The Parliamentary Counsel Office has made editorial and format changes to this version using the powers under subpart 2 of Part 3 of the Legislation Act 2019.

Note 4 at the end of this version provides a list of the amendments included in it.

These regulations are administered by the Department of Internal Affairs.

These regulations are made under section 102(1) of the Digital Identity Services Trust Framework Act 2023—

(a)

on the advice and with the consent of the Executive Council; and

(b)

on the recommendation of the Minister for Digitising Government made—

(i)

with the approval of the Trust Framework Board under section 28(1)(b) of that Act; and

(ii)

after consulting the Office of the Privacy Commissioner in accordance with section 102(3) of that Act.

1	Title
2	Commencement
3	Interpretation
4	Transitional, savings, and related provisions
	Accredited services
5	Types of accredited services
	Key information to be provided by applicants
6	Key information required in provider accreditation applications
7	Key information required in digital identity service accreditation applications
7A	Key information required in accreditation renewal applications
	Requirement for independent evaluations
8	Applicants must obtain independent evaluations
8A	Limited evaluations allowed for some accreditation renewal applications
	Assessment of applications
9	Assessment criteria for providers
10	Assessment criterion for digital identity services
11	Authority may seek advice from Privacy Commissioner
	Third party assessors
12	Certification as third party assessor
	Duration of accreditation
13	Accreditation expiry date
	Complaints process and dispute resolution
14	Complaints process must be established
15	Complaints process must incorporate industry-specific dispute resolution scheme or process
16	Complaints process must be publicly available
17	Information must be given to complainants
	Record-keeping and reporting
18	Information to be collected and kept
19	Six-monthly reports and annual reports
20	Incident notification
21	Retention period
22	Secure storage and disposal of information
	Complaints to TF authority
23	Complaints to TF authority must be in writing
	Schedule 1 Transitional, savings, and related provisions
	Schedule 2 Profile information about applicant
	Schedule 3 Profile information about digital identity service
	Schedule 4 Levels of assurance
	Gazette Information
	Notes

Regulations

1 Title

These regulations are the Digital Identity Services Trust Framework Regulations 2024.

2 Commencement

These regulations come into force on 24 October 2024.

3 Interpretation

In these regulations, unless the context otherwise requires,—

Act means the Digital Identity Services Trust Framework Act 2023

authentication service means a digital identity service (for example, a log-in service or a 2-factor authentication service) that enables a person to use an authenticator to access another service

authenticator means information or another thing (for example, a password or a fingerprint) that—

(a)

is known to, or possessed or controlled by, a person; and

(b)

is bound to the person during an interaction with a service; and

(c)

can be used by the person during subsequent interactions with the service to prove that they are the same person

bind, in relation to personal or organisational information, means to link securely to the correct individual or organisation by means of 1 or more checks that the information relates to that particular individual or organisation

binding service means a digital identity service that binds personal or organisational information

carrying on business in New Zealand has the meaning given in section 332 of the Companies Act 1993, except that the references to an overseas company must be treated as references to an organisation

credential means a digital record (for example, a digital vaccination record) that—

(a)

combines an authenticator and bound personal or organisational information; and

(b)

a relying party or another person can rely on without verifying the information

credential service means a digital identity service that creates a reusable credential

facilitation service means a digital identity service that enables a person to present a credential to a relying party

information service means a digital identity service that provides—

(a)

personal or organisational information; and

(b)

a level of assurance as to the accuracy of that information

level of assurance, in relation to personal information or organisational information, means a level of assurance determined in accordance with Schedule 4

New Zealand government agency means any part of the State services as defined in section 5 of the Public Service Act 2020

New Zealand resident means—

(a)

an individual who—

(i)

has a permanent place of residence in New Zealand, even if they also have a permanent place of residence elsewhere; and

(ii)

is a New Zealand citizen, holds a residence class visa granted under the Immigration Act 2009, or holds a visa granted under that Act that allows the individual to work or study in New Zealand; or

(b)

an organisation that is—

(i)

formed or incorporated in New Zealand; and

(ii)

carrying on business in New Zealand

service includes a product.

