM use in privacy policy.

• 10 December 2026

  Children's Online Privacy Code in force

  OAIC Children's Code (binding) in force.

• 14 July 2026

  STP end-of-year finalisation

  Finalise STP submissions for the previous financial year by 14 July.

• 1 July 2026

  Payday Super commences

  Super contributions must reach the employee's fund within 7 business days of each payday. New STP fields (QE + Super Liability).

• 31 December 2026

  Modern Slavery Statement (FY26 ending 30 June)

  Within 6 months of FY end — typically 31 December for 30 June year-ends.

Forms and regulator portals

Direct links to the lodgement forms and regulator portals. Rules Mate does not host copies — we link to the official source.

• ACCC — product safety reporting + recall portal

  Lodge mandatory product safety incident reports (s 131) and recall notifications.

  Open portal →

• ACMA — Spam Act enforcement / complaints

  Report a spam breach or seek guidance on Spam Act compliance.

  Open portal →

• Do Not Call Register — washer access

  Telemarketers must subscribe to the Register and wash lists at least every 30 days.

  Open portal →

• OAIC — Notifiable Data Breach notification

  Report an eligible data breach involving customer information.

  Open portal →

• Modern Slavery Statements Register — lodgement

  Lodgement portal for entities at or above the $100M consolidated revenue threshold.

  Open portal →

• ATO — Business Activity Statement portal

  Lodge BAS, manage GST, PAYG, fuel tax credits.

  Open portal →

• Australian Border Force — Notice of Objection (counterfeit goods)

  Register an IP notice to enable ABF seizure of counterfeit imports.

  Open portal →

Free tools that help

Interactive Rules Mate tools matched to this persona.

In-depth reading

24 Rules Mate articles tagged to this playbook.

• Australian Consumer Law: the consumer guarantees explained

  Sections 54-59 of the ACL set out the guarantees that apply to most consumer goods and services in Australia. Here's what each guarantee means and what the remedies are.

• ACL misleading or deceptive conduct: sections 18 and 29

  Section 18 of the Australian Consumer Law prohibits misleading or deceptive conduct in trade or commerce. Section 29 targets specific false representations about goods and services. Here's how they differ.

• Country of Origin labelling in Australia: the Information Standard explained

  Most food sold in Australia must carry country-of-origin labelling under the Country of Origin Food Labelling Information Standard 2016, made under the Australian Consumer Law.

• Allergen labelling in Australia: Plain English Allergen Labelling (PEAL) explained

  Food Standards Code Standard 1.2.3 requires mandatory declaration of 10 prescribed allergens. PEAL took effect 25 February 2024 with a transition period to 25 February 2027.

• Spam Act 2003: the three rules every Australian sender must follow

  The Spam Act 2003 governs commercial electronic messages sent to or from Australia. Three rules: consent, identification, unsubscribe. Penalties under ACMA enforcement can reach $2.96M per day.

• Do Not Call Register: who can call, who can't, and the rules

  The Do Not Call Register Act 2006 prohibits unsolicited telemarketing calls and marketing faxes to registered numbers. Here are the rules, the exemptions, and the enforcement.

• Privacy Act 2026: what Australian SMBs need to do before 10 December

  On 10 December 2026, ADM transparency and the Children's Online Privacy Code commence. The proposed small business exemption removal — which would bring ~2 million SMBs into APP scope — is not yet law. Here's what you need in place.

• Privacy Act 2026: 8 questions every Australian SMB should answer

  Removing the small business exemption is proposed for a future reform tranche — not yet law — but if enacted ~2 million SMBs would become APP entities. Answer these 8 questions to know where you stand.

• APP 8 overseas disclosure: when AU businesses are accountable for what an overseas recipient does

  Australian Privacy Principle 8 makes an APP entity accountable for what an overseas recipient does with personal information it discloses. Here's the rule, the exceptions, and how to discharge the obligation.

• BNPL Becomes Regulated Credit: ACL Required from 10 June 2025

  The Treasury Laws Amendment (Responsible Buy Now Pay Later and Other Measures) Act 2024 brings BNPL contracts into the NCCP Act as 'low cost credit contracts', requiring providers to hold an ACL from 10 June 2025.

• ePayments Code 2022: ASIC's Updated Consumer Protections for Electronic Payments

  ASIC published the updated ePayments Code on 2 June 2022 (mandatory from 2 June 2023), covering mistaken internet payments, unauthorised transactions, NPP payments and complaints handling.

• Consumer Data Right: Banking Data Holder and Accredited Data Recipient Duties

  How the Consumer Data Right works in banking, including data holder obligations and the ACCC accreditation process for data recipients.

• Cyber Security Act 2024 — mandatory ransomware payment reporting

  How Part 3 of the Cyber Security Act 2024 (Cth) requires reporting entities to notify ASD within 72 hours of making or being aware of a ransomware payment.

• Notifiable Data Breach: a step-by-step walkthrough for the first 30 days

  What to do hour-by-hour when you discover a suspected data breach. The 30-day assessment, the notification triggers, OAIC and affected individuals.

• Australian compliance calendar 2026–2027: every deadline you need

  A month-by-month list of every major Australian compliance deadline for 2026 and 2027 — tax, super, AML, privacy, climate, WHS, modern slavery. Free .ics download.

• Privacy Act vs GDPR: what Australian businesses actually need to know

  How Australia's Privacy Act and Australian Privacy Principles compare to the EU's GDPR — thresholds, consent, breach notification, penalties, and what changes for AU businesses in December 2026.

• The Notifiable Data Breach 30-day rule explained

  Under the Privacy Act's NDB scheme you have up to 30 days to assess a suspected breach, then must notify the OAIC and affected individuals. Here's how both clocks work.

• Consumer Data Right (CDR) in Australia: open banking, open energy and what's coming

  The Consumer Data Right lets consumers share their banking, energy and (progressively) other data with accredited third parties. Here's the framework, the participants and the Privacy Safeguards.

• The Privacy Act statutory tort for serious invasions of privacy

  Schedule 2 to the Privacy and Other Legislation Amendment Act 2024 created a new statutory cause of action for serious invasions of privacy. It commenced 10 June 2025. Here's the framework.

• The My Health Records Act 2012: access, controls and offences

  The My Health Records Act 2012 establishes Australia's My Health Record system. Strict access rules, audit logging, and significant criminal penalties apply for unauthorised access.

• Workplace surveillance Acts in Australia: NSW, ACT and the patchwork

  Some states have specific workplace surveillance Acts; others rely on the Privacy Act and state surveillance-devices Acts. Here's the framework — particularly for NSW + ACT employers.

• The Privacy Act employee records exemption (section 7B): what it covers and what it doesn't

  Section 7B(3) of the Privacy Act 1988 exempts acts and practices of organisations relating to employee records from the Australian Privacy Principles. The carve-out is narrower than many employers think.

• TIA Act data retention: the 2-year metadata regime explained

  Telecommunications service providers must retain prescribed metadata for 2 years under the Telecommunications (Interception and Access) Act 1979. Here's the framework and the access rules.

• Privacy Act 2024 automated decision-making transparency: commencing 10 December 2026

  The Privacy and Other Legislation Amendment Act 2024 added automated decision-making transparency obligations. They commence 10 December 2026. Here's what entities must disclose in their privacy policies.

Frequently asked