Under Australian Privacy Principle (APP) 8 of the Privacy Act, APP entities that disclose personal information to overseas recipients are required to take reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles (excluding APP 1), unless an exception applies. The "substantially similar regime" exception applies where the APP entity reasonably believes that the overseas recipient is subject to a law or binding scheme that, overall, affords a level of protection substantially similar to that of the APPs and provides mechanisms for individuals to enforce those protections. In December 2024, the Privacy Act was amended to allow the government to make regulations specifying jurisdictions or binding schemes that qualify under this first exception, although no such whitelist has been formally established to date. Second, data can be transferred across borders when the individual is expressly informed that, by consenting to the disclosure, APP 8.1 will not apply, and the individual subsequently provides consent. Third, the disclosure may be permitted if it is required or authorised by an Australian law or by an order of a court or tribunal. Fourth, an exception arises where a permitted general situation (excluding those related to legal or equitable claims or alternative dispute resolution) exists in relation to the disclosure. Fifth, if the APP entity is a government agency, and the disclosure is required or authorised under an international agreement to which Australia is a party that pertains to information sharing. Sixth, where the entity is an agency and reasonably believes that the disclosure is necessary for one or more enforcement-related activities conducted by or on behalf of an enforcement body, and the recipient performs similar functions or exercises comparable powers, the exception also applies.
Pursuant to Section 6, an “APP entity” includes both agencies and organisations. “Agencies” refer to Commonwealth government entities, including federal courts, as listed in the Privacy Act, while “organisations” encompass individuals, corporations, partnerships, unincorporated associations, and trusts, excluding small business operators, registered political parties, agencies, State or Territory authorities, and certain prescribed State or Territory instrumentalities.

Australia has joined several agreements with binding commitments to open transfers of data across borders. These include: Updated Singapore-Australia Free Trade Agreement (SAFTA, Chapter 14, Art. 13), the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP, Art. 14.11), the Australia - Peru Free Trade Agreement (Art. 13.11), the Indonesia - Australia Comprehensive Economic Partnership Agreement (Art. 13.11), the Australia -Hong Kong Free Trade Agreement and associated Investment Agreement [Art. 11.7(2) and 11.15(1)], the Australia - Singapore Digital Economy Agreement (Annex A Art. 23), and the Australia - United Kingdom Free Trade Agreement [14.10(2)].

The Privacy Act 1988 provides a comprehensive regime of data protection in Australia. The Privacy Act, which includes a set of Australian Privacy Principles, provides general personal data protection requirements and provisions, including the right to access and to be informed. Initially, the Act stipulated guidelines for how Australian government agencies should manage personal information. Subsequently, in 2000, the Privacy Amendment (Private Sector) Act extended these provisions to certain private sector organisations.
Sector-specific privacy regulations, particularly concerning telecommunications, are addressed by the Telecommunications Act 1997 and the Telecommunications (Interception and Access) Act 1979. Additional protections for healthcare information are provided under the My Health Records Act 2012 and the Healthcare Identifiers Act 2010. Businesses operating in industries such as financial services and gambling are required to adhere to the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and its accompanying rules. Furthermore, the Security of Critical Infrastructure Act 2018 applies to entities that own, operate, or hold direct interests in assets across various sectors, including communications, energy, defence, financial services, transport, data processing or storage, supermarket and grocery supply chains, health and medical services, education, and space.

The Telecommunications (Interception and Access) Act 1979 requires a telecommunication service provider to keep specific telecommunications data relating to the services it offers for two years (187C). The dataset to be kept includes the subscriber, the accounts of telecommunications devices, the source of communication, the destination of a communication, the date, time, and duration of a communication, the type of communication, and the location of the equipment or line used (187AA). This retention scheme was inserted into the Act by the Telecommunications (Interception and Access) Amendment (Data Retention) Act 2015.

The Telecommunications (Interception and Access) Act 1979 grants criminal law enforcement agencies the authority to intercept real-time communications without a warrant. The Act addresses various types of interception warrants, including an interception warrant (Section 10), a telecommunications service warrant (Section 11A), a foreign communications warrant (Section 11C), and a stored communications warrant (Section 110). However, in emergency situations (Section 30) or for the purpose of developing and testing interception capabilities (Section 31A), law enforcement officers or agencies may intercept live communications without obtaining a warrant.