Regulation 3 level of assurance: inserted, on 28 May 2026, by regulation 4 of the Digital Identity Services Trust Framework Amendment Regulations 2026 (SL 2026/89).

4 Transitional, savings, and related provisions

The transitional, savings, and related provisions (if any) set out in Schedule 1 have effect according to their terms.

Accredited services

5 Types of accredited services

The following types of digital identity services may be accredited under the Act:

(a)

information services:

(b)

binding services:

(c)

authentication services:

(d)

credential services:

(e)

facilitation services.

Key information to be provided by applicants

6 Key information required in provider accreditation applications

(1)

An application for accreditation as a TF provider under the Act must include the following key information:

(a)

the profile information about the applicant specified in Schedule 2:

(b)

information about whether the applicant is a New Zealand resident or a New Zealand government agency:

(c)

information about whether the applicant has any interests in overseas defence contracts or overseas government contracts:

(d)

information about any data breaches, data losses, or cybersecurity attacks previously experienced by the applicant, and any controls implemented following those events:

(e)

information about the applicant’s organisational capabilities, including information about the people, processes, and systems that are, or are proposed to be, used to—

(i)

deliver any service for which accreditation is sought; and

(ii)

protect personal and organisational information:

(f)

information about the applicant’s complaints and dispute resolution processes:

(g)

information about whether the applicant is in receivership, in liquidation, bankrupt, or subject to a no asset procedure under subpart 4 of Part 5 of the Insolvency Act 2006 (or a similar procedure under a law of an overseas jurisdiction):

(h)

information showing that the applicant has appropriate policies and processes for ensuring staff recruitment and service contracting are consistent with the TF rules and the regulations and will not pose a risk to—

(i)

the security, privacy, confidentiality, or safety of the information of any trust framework participants:

(ii)

the integrity or reputation of the trust framework:

(i)

a copy of the applicant’s criminal record, or an overseas equivalent if requested by the TF authority:

(j)

if the applicant is or has been the subject of a formal investigation or proceeding by or taken by the Privacy Commissioner, details of the status or outcome of the investigation or proceeding.

(2)

The information provided under subclause (1)(h) must include information showing that the applicant has arrangements for checking whether the people involved, or proposed to be involved, in the governance, management, design, or delivery of any service for which accreditation is sought—

(a)

have been convicted of a criminal offence in New Zealand or overseas:

(b)

have been, or are currently, the subject of a formal investigation or proceeding by or taken by the Privacy Commissioner.

(3)

In subclause (1)(c), (i), and (j),—

applicant has the same meaning as in section 25 of the Act

applicant’s criminal record means a document giving all details recorded in law enforcement information held by or on behalf of the Ministry of Justice of any criminal conviction of the applicant (whether a conviction in New Zealand or overseas).

(4)

See also section 25(1) of the Act, which requires the applicant to provide additional specified information.

7 Key information required in digital identity service accreditation applications

(1)

An application for accreditation of a digital identity service as an accredited service must include the following key information:

(a)

the profile information about the service specified in Schedule 3:

(b)

information as to how the applicant will meet the service standards, and comply with the processes, specified in TF rules in relation to the service.

(2)

See also section 25(1) of the Act, which requires the applicant to provide additional specified information.

7A Key information required in accreditation renewal applications

(1)

This regulation applies to applications to renew the accreditation of—

(a)

a TF provider; or

(b)

an accredited digital identity service.

(2)

A renewal application must include the same key information as an application for accreditation as a TF provider (as specified in regulation 6) or an application for accreditation of a digital identity service (as specified in regulation 7).

