Australia
Sydney · ap-southeast-2
- Rules
- 10
- Local overlays
- 9
Find the rules that reach your email data.
Choose a country, search the regulation, and get the actual answer: who it applies to, what it requires, how location changes the email path, and what your team still owns.
- Countries mapped
- 1
- Rules indexed
- 10
- Primary sources
- 16
- Sources checked
- 2026-08-16
All published rules
10 results
Australia · Privacy Act + APPs · Federal baseline
Privacy Act 1988 and Australian Privacy Principles
No blanket localisation
→Australia · NDB scheme · Incident response
Notifiable Data Breaches scheme
Security and evidence
→Australia · My Health Record · Healthcare system
My Health Records Act 2012 — section 77
Explicit Australian boundary
→Australia · State privacy laws · Jurisdiction overlay
State and territory privacy and health-record laws
Scope varies by state
→Australia · APRA CPS 230 · Financial services
CPS 230 Operational Risk Management
Stronger offshore governance
→Australia · APRA CPS 234 · Financial services
CPS 234 Information Security
Third-party assurance
→Australia · CDR safeguards · Consumer data
Consumer Data Right Privacy Safeguards
Restricted overseas disclosure
→Australia · SOCI Act · Critical infrastructure
Security of Critical Infrastructure Act 2018
Risk and incident governance
→Australia · PSPF / ISM / IRAP · Government procurement
Australian Government cloud security assessment framework
Classification and assurance
→Australia · Spam Act · Message conduct
Spam Act 2003
Consent and unsubscribe
→Countries
A country is published only when the regional plane, applicable rules, primary sources, and known exceptions can be shown together.
Additional countries
Not published until the infrastructure and evidence are real
The model is global. The directory is deliberately smaller than the roadmap so nobody mistakes a planned region for a live one.
Read the region roadmap →How to use the answers
This directory narrows the engineering and vendor-review problem. It does not decide legal applicability for an unknown organisation.
- 01
Start with the regulated entity.
The same message can be ordinary for one company and governed by health, financial, government, or critical-infrastructure rules for another.
- 02
Classify the exact data and system.
Recipient addresses, reset links, health context, attachments, logs, and delivery events do not automatically inherit the same handling rule.
- 03
Trace the complete email path.
A location claim must survive queues, logs, webhooks, support access, subprocessors, retention, deletion, and final delivery to the mailbox provider.
The source is part of the answer.
Every rule page links to the legislation, regulator standard, or official guidance used to write it. Each source carries its last checked date. Live procurement and legal decisions should always return to that primary material.
Primary material first
Regulators, legislation registers, government security guidance, and Boundry’s published architecture.
Scope before slogans
Every answer separates who is covered, what is required, what location changes, and what it does not solve.
Dates stay visible
Laws and product boundaries move. The page shows when each source was checked so stale answers are easier to spot.
Boundry Rules is an engineering and vendor-evaluation resource, not legal advice.