The Digital Duty of Care Bill, explained for small business

What is the Digital Duty of Care?

It is a proposed change to the Online Safety Act 2021, set out in the Online Safety Amendment (Digital Duty of Care) Bill 2026. It would put one general duty on online services: take appropriate action to ensure a safe online environment for people in Australia. The eSafety Commissioner would enforce it.

The Bill would do three main things:

• Set a general duty. A person responsible for an online service would have to take appropriate action to keep users safe, including effective measures against the risks they identify.
• Require a written risk assessment for each online service, at least once a year.
• Replace today's rules. The current industry codes and standards and the Basic Online Safety Expectations would be repealed when the duty starts.

Is the Digital Duty of Care law yet?

No. As at 14 November 2026 it is a Bill. It passed the House of Representatives on 28 October 2026 and is now before the Senate, where a committee is due to report on 20 November 2026. It can still be amended or rejected. See where the Bill is up to.

When does the Digital Duty of Care start?

If the Bill passes, the duty would start 12 months after Royal Assent. On the current timetable that means late 2027 at the earliest.

Some other changes in the Bill would start the day after Royal Assent. One example is a shorter deadline for acting on eSafety removal notices, down from 48 hours to 24.

Who does the Digital Duty of Care apply to?

It would apply to anyone responsible for an online service that people in Australia use. The Bill lists nine kinds of online service. They include social media, messaging, search engines, app stores, hosting services and services that generate material using artificial intelligence.

The list also includes "designated internet services". This is a broad existing category that eSafety says includes websites.

The Bill names two people as responsible for a service: the person who provides it, and the person who exercises the greatest degree of day-to-day control over it (section 25B).

Does the Digital Duty of Care apply to small businesses?

Probably, if you run your own website or app. The Bill has no exemption based on business size, turnover or number of users.

The Minister could exempt services that pose little risk to users. No exemption exists, and none can be made until the Bill is law. Small business groups have asked for one. Read more on the small business exemption, or check how your kind of site is likely to be treated.

What would a small business have to do?

• Take appropriate action to keep users safe. What counts as appropriate depends on the level of risk. The Bill says the cost of a measure must not be taken into account.
• Keep a written risk assessment. Do it at least once a year and before any significant change that could add new risks.
• Keep each assessment for six years and give it to eSafety within 30 days if asked.

For a simple website the assessment should be short. See what goes in a risk assessment.

What harms is it about?

The duty is about two groups of harm.

• Seriously harmful material and conduct, for everyone (section 25D). This includes child sexual abuse material, grooming, sexual and extreme violence, threats of violence, sharing intimate images without consent, serious menacing or harassment, terrorism material and encouragement of suicide or self-harm.
• Material and conduct harmful to children (section 25E). This includes pornography, material promoting disordered eating, abuse, harassment and bullying, material that glorifies crime or encourages dangerous stunts, and anything else that may cause serious harm to children.

Some material is excluded, including professional news, material for research or education, and material in the public interest (section 25F).

What are the penalties under the Digital Duty of Care?

The maximum civil penalty for breaching the duty would be 60,000 penalty units. A penalty unit is a fixed dollar amount set by federal law, currently $364, so that comes to $21.84 million. The Government puts the maximum for a company at $109.2 million. The same maximum would apply to not having a risk assessment.

Maximums are for serious cases. The explanatory memorandum says a court must consider the size of the organisation and the circumstances. eSafety would also have formal warnings, remedial directions and infringement notices available, and the Department says services would generally get the chance to fix problems first. For most small businesses the practical risk is not a headline fine. It is being unable to show what you did and why.

Do I need to do anything now?

Nothing is required yet under this Bill. Three steps are useful either way:

1. List your online services: website, booking tool, chatbot, reviews, any app.
2. Note which ones let people post content, talk to an AI tool, or are used by children.
3. Run the free check to see how your site is likely to be treated.

Separately, eSafety's existing industry codes already apply to some online services today, and they stay in force until the duty starts. Check eSafety's guidance if you host websites for others or run a chatbot.

Last updated 14 November 2026