(3)

However, if subclause (4) applies to a piece of key information, the application may instead include, as key information, a declaration that—

(a)

the key information that the applicant has given the TF authority in that area is up to date; and

(b)

the applicant is in compliance with their obligation to tell the TF authority about any changes to the key information in that area.

(4)

This subclause applies to a piece of key information if 1 or more of the following apply in relation to the key information:

(a)

the key information has not changed since the previous renewal application (or, in the case of an accreditation that has not yet been renewed, the accreditation application):

(b)

all of the changes to the key information since the application referred to in paragraph (a) have been communicated to the TF authority in accordance with section 33(1) of the Act:

(c)

the key information—

(i)

would need to be included in a full independent evaluation in an area prepared for the application; but

(ii)

is not included in the application’s independent evaluation in that area because the independent evaluation is a limited evaluation (see regulation 8A).

(5)

If a renewal application includes a declaration in accordance with subclause (3), the declaration must also—

(a)

identify the key information to which the declaration relates; and

(b)

record the basis on which subclause (4) applies to the key information.

Regulation 7A: inserted, on 28 May 2026, by regulation 5 of the Digital Identity Services Trust Framework Amendment Regulations 2026 (SL 2026/89).

Requirement for independent evaluations

8 Applicants must obtain independent evaluations

(1)

An application for accreditation or renewal of an accreditation under the Act must include an evaluation from an independent evaluator in each of the following areas:

(a)

security:

(b)

privacy:

(c)

identification management.

(2)

The evaluation must state whether, in the opinion of the independent evaluator, the criteria in regulation 9 or 10 for the assessment of the application are met in that area.

(3)

In this regulation, independent evaluator, in relation to an area, means an individual or organisation considered by the TF authority to have the skills, knowledge, and experience necessary to carry out evaluations in that area to a reasonable standard.

Regulation 8(1): amended, on 28 May 2026, by regulation 6 of the Digital Identity Services Trust Framework Amendment Regulations 2026 (SL 2026/89).

8A Limited evaluations allowed for some accreditation renewal applications

(1)

The independent evaluations included in an application to renew an accreditation (as required by regulation 8(1)) must meet or exceed the requirements set out in subclause (2), (3), or (4) (as applicable).

Requirements for high-confidence applications

(2)

For a high-confidence application, the evaluation in each of the 3 areas referred to in regulation 8(1) may be limited to things that have changed or occurred in the area since the last evaluation in that area was completed (a limited evaluation).

Requirements for medium-confidence applications

(3)

For a medium-confidence application,—

(a)

the evaluation in the area of security must be a full evaluation; but

(b)

the evaluation in the area of privacy and the area of identification management may be a limited evaluation.

Requirements for low-confidence applications

(4)

For a low-confidence application, the evaluation in each of the 3 areas referred to in regulation 8(1) must be a full evaluation.

(5)

In this regulation, an application is—

(a)

high-confidence if, in the opinion of the TF authority, both of the following apply to the application:

(i)

there have been no changes to the TF provider or accredited service since the last accreditation decision or, if there have been changes, those changes are minor:

(ii)

there have been no compliance or performance issues during the accreditation or, if there have been compliance or performance issues, those issues are minor:

(b)

medium-confidence if the application is not a low-confidence application and, in the opinion of the TF authority, either of the following apply to the application:

(i)

there have been changes to the TF provider or the accredited service since the last accreditation decision that are more than minor:

(ii)

there have been compliance or performance issues during the accreditation that are more than minor:

(c)

low-confidence if, in the opinion of the TF authority, any of the following apply to the application:

(i)

there have been significant changes to the TF provider or the accredited service since the last accreditation decision:

(ii)

there have been significant compliance or performance issues during the accreditation:

(iii)

it is not possible to determine whether the application is high-confidence, medium-confidence, or low-confidence (under subparagraph (i) or (ii)) based on the information available to the TF authority.

Regulation 8A: inserted, on 28 May 2026, by regulation 7 of the Digital Identity Services Trust Framework Amendment Regulations 2026 (SL 2026/89).

