Compliance risk

The OAIC has updated its facial recognition guidance for APP entities using biometric technology in high-volume, publicly accessible retail spaces. The update reflects the ART’s March 2026 Bunnings decision and reinforces that each deployment needs…

Two recent ASIC matters provide a useful opportunity to think differently about risk management. They can be read as stories about compensation, penalties and compliance...

APRA has granted an authorised deposit-taking institution (ADI) licence to Revolut. This is a substantive licensing decision and a current prudential development for boards, risk teams and governance functions watching new entrants into the banking…

A serious data breach does not automatically mean governance failed. The more important question is whether an organisation can demonstrate that it understood the risks,...

The ACCC fined Lactalis $59,400 over misleading 'fresh' milk labelling, while the Federal Court's $11.3 million penalty against Mercer Super shows the same claims-outrun-evidence governance failure at a very different scale.

The OAIC has published new Notifiable Data Breaches statistics for 2025, showing notifications at an all-time high and issuing a new quick reference guide for entities covered by the scheme. This is not a new…