Policy management software for Australian compliance

Strengthened privacy obligations and cyber security accountability. Australia's Privacy Act reforms - the most significant since the Act's introduction - impose stronger obligations for how organisations handle personal information, respond to data breaches, and enforce data governance.

• Documented, up-to-date privacy policies must be accessible to employees and customers
• Data handling procedures must be defined, distributed, and attested to by relevant staff
• Increased penalties for serious or repeated breaches - up to AU$50 million for corporations
• New requirements for data retention, destruction, and transparency
• Organisations must demonstrate proactive governance, not just reactive compliance

Workplace safety policy obligations across all states and territories. Australia's harmonised WHS framework places extensive obligations on employers to document, communicate, and enforce health and safety policies - consistently across multiple jurisdictions.

• Employers have a primary duty of care to ensure safety - which requires clear, documented, communicated policies
• Workers must be informed of and trained on relevant WHS policies; records must be maintained
• Safe Work Australia requires regular review and update of all WHS policies
• Penalties can include significant fines and, in serious cases, criminal prosecution
• Consistent policy management required across New South Wales, Victoria, Queensland and beyond

Corporate governance and policy documentation obligations. The Corporations Act establishes obligations for corporate governance, director duties, and the management of corporate policies - reinforced by ASIC's active regulatory expectations.

• Directors and officers must act with due care and diligence - supported by documented governance policies
• Companies must have and enforce policies covering conflicts of interest, related-party transactions, and financial reporting
• ASIC expects policies to be actively managed, distributed, and adhered to - not just documented
• Policy documentation and attestation records are essential evidence in any ASIC investigation

Mandatory whistleblower policies for public and large companies. All public companies, large proprietary companies, and trustees of registrable superannuation entities must have a compliant, accessible, and evidenced whistleblower policy.

• Whistleblower policies must be accessible to all eligible disclosers - employees, contractors, suppliers
• Organisations must evidence that the policy has been communicated and distributed effectively
• ASIC actively monitors compliance and has issued enforcement action for inadequate policies
• Legal safeguards protect whistleblowers from victimisation

Supply chain due diligence and annual reporting obligations. Entities with annual consolidated revenue of AU$100 million or more must submit annual modern slavery statements documenting their supply chain risk management.

• Document and communicate due diligence processes, supplier policies, and risk management procedures
• Modern slavery policies must be reviewed regularly with evidence of distribution and acknowledgement maintained
• Smaller organisations increasingly adopting equivalent practices voluntarily

Information security - APRA CPS 234. CPS 234 requires APRA-regulated entities to maintain information security policies commensurate with the size and extent of threats to their information assets. Boards and senior management must be able to demonstrate that information security policies are documented, current, distributed to relevant staff, and actively acknowledged. Xoralia provides the policy library, targeted distribution, and timestamped attestation records that satisfy CPS 234's governance requirements.