Assessment of applications

9 Assessment criteria for providers

The criteria under section 26(1)(b) of the Act for the assessment of an application for accreditation as a TF provider (including an application to renew an accreditation as a TF provider) are that the applicant—

(a)

is a New Zealand resident or a New Zealand government agency; and

(b)

will not pose a risk to New Zealand’s national security or national interests; and

(c)

has a complaints process that meets the requirements in regulations 14 to 17; and

(d)

is not in receivership, in liquidation, bankrupt, or subject to a no asset procedure under subpart 4 of Part 5 of the Insolvency Act 2006 (or a similar procedure under a law of an overseas jurisdiction); and

(e)

has appropriate policies and processes for ensuring staff recruitment and service contracting are consistent with the TF rules and the regulations and will not pose a risk to—

(i)

the security, privacy, confidentiality, or safety of the information of any trust framework participants:

(ii)

the integrity or reputation of the trust framework.

Regulation 9: amended, on 28 May 2026, by regulation 8 of the Digital Identity Services Trust Framework Amendment Regulations 2026 (SL 2026/89).

10 Assessment criterion for digital identity services

The criterion under section 26(1)(b) of the Act for the assessment of an application for accreditation of a digital identity service (including an application to renew the accreditation of a digital identity service) is that the service is a service that the applicant can provide in a way that meets the service standards, and complies with the processes, specified in the TF rules.

Regulation 10: amended, on 28 May 2026, by regulation 9 of the Digital Identity Services Trust Framework Amendment Regulations 2026 (SL 2026/89).

11 Authority may seek advice from Privacy Commissioner

(1)

When assessing an application under section 26 of the Act, the TF authority may request information from the Privacy Commissioner about—

(a)

whether the applicant is or has been the subject of a formal investigation or proceeding by or taken by the Privacy Commissioner; and

(b)

the status or outcome of any such investigation or proceeding.

(2)

In this regulation, applicant has the same meaning as in section 25 of the Act.

Third party assessors

12 Certification as third party assessor

(1)

The TF authority may certify an individual or organisation as a third party assessor to carry out accreditation assessments in 1 or more of the following areas:

(a)

security:

(b)

privacy:

(c)

identification management.

(2)

An individual or organisation may apply in writing to the TF authority to be certified as a third party assessor.

(3)

The application must—

(a)

specify the area to which it relates; and

(b)

include information showing that the applicant has the skills, knowledge, and experience necessary to carry out accreditation assessments in that area to a reasonable standard.

(4)

The TF authority may certify an individual or organisation as a third party assessor in relation to an area only if satisfied that the individual or organisation has the skills, knowledge, and experience necessary to carry out accreditation assessments in that area to a reasonable standard.

(5)

In this regulation, accreditation assessments means the TF authority’s function of assessing whether an individual or organisation meets the criteria in regulation 9 or 10 for the assessment of an application for accreditation.

Duration of accreditation

13 Accreditation expiry date

An accreditation expires under section 30(1)(c) of the Act at the end of the 3-year period beginning with the date on which the accreditation commenced or was renewed.

Complaints process and dispute resolution

14 Complaints process must be established

(1)

A TF provider must establish and maintain an accessible complaints process for dealing with complaints fairly, promptly, without undue formality, and with regard to tikanga Māori where applicable.

(2)

A TF provider must consider any complaint in accordance with their complaints process.

(3)

In this regulation, complaint means a complaint made to the TF provider about an alleged breach by the TF provider of the TF rules, the regulations, terms of use of accreditation marks, or provisions of the Act.

15 Complaints process must incorporate industry-specific dispute resolution scheme or process

(1)

This regulation applies if a TF provider is a party to a dispute resolution scheme or process because of the TF provider’s membership of a particular industry.

(2)

The TF provider’s complaints process must include the use of that industry-specific dispute resolution scheme or process.

