Australia Spam Act 2003
Australia's law on commercial email and SMS: consent before sending, no messages to non-existent addresses, clear sender identity and contact details, a free, login-free unsubscribe facility that works for 30 days, opt-outs honoured within 5 business days, no address harvesting, and liability for anyone knowingly involved.
Australia Spam Act 2003 is a compliance framework from Australia (Commonwealth) with 4 domains and 12 controls that map to 4 other frameworks. The largest domains are Part 2: Rules for sending commercial electronic messages – Australia Spam Act 2003 (5 controls), Part 3: Address-harvesting software and harvested-address lists – Australia Spam Act 2003 (3 controls), Schedule 2: Consent and its withdrawal – Australia Spam Act 2003 (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
Part 2: Rules for sending commercial electronic messages – Australia Spam Act 2003
| Code | Title |
|---|---|
| australia-spam-act-2003::s16-1 | s 16(1) Send commercial electronic messages only with the recipient's consent |
| australia-spam-act-2003::s16-6 | s 16(6) Do not send commercial messages to addresses not believed to exist |
| australia-spam-act-2003::s16-9 | s 16(9) Do not aid, induce or be knowingly concerned in unsolicited or non-existent-address sends |
| australia-spam-act-2003::s17 | s 17(1) Identify the authoriser and give accurate contact details valid for 30 days |
| australia-spam-act-2003::s18 | s 18(1) Include a functional, conspicuous unsubscribe facility that works for 30 days |
Part 3: Address-harvesting software and harvested-address lists – Australia Spam Act 2003
| Code | Title |
|---|---|
| australia-spam-act-2003::s20 | s 20 Do not supply address-harvesting software or harvested-address lists |
| australia-spam-act-2003::s21 | s 21 Do not acquire address-harvesting software or harvested-address lists |
| australia-spam-act-2003::s22 | s 22 Do not use address-harvesting software or harvested-address lists for unsolicited sends |
Schedule 2: Consent and its withdrawal – Australia Spam Act 2003
| Code | Title |
|---|---|
| australia-spam-act-2003::sch2-c2 | Sch 2 cl 2 Hold express or reasonably inferred consent for each recipient |
| australia-spam-act-2003::sch2-c4 | Sch 2 cl 4 Do not infer consent from a published address except conspicuous work publication |
| australia-spam-act-2003::sch2-c6 | Sch 2 cl 6 Stop commercial messages within 5 business days of an unsubscribe request |
Spam Regulations 2021 – Australia Spam Act 2003
| Code | Title |
|---|---|
| australia-spam-act-2003::r7 | Spam Regulations 2021 s 7 Unsubscribe address conditions: no cost, no fee, no personal information, no login |
Your Compliance Coverage
If you comply with Australia Spam Act 2003, you already cover:
Canada's Anti-Spam Legislation (CASL)
92%
11 controls mapped
Compare →UK Privacy and Electronic Communications Regulations 2003 (PECR)
33%
4 controls mapped
Compare →Australian Privacy Principles (APPs)
25%
3 controls mapped
Compare →+ 1 more: EU ePrivacy Directive (2002/58/EC) (25%)
See all 4 mapped frameworks ↓Maps to 4 other frameworks
Coverage is not the same as your position
This page shows what Australia Spam Act 2003 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Australia Spam Act 2003 and who does it apply to?
Australia Spam Act 2003 is a compliance framework from Australia (Commonwealth) with 4 domains and 12 controls. Australia's law on commercial email and SMS: consent before sending, no messages to non-existent addresses, clear sender identity and contact details, a free, login-free unsubscribe facility that works for 30 days, opt-outs honoured within 5 business days, no address harvesting, and liability for anyone knowingly involved. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Australia Spam Act 2003 actually require?
Australia Spam Act 2003 has 12 controls organised across 4 domains. The largest domains are Part 2: Rules for sending commercial electronic messages – Australia Spam Act 2003 (5 controls), Part 3: Address-harvesting software and harvested-address lists – Australia Spam Act 2003 (3 controls), Schedule 2: Consent and its withdrawal – Australia Spam Act 2003 (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Australia Spam Act 2003 do I already cover?
Australia Spam Act 2003 maps to 4 other compliance frameworks. The top mapping partners are Canada's Anti-Spam Legislation (CASL) (92% coverage), UK Privacy and Electronic Communications Regulations 2003 (PECR) (33% coverage), Australian Privacy Principles (APPs) (25% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Australia Spam Act 2003?
Start your Australia Spam Act 2003 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Australia Spam Act 2003 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 12 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 849 frameworks.
Get Started Free →Free forever — no credit card required