Small businesses have every reason to be frustrated by the Government’s proposed Digital Duty of Care. In our view, drawing ordinary business websites into this framework is government overreach. Describing the potential obligation as “minor” misses the point. An obligation is an obligation. You cannot be half pregnant. You either have a compliance responsibility or you do not. For small business owners already stretched for time and resources, assessing requirements, documenting decisions and maintaining records means more work and another compliance cost. A plumber’s website, an accountant’s service pages and a local funeral home should not be handed another compliance burden without a clear and proportionate justification.
For most GOOP Digital clients, a website explains their services, showcases their work and helps customers make contact. Visitors cannot publish their own content or communicate with other visitors. A website safety assessment should reflect those circumstances.
The proposed Australian Digital Duty of Care would require covered online services to take reasonable steps to protect Australians from serious online harm, with additional protections for children. The Government introduced legislation on 15 October 2026, but the legislation and supporting requirements are yet to be finalised.
GOOP Digital is preparing for these changes. We are developing an assessment approach that considers how each client’s website operates, the risks it may present and the safeguards already in place. The final legislation will determine which obligations and exemptions apply.
What is a Digital Duty of Care risk assessment?
A Digital Duty of Care risk assessment identifies how an online service could expose people to harm. The assessment examines the website’s content, features and management processes, then records appropriate safeguards and any improvements needed.
The Government wants online services to prevent foreseeable harm and demonstrate accountability for their safety decisions. Its proposed approach connects risk assessment with preventative action and measurement.
For a business owner, the practical questions are straightforward. What can visitors do on your website? Who controls what appears? Could a feature expose somebody to harmful material or behaviour? Who takes action if a concern is raised?
A useful assessment answers those questions with evidence. Its depth should reflect the website’s actual functions and risks.
What a Digital Duty of Care risk assessment could mean for professional services
Accountants, lawyers and medical practices commonly use their websites to explain services, introduce staff and receive private enquiries or appointment requests. These websites often have limited opportunities for visitors to publish material or interact with one another.
For this type of website, our proposed assessment would examine who approves published information, where enquiries are delivered and whether any features allow public contributions or AI generated responses. We would also check how the business receives and handles concerns about website content.
For a website that meets these conditions, an assessment finding could read:
The website publishes business controlled service information. Visitors cannot publish content, contact each other or generate AI responses. Enquiries are delivered privately to designated staff. The review found limited routes for the identified online safety harms, subject to the controls and limitations recorded in this assessment.
That is an example of a finding supported by a review, rather than a statement that automatically applies to every professional service website.
A medical practice with an AI chatbot would need additional consideration of the chatbot’s responses and safeguards. An accounting firm with a simple contact form would require a different review. Links to booking systems and other external services would also need to be identified so responsibilities are clear.
Professional confidentiality, privacy and the accuracy of professional advice remain important obligations in their own right. Any related findings should be clearly identified within the assessment.
What a Digital Duty of Care risk assessment could mean for tradies
For plumbers, electricians, builders, landscapers and other trade businesses, the website usually publishes business controlled information about services, locations and completed projects.
Our proposed Digital Duty of Care risk assessment for tradies would focus on the features actually available. We would check who can publish or change content, whether visitors can leave public comments and how the business responds to a concern.
A project gallery managed by the business has different risks from a website where anybody can publish a review immediately. A private quote request also operates differently from a public discussion forum.
If your website has no public contributions, messaging between visitors or AI features, the assessment should record those facts and explain their significance. There is little value in filling a report with hypothetical features your website does not have.
The outcome should be an understandable record of the website’s functions, relevant safeguards and any practical changes required.
What a Digital Duty of Care risk assessment could mean for funeral homes
Funeral home websites need closer consideration because obituary pages can involve public contributions during a particularly sensitive time for families.
An obituary prepared and published by the funeral home differs from a tribute, condolence message or other contribution submitted by a visitor. A funeral home website risk assessment needs to distinguish these publishing processes and examine who approves each type of content.
Potential concerns include abusive messages, impersonation, malicious allegations, family disputes appearing publicly and the disclosure of sensitive information. These are practical scenarios to examine. The assessment would need to distinguish proposed online safety obligations from separate privacy, defamation and other legal issues.
GOOP Digital already provides a moderation facility for our funeral home clients. That is an existing safeguard we can examine and document as we prepare for the proposed requirements.
The next step is to demonstrate how moderation operates and who is accountable. Our proposed assessment would cover:
- Whether visitor contributions remain unpublished until approval.
- Who reviews submissions and who provides backup.
- What reviewers check before accepting a contribution.
- How concerning submissions are rejected or escalated.
- How families and other people can report a published contribution.
- What records show the decisions made and action taken.
The moderation facility supports the process. The funeral home’s review decisions and response procedures demonstrate how that safeguard is used.
For example, if somebody submits an abusive message beneath an obituary, the assessment should establish whether the system holds that message for review, whether the reviewer knows how to handle it and how the decision is recorded.
A clear process also needs to address concerns raised after publication. Families should have an accessible way to request a review, with an identified person responsible for responding.
What could your website risk assessment report include?
GOOP Digital is developing a practical report structure that explains what we examined, what we found and what needs attention.
The proposed report would include a description of the website and its features, relevant harm scenarios, existing safeguards, supporting evidence and recommended improvements. It would also identify who is responsible for each action and when the assessment should be reviewed.
For a straightforward service website, much of the report may explain why opportunities for the identified harms are limited. For a funeral home accepting public contributions, more detail would be needed about moderation, decisions and responses.
A completed report records the assessment. Action on its findings and evidence that safeguards work provide the accountability behind it.
How GOOP Digital is preparing for the proposed Digital Duty of Care
We are reviewing the proposed framework and developing assessment processes suited to the websites we build and support across regional Australia.
Our preparation includes identifying relevant website features, documenting existing safeguards and clarifying the responsibilities shared between GOOP Digital and each client. We will refine this approach as the legislation and supporting requirements are finalised.
You can help prepare by confirming who manages your website content, who receives enquiries or safety concerns and, where relevant, who approves public contributions.
To discuss how your website operates and what preparation may be appropriate, contact GOOP Digital.