The expanded protections apply to a "standard form small business contract" — broadly, a contract where:

• At least one party is a small business (the eligibility test was broadened as part of this reform to capture a larger range of businesses than previously covered)
• The contract is a "standard form" contract — generally meaning one party has significantly more bargaining power and the contract is offered on a take-it-or-leave-it basis, without genuine negotiation of the specific terms

Many businesses assume unfair contract term protections are something that applies to consumer contracts and doesn't touch their B2B supplier or customer agreements. That assumption is incorrect — a standard form contract between two businesses can absolutely be captured, particularly where a larger business is contracting with a smaller one on its own standard terms.

Not every security incident triggers notification obligations. The threshold is specifically an "eligible data breach" — broadly, one where:

• There's unauthorised access to, unauthorised disclosure of, or loss of personal information held by the business, and
• This is likely to result in serious harm to one or more individuals whose information is involved, and
• The business hasn't been able to prevent the likely risk of serious harm through remedial action taken before serious harm occurs

"Serious harm" isn't limited to financial loss — it can include harm such as identity theft risk, reputational damage, or other significant harm to the individual, depending on the nature of the information involved and the circumstances of the breach.

If an eligible data breach has occurred (or is reasonably suspected), the business generally needs to:

1. Carry out a reasonable and expeditious assessment, generally within a defined timeframe, to determine whether the breach meets the eligible data breach threshold.
2. Notify the OAIC, providing details of the breach, the kind of information involved, and recommendations for individuals affected.
3. Notify affected individuals, or if that's not practicable, publish a notification prominently and take reasonable steps to publicise it, so affected individuals have a genuine opportunity to become aware of the breach and its implications.

Once validly served, the company has 21 days to either:

• Pay the debt in full, or
• Apply to a court to have the statutory demand set aside, on specific grounds (such as a genuine dispute about the debt, an offsetting claim, or a defect in the demand itself), or
• Reach a settlement or payment arrangement with the creditor that resolves the demand

If none of these happen within the 21-day period, the company is presumed to be insolvent for the purposes of a winding-up application — this presumption arises specifically from the failure to respond, separate from whether the company was actually insolvent in a broader financial sense. A creditor can then apply to court to wind up the company based on this presumption, and the company faces a considerably harder task defending that application after the fact than it would have faced responding within the original 21 days.

If your business has received a statutory demand, the most important thing is speed — get advice immediately, don't wait to "figure out the best approach" over several days while the clock continues to run.

RBizz  works alongside insolvency lawyers to help directors respond to statutory demands quickly and appropriately — contact us immediately if you've received one.

Without safe harbour, a director facing a genuinely difficult trading period has faced a difficult choice: stop trading and potentially appoint an administrator or liquidator prematurely (even where the business might have been salvageable), or continue trading and risk personal liability if the company is later found to have been insolvent during that period. This created pressure toward premature external administration, sometimes destroying value that could have been preserved with a genuine restructuring effort.

Safe harbour exists to give directors room to attempt a genuine turnaround, without the constant threat of personal liability hanging over every trading decision made during that period.

If the conditions are met, safe harbour protects a director from personal liability for debts incurred during a period where the director was developing and implementing a course of action reasonably likely to lead to a better outcome for the company than immediate administration or liquidation.

This is a conditional protection — it doesn't apply automatically simply because a director believes they're doing their best. Specific requirements need to be met and maintained throughout the relevant period.

Beyond the director residency requirement, Australian tax law also looks at where a company's central management and control actually takes place when determining tax residency. This matters because a company's tax residency status affects how its income is taxed in Australia, and potentially in the parent company's home jurisdiction as well.

The director residency requirement and the broader question of tax residency aren't just box-ticking exercises — they establish the legal and tax foundation the Australian entity operates on. Getting this right from the outset avoids more complex questions arising later, particularly if the company's tax residency position is ever reviewed or challenged.

RBizz provides resident director services and reviews governance arrangements for foreign-owned Australian companies — schedule a free consultation to make sure your structure is properly established.

For a small volume of international sales, an incorrect GST assumption might go unnoticed. As digital sales scale — which is often the explicit goal for software, subscription, and online content businesses — an incorrect GST treatment compounds across a growing transaction volume, turning a manageable correction into a much larger reconciliation exercise if left unaddressed.