Australian small businesses may soon face new website compliance requirements under proposed Digital Duty of Care legislation. These changes could introduce annual website risk assessments, written record-keeping obligations and new responsibilities for businesses operating websites and online services.
While the legislation is primarily aimed at improving online safety, its potential reach is much broader than social media platforms and large technology companies. In its current form, the proposed legislation could affect businesses of all sizes across Australia, including many of the clients whose websites GOOP Digital manages.
GOOP Digital is closely following these developments and will keep our clients and other Australian small businesses informed about what the legislation could mean for their websites.
What is Australia’s proposed Digital Duty of Care legislation?
On 8 September 2026, the Australian Government released the draft Online Safety Amendment (Digital Duty of Care) Bill 2026.
The Government subsequently introduced Digital Duty of Care legislation into Parliament on 15 October 2026.
The proposed legislation aims to make providers of online services more responsible for identifying and reducing foreseeable risks to people using their services, particularly children.
According to the Australian Government, the reforms would require online service providers to take reasonable steps to keep Australian users safe.
While much of the public discussion has focused on social media platforms, the proposed legislation has the potential to extend to a much wider range of online services.
For Australian small businesses, this raises an important question: Will my business website need an annual risk assessment?
Will small business websites require an annual risk assessment?
Under the September 2026 exposure draft, providers of covered online services would be required to undertake regular written risk assessments to identify foreseeable online safety risks and determine appropriate safeguards.
The proposed requirements include:
- Annual website risk assessments: Covered online services would need to complete a written risk assessment at least once every 12 months.
- Written documentation: Businesses would need to document identified risks and the measures taken to address them.
- Six-year record retention: Risk assessment records would need to be retained for at least six years.
- Reporting to the eSafety Commissioner: Risk assessments would need to be supplied within 30 days of a formal request.
- Ongoing risk management: Businesses would need to consider changes to their online services that could introduce additional risks.
These requirements come from the September exposure draft. Their final application will depend on the legislation passed by Parliament and any subsequent exemptions or guidance.
Importantly, a website risk assessment under the proposed Digital Duty of Care framework is not simply a technical security check. Its primary purpose is to identify and address foreseeable online safety harms associated with a website or online service.
Could the legislation affect every GOOP Digital client?
Potentially, yes.
GOOP Digital designs, develops and maintains websites for businesses across Australia, ranging from sole traders and small family businesses to larger organisations.
The proposed legislation does not automatically exclude a business simply because it is small or operates a relatively basic website.
This means businesses operating websites for trades, professional services, retail, healthcare, hospitality and many other industries could potentially fall within the framework.
However, it is not yet confirmed that every ordinary small business website will need an annual assessment. The Government may introduce exemptions or simplified requirements for lower-risk online services.
This distinction is important. A simple business website displaying services and contact details may present very different online safety risks from a social media platform, online marketplace or website allowing users to upload and share content.
GOOP Digital believes any final compliance requirements should be practical and proportionate to the risks presented by individual websites.
Why are small businesses concerned about the proposed legislation?
The possible impact on ordinary Australian businesses has already attracted attention from business organisations.
In its October 2026 submission, the Business Council of Australia raised concerns about the potential reach of the proposed framework and called for a clearer, more proportionate approach.
For small businesses, the concern is straightforward. Additional annual assessments, documentation and record-keeping could create new compliance responsibilities and costs.
A small business operating a straightforward informational website should not necessarily face the same administrative burden as a major social media platform.
The final legislation will need to clarify which businesses are covered, what risks they must assess and what documentation is required.
What should small businesses do now?
At this stage, small businesses should be aware of the proposed legislation but should not assume that they must immediately purchase or complete a new annual compliance assessment.
The most sensible approach is to monitor the legislation as it progresses through Parliament and wait for confirmation of the final obligations, exemptions and implementation dates.
Businesses should also continue following established website safety practices, including maintaining updated website software, protecting customer information, reviewing website forms and managing any features that allow users to interact or submit content.
These practices are worthwhile regardless of whether the proposed Digital Duty of Care requirements ultimately apply to a particular website.
How GOOP Digital is preparing to assist Australian businesses
At GOOP Digital, we recognise that most small business owners have neither the time nor the resources to continually monitor changes to Australian website legislation.
That is why we are closely following the proposed Digital Duty of Care laws and their potential implications for our clients.
Our objective is to keep Australian small businesses informed and, if annual website risk assessments become mandatory, investigate practical ways to help businesses understand and meet their obligations.
We are particularly interested in how the final legislation will treat small business websites, whether exemptions will apply and what documentation the eSafety Commissioner may require.
If the legislation proceeds with annual risk assessment requirements for ordinary business websites, GOOP Digital intends to explore appropriate assessment and record-keeping services to assist affected clients.
We will provide further information as the Government clarifies the requirements.
Have questions about small business website risk assessments?
If you are concerned about how the proposed Digital Duty of Care legislation could affect your website, GOOP Digital is happy to discuss what is currently known.
We are monitoring developments closely and will continue sharing updates as more information becomes available.
Contact GOOP Digital and ask to speak with Karl Morris about the proposed Digital Duty of Care legislation and potential annual website risk assessment requirements.
Frequently asked questions
Will annual website risk assessments become compulsory in Australia?
The proposed Digital Duty of Care legislation includes annual written risk assessment requirements for covered online services. However, the legislation has not yet passed Parliament, and the final requirements for ordinary small business websites remain uncertain.
Do small businesses need to keep website risk assessment records for six years?
The September 2026 exposure draft proposes that covered online service providers retain written risk assessment records for at least six years. Whether this requirement will apply to all small business websites will depend on the final legislation and any exemptions.
Can GOOP Digital help with annual website risk assessments?
GOOP Digital is monitoring Australia’s proposed Digital Duty of Care legislation and assessing how it may affect business websites. If new compliance requirements are introduced, GOOP Digital intends to investigate practical services to help affected businesses understand and meet their obligations.
Sources and further reading
- Australian Government: Exposure Draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026, 8 September 2026.
- Australian Government: Digital Duty of Care.
- Prime Minister of Australia: My Feed, My Way, 8 September 2026.
- Business Council of Australia: Submission on the exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026, 1 October 2026.
Disclaimer: This article reflects the proposed legislation and publicly available information as at 19 October 2026. The legislation has not yet become law, and the final requirements may change. This article provides general information and does not constitute legal advice.