Australia has ratified the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

Australia is a signatory of the World Trade Organization (WTO) Information Technology Agreement (ITA) of 1996 and its 2015 expansion (ITA II).

Pursuant to the authority conferred by the Customs Act 1901, the Anti-Dumping Commission, led by a Commissioner, is responsible for administering anti-dumping and countervailing measures. In May 2024, the Commission extended the anti-dumping duties originally imposed in May 2019 on PVC flat electric cables (HS 8544.49.20) imported from China. The applicable duty rates range from 2.8% to 18.9%, depending on the exporting company.

In April 2023, the Australian Government, acting under the Protective Security Policy Framework (PSPF) Direction 001-2023, prohibited the use of TikTok on all federal government devices. This measure aligned Australia with its Five Eyes intelligence-sharing partners, namely the United States, Canada, the United Kingdom, and New Zealand, and was adopted in response to cybersecurity concerns associated with the Chinese-owned application. According to official statements, the decision was based on assessments conducted by national intelligence and security agencies, with implementation to occur “as soon as practicable.” In response, TikTok expressed concern, noting that the measure was introduced without specific security findings being publicly disclosed or prior consultation with the company.
Furthermore, in February 2025, the Australian Government, acting under the Protective Security Policy Framework (PSPF) 001-2025, extended similar restrictions to products, applications, and web services developed by the Chinese artificial intelligence firm DeepSeek on government networks and devices. The Government indicated that this prohibition was grounded in a risk and threat assessment identifying security risks associated with the use of such technologies.

The 2012 Commonwealth Procurement Rules (CPRs) were amended in June 2024 to raise the procurement thresholds for small and medium-sized enterprises (SMEs). Pursuant to Sections 5.7 and 5.8, at least 25% (up from 20%) of procurements valued below AUD 1 billion (approx. USD 660 million), and 40% (up from 35%) of procurements valued below AUD 20 million (approx. USD 13 million), must be sourced from domestic SMEs.
In addition, the amendment raised the SME exemption threshold from AUD 200,000 (approx. USD 130,000) to AUD 500,000 (approx. USD 330,000). This threshold denotes the value below which Australian Government entities may procure directly from SMEs without conducting a full open tender procedure.

The Commonwealth Indigenous Procurement Policy (IPP), as updated in June 2025, establishes both procurement targets for purchasing from Indigenous enterprises and a Mandatory Set-Aside (MSA) mechanism to direct Commonwealth contracts to such enterprises (Section 1.3.2). The MSA applies to all procurements conducted in remote areas, as well as to procurements wholly delivered within Australia with an estimated value between AUD 80,000 and AUD 200,000 (approx. USD 55,000–140,000).
Furthermore, Section 1.3.3 of the Policy introduces Indigenous participation targets for high-value contracts wholly delivered in Australia, specifically those valued at AUD 7.5 million (approx. USD 5 million) or more within designated industry categories. These targets, referred to as the Mandatory Minimum Indigenous Participation Requirements (MMR), include the obligation that, in procurement processes subject to the MMR, contracting authorities must take into account a tenderer’s past performance in meeting MMR targets under previous Commonwealth contracts.

Australia is a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA), and its commitments also cover the services sectors considered most important for digital trade, namely telecommunication services (CPC 752), telecommunication-related services (CPC 754), and computer and related services (CPC 84).

The Telstra Corporations Act 1991 provides under Section 8BG that aggregate foreign ownership of Telstra (the incumbent telecommunication company) is limited to 35%, and individual foreign investors are only allowed to own up to 5%. This specific cap was imposed in 1999 as part of an amendment to the Act.
Additionally, the National Broadband Network Companies Act 2011 provides that the Commonwealth must retain full ownership of National Broadband Network Co (NBN Co) (Part 3, Division 2, Subdivision A). This ownership structure could be terminated only in limited circumstances (Part 3, Division 2, Subdivision B). This rule has been in place since its enactment in 2011.