16 Complaints process must be publicly available

A TF provider must publish their complaints process on a publicly accessible internet site maintained by or on behalf of the TF provider.

17 Information must be given to complainants

A TF provider must tell complainants that they may complain to the TF authority if they are dissatisfied with the outcome of the TF provider’s complaints process.

Record-keeping and reporting

18 Information to be collected and kept

(1)

A TF provider must collect and keep the following information under section 42 of the Act:

(a)

information showing that the provider has provided their accredited services in accordance with the requirements of the Act, the TF rules, and the regulations:

(b)

information required to be included in reports under regulation 19:

(c)

information required to be included in incident notifications under regulation 20.

(2)

The information collected and kept under subclause (1)(a)—

(a)

must include records of transactions, events, and actions occurring in the normal course of users starting, progressing, and completing their digital transactions; but

(b)

must not include personal information.

19 Six-monthly reports and annual reports

(1)

After the end of each 6-month period, a TF provider must give the TF authority a report about the use of their accredited services during that period, including the types and volume of services provided and the number of credentials issued by the TF provider.

(2)

After the end of each 12-month period, a TF provider must give the TF authority a report about—

(a)

the delivery of their accredited services during that period, including—

(i)

steps taken by the TF provider to ensure accredited services are delivered in accordance with the TF rules and the regulations; and

(ii)

any breaches of the TF rules and the regulations; and

(iii)

action taken to remedy any breaches of the TF rules and the regulations; and

(iv)

steps taken to improve delivery of the accredited services; and

(b)

complaints and dispute resolution during the 12-month period, including—

(i)

the number and types of complaints made to the TF provider; and

(ii)

the outcomes of complaints, including details of any remedies; and

(c)

the status or outcome during the 12-month period of any incidents reported to the TF authority under regulation 20.

(3)

In this regulation,—

6-month period means a period of 6 months beginning on 1 March or 1 September

12-month period means a period of 12 months beginning on 1 March.

(4)

A report required by this regulation must be given to the TF authority—

(a)

no later than 1 month after the end of the period to which it relates; or

(b)

if a later date is agreed by the TF provider and the TF authority, by that date.

(5)

Reports under this regulation must be in the form, and be made in the manner, approved by the TF authority.

Regulation 19(3) 6-month period: amended, on 28 May 2026, by regulation 10(1) of the Digital Identity Services Trust Framework Amendment Regulations 2026 (SL 2026/89).

Regulation 19(3) 12-month period: amended, on 28 May 2026, by regulation 10(2) of the Digital Identity Services Trust Framework Amendment Regulations 2026 (SL 2026/89).

20 Incident notification

(1)

A TF provider must notify the TF authority of any incident relating to the TF provider, or to an accredited service of the TF provider, as soon as practicable.

(2)

In this regulation, incident means an actual or a suspected event, including a cybersecurity event or fraud, that does or would do any of the following:

(a)

adversely affect privacy or confidentiality:

(b)

adversely affect the integrity or availability of an accredited service:

(c)

cause, or risk causing, serious harm to a trust framework participant.

(3)

See also section 114 of the Privacy Act 2020, which requires TF providers to also notify the Privacy Commissioner of some incidents.

21 Retention period

A TF provider must keep information collected under section 42 of the Act until the later of the following:

(a)

12 months from the date on which the TF provider’s accreditation as a TF provider ends:

(b)

12 months from the date on which the TF provider last used that information.

22 Secure storage and disposal of information

(1)

A TF provider must securely store any information kept under section 42 of the Act, in a manner that ensures that the information—

(a)

remains unaltered; and

(b)

is readily retrievable in a timely manner on request by the TF authority.

(2)

A TF provider must have a secure way of disposing of any records that are no longer required.

Complaints to TF authority

23 Complaints to TF authority must be in writing

A complaint made to the TF authority under section 69 of the Act must be in writing.

