Encryption lawsAustralia
Australia's Assistance and Access Act 2018
The Act set up a framework, on 9 December 2018, in Part 15 of the Telecommunications Act 1997 that lets agencies request or require technical help from communications companies. In 2024-25 agencies gave 58 requests and no notices.1, 2
Checked 28 October 2026 against the sources. This page describes the law. It is not legal advice.
Three kinds of request
Part 15 sets up a graduated approach, from voluntary help to help a provider must build the capability to give.2
| Tool | What it asks | Who can give it |
|---|---|---|
| Technical assistance request | Voluntary help from a provider.2 | Police interception agencies, ASIO, ASD and ASIS2 |
| Technical assistance notice | Required help, where the provider already has the capability to give it.2A state or territory agency's notice must first be reviewed by the AFP Commissioner. | Police interception agencies and ASIO2 |
| Technical capability notice | Required help, where the provider may not have the capability to give it.2 | The Attorney-General, with the approval of the Minister for Communications2 |
The limits on what can be asked
Requests and notices "cannot be used to introduce a systemic weakness or systemic vulnerability into a form of electronic protection", and cannot be used to "compel a provider to build a decryption capability or make their encrypted systems less effective", the Department of Home Affairs says.3 A systemic weakness is one "that affects a whole class of technology", not one "selectively introduced" to technologies connected with a particular person.2
Any assistance must be reasonable, proportionate, practicable and technically feasible. A provider can ask for a proposed capability notice to go to an assessment panel of a retired senior judge and a technical expert, and can seek judicial review.2
The framework covers "designated communications providers", which Home Affairs says includes telecommunications operators, providers of electronic services, software developers and device makers that supply products for use in Australia.1 Information about a request or notice cannot be disclosed, with exceptions, though companies can publish the number they received over six-month periods.1
How often the powers are used
The yearly report counts what police interception agencies gave. It does not cover requests from ASIO or the other intelligence agencies.2
| Year | Requests | Assistance notices | Capability notices |
|---|---|---|---|
| 2023-24 | 60 | 2 | 0 |
| 2024-25 | 582 | 0 | 0 |
A separate law: eSafety's industry standards
Under the Online Safety Act 2021, the eSafety Commissioner made an industry standard for designated internet services in 2024 that requires the highest-risk services to detect known child sexual abuse and pro-terror material. Its supplementary explanatory statement says that for end-to-end encrypted services, providers are not required "to implement or build a new decryption capability into the service or render encryption methods less effective".4
Questions people ask
Is encryption illegal in Australia?
No. The government says it "supports cyber security tools, like encryption". The Act lets agencies seek help from providers, within the limits above.3
Has a technical capability notice ever been issued?
None was given in 2023-24 or 2024-25, according to the annual report. The report covers notices directed at helping police interception agencies.2
Does the Act apply to companies outside Australia?
It applies to designated communications providers that supply or operate products for use, or likely use, in Australia, Home Affairs says.1
Sources 4
- Industry assistance under Part 15 of the Telecommunications Act 1997: frequently asked questions, Department of Home Affairs, Australia. Read 28 October 2026.
- Telecommunications (Interception and Access) Act 1979 and Part 15 of the Telecommunications Act 1997, Annual Report 2024-25, chapter 6, Department of Home Affairs, Australia. Read 28 October 2026.
- The Assistance and Access Act 2018, Department of Home Affairs, Australia. Read 28 October 2026.
- Supplementary explanatory statement, Online Safety (Designated Internet Services, Class 1A and 1B Material) Industry Standard 2024, registered 13 November 2024, Federal Register of Legislation, Australia. Read 28 October 2026.
We read the law itself, and every status has a date. How we check