Australia
Sydney · ap-southeast-2
- Rules
- 10
- Local overlays
- 9
Find the rules that reach your email data, mapped to the real path.
Choose a country, search the regulation, and get the actual answer: who it applies to, what it requires, how location changes the email path, and what your team still owns.
- Countries mapped
- 1
- Rules indexed
- 10
- Primary sources
- 16
- Sources checked
- 2026-08-16
Every published rule, in one directory.
Search, or pick a country, then scan the rules by category and open the page that maps the rule to the real email path.
11 rules and guides published.
Federal baseline
The rules that apply before any industry or state overlay is added.
Incident response
What a regulated entity owes once a breach is likely to cause serious harm.
Healthcare system
Extra obligations tied to health information and health-specific systems.
Jurisdiction overlay
State and territory rules layered on top of the federal baseline.
Financial services
Prudential and security standards for regulated financial entities.
APRA CPS 230
CPS 230 is not a blanket data-localisation rule. It does make offshore service delivery, including the physical location of relevant data or personnel, a specific governance and notification consideration when the arrangement is material.
Stronger offshore governanceOpenAPRA CPS 234
CPS 234 focuses on control effectiveness rather than a country pin. Residency becomes useful when it reduces an untrusted environment and produces clearer evidence about access, lifecycle, and third parties.
Third-party assuranceOpen
Consumer data
Rules attached to data shared under a consumer data scheme.
Critical infrastructure
Security obligations for systems treated as critical infrastructure.
Government procurement
What a government buyer expects from a vendor's information system.
Message conduct
Consent and identification rules for commercial electronic messages.
Industry guides
The rules above, connected to one industry's real email workflows.
Countries
A country is published only when the regional plane, applicable rules, primary sources, and known exceptions can be shown together.
Additional countries
Not published until the infrastructure and evidence are real
The model is global. The directory is deliberately smaller than the roadmap so nobody mistakes a planned region for a live one.
Read the region roadmapHow to use the answers
This directory narrows the engineering and vendor-review problem. It does not decide legal applicability for an unknown organisation.
- 01
Start with the regulated entity.
The same message can be ordinary for one company and governed by health, financial, government, or critical-infrastructure rules for another.
- 02
Classify the exact data and system.
Recipient addresses, reset links, health context, attachments, logs, and delivery events do not automatically inherit the same handling rule.
- 03
Trace the complete email path.
A location claim must survive queues, logs, webhooks, support access, subprocessors, retention, deletion, and final delivery to the mailbox provider.
The source is part of the answer.
Every rule page links to the legislation, regulator standard, or official guidance used to write it. Each source carries its last checked date. Live procurement and legal decisions should always return to that primary material.
Primary material first
Regulators, legislation registers, government security guidance, and Boundry’s published architecture.
Scope before slogans
Every answer separates who is covered, what is required, what location changes, and what it does not solve.
Dates stay visible
Laws and product boundaries move. The page shows when each source was checked so stale answers are easier to spot.
Boundry Rules is an engineering and vendor-evaluation resource, not legal advice.
Put the rule next to the email path.
Start with one Australian transactional workflow. Classify the data, map the path, and give the reviewer evidence instead of a region slogan.