Schedule 1 Transitional, savings, and related provisions

r 4

Part 1 Provisions relating to these regulations as made

There are no transitional, savings, or related provisions in these regulations as made.

Part 2 Provision relating to Digital Identity Services Trust Framework Amendment Regulations 2026

Schedule 1 Part 2: inserted, on 28 May 2026, by regulation 11(a) of the Digital Identity Services Trust Framework Amendment Regulations 2026 (SL 2026/89).

1 Transitional arrangements relating to reporting obligations under regulation 19

(1)

This clause applies if a TF provider is required to give the TF authority either of the following:

(a)

a report under regulation 19(1) for the 6-month period that begins on 1 March 2026 and ends on 31 August 2026:

(b)

a report under regulation 19(2) for the 12-month period that begins on 1 March 2026 and ends on 28 February 2027.

(2)

The report referred to in subclause (1)(a) must cover a period that begins on 1 January 2026 and ends on 31 August 2026 (instead of a 6-month period beginning on 1 March 2026).

(3)

The report referred to in subclause (1)(b) must cover a period that begins on 1 January 2026 and ends on 28 February 2027 (instead of a 12-month period beginning on 1 March 2026).

Schedule 1 clause 1: inserted, on 28 May 2026, by regulation 11(a) of the Digital Identity Services Trust Framework Amendment Regulations 2026 (SL 2026/89).

Schedule 2 Profile information about applicant

r 6(1)(a)

Information to be provided by every applicant:

the applicant’s name and any trading names of the applicant:
the applicant’s New Zealand Business Number (if any):
whether the applicant is an individual or an organisation:
the applicant’s address and internet site address:
details of individuals with material control over the applicant (for example, board members and chief executives).

Additional information to be provided by an applicant that is an organisation (excluding a New Zealand government agency):

the type of organisation:
whether the organisation is registered or incorporated in New Zealand:
the organisation’s registered address:
whether the organisation is a subsidiary of an overseas organisation or has offices overseas:
information on the ownership structure (if any) of the organisation.

Schedule 3 Profile information about digital identity service

r 7(1)(a)

Information to be provided about every service for which accreditation is sought:

the applicant’s name and any trading names of the applicant:
the applicant’s New Zealand Business Number (if any):
the name (if any) and general description of the service:
details of individuals involved, or proposed to be involved, in the governance of the service:
details of individuals involved, or proposed to be involved, in the management, design, or delivery of the service.

Schedule 4 Levels of assurance

r 3

Schedule 4: inserted, on 28 May 2026, by regulation 12 of the Digital Identity Services Trust Framework Amendment Regulations 2026 (SL 2026/89).

1 Interpretation

In this schedule, unless the context otherwise requires,—

authoritative source, in relation to a piece of personal information or organisational information, means a primary record of the information (for example, the registry of births, deaths, and relationships)

biometric factor means biometric information about a person that is used to bind the personal information or organisational information to the person in a way that satisfies the requirements set out in the TF rules

biometric information, in relation to a person,—

(a)

means personal information about the person that relates to any of the following:

(i)

a physical feature or quality of any part of the person’s body, including their face, fingerprints, palm prints, iris, retina, voice, or vein patterns:

(ii)

a combination of any such distinctive attributes, including the way the person sounds when they speak; and

(b)

includes—

(i)

an analogue or digital record of those attributes; and

(ii)

a numerical or algorithmic representation extracted from such a record

direct copy, in relation to an authoritative source, means a copy of all or part of the authoritative source that is made directly from the authoritative source (for example, a birth certificate issued by the Registrar-General)

indirect copy, in relation to an authoritative source, means a copy of all or part of a direct copy of the authoritative source (for example, a photocopy of a birth certificate issued by the Registrar-General)

knowledge factor means something that is known to, and can be recalled or reproduced by, a person (for example, a password or personal identification number) that is used to bind the personal information or organisational information to the person in a way that satisfies the requirements set out in the TF rules

possession factor means a thing that is in the possession or control of a person that is used to bind the personal information or organisational information to the person in a way that satisfies the requirements set out in the TF rules

Registrar-General has the meaning given in section 4 of the Births, Deaths, Marriages, and Relationships Registration Act 2021.

