Comprehensive implementing framework for the NDPA. Repeals the NDPR 2019; mandates registration of major-importance entities, compliance audits within 15 months of commencing processing, annual CARs for UHL/EHL entities, semi-annual DPO reports, privacy by design/default (including for AI tools), mandatory consent categories (direct marketing, sensitive data, children's data, non-adequate cross-border transfers, automated processing), DPIA requirements and standard clauses for data processing agreements. New audit filing fees commence with the 2026 audit cycle.
All data controllers and processors subject to the NDPA.
Open Source Document ↗