Schedule 4 clause 1: inserted, on 28 May 2026, by regulation 12 of the Digital Identity Services Trust Framework Amendment Regulations 2026 (SL 2026/89).

2 Levels of assurance

Levels of assurance that may apply to information

(1)

The levels of assurance that may apply in relation to personal information or organisational information that is used or relied on to provide an accredited service are as follows:

(a)

basic:

(b)

standard (including the standard+ subcategory):

(c)

strong (including the strong+ subcategory):

(d)

very strong.

How applicable level of assurance is determined

(2)

A piece of personal information or organisational information has the level of assurance specified in the first column of the table below if the information assurance and binding assurance requirements for the level (specified in the third and fourth columns of the table) are both met or exceeded in relation to the information.

(3)

If a piece of personal information or organisational information satisfies the requirements for more than 1 level of assurance, the highest of those levels of assurance is the level of assurance that applies to the information (the lowest level of assurance being basic and the highest level of assurance being very strong).

When standard+ and strong+ subcategories apply

(4)

A level of assurance subcategory, specified in the second column of the table, applies to a piece of personal information or organisational information if—

(a)

the corresponding level of assurance, specified in the first column of the table, applies to the information; and

(b)

a biometric factor was used to satisfy the minimum binding assurance requirement for that level of assurance.

(5)

The table is as follows:

Level of assurance	Subcategory	Minimum information assurance required	Minimum binding assurance required
Basic	N/A	Information accepted as accurate without verification or verified in a way that does not satisfy the requirements for a higher level of assurance	No binding assurance undertaken
Standard	Standard+ (see clause 2(4))	Information verified as an indirect copy of an authoritative source	Information must be bound to the person in one of the following ways: a possession factor: a biometric factor: a knowledge factor Integrity of binding must be protected by security measures that satisfy the security requirements for a standard level of assurance specified in the TF rules
Strong	Strong+ (see clause 2(4))	Information verified as a direct copy of an authoritative source	Information must be bound to the person in 2 of the following ways: a possession factor: a biometric factor: a knowledge factor Integrity of binding must be protected by security measures that satisfy the security requirements for a strong level of assurance specified in the TF rules
Very strong	N/A	Information verified in one of the following ways: as an authoritative source: as a source that is continuously synchronised with an authoritative source	Information must be bound to the person by a biometric factor and in one of the following ways: a possession factor: a knowledge factor Integrity of binding must be protected by security measures that satisfy the security requirements for a very strong level of assurance specified in the TF rules

Schedule 4 clause 2: inserted, on 28 May 2026, by regulation 12 of the Digital Identity Services Trust Framework Amendment Regulations 2026 (SL 2026/89).

Nicola Purvis,
Acting Clerk of the Executive Council.

Issued under the authority of the Legislation Act 2019.

Date of notification in Gazette: 26 September 2024.

Notes

1 General

This is a consolidation of the Digital Identity Services Trust Framework Regulations 2024 that incorporates the amendments made to the legislation so that it shows the law as at its stated date.

2 Legal status

A consolidation is taken to correctly state, as at its stated date, the law enacted or made by the legislation consolidated and by the amendments. This presumption applies unless the contrary is shown.

Section 78 of the Legislation Act 2019 provides that this consolidation, published as an electronic version, is an official version. A printed version of legislation that is produced directly from this official electronic version is also an official version.

3 Editorial and format changes

The Parliamentary Counsel Office makes editorial and format changes to consolidations using the powers under subpart 2 of Part 3 of the Legislation Act 2019. See also PCO editorial conventions for consolidations.

4 Amendments incorporated in this consolidation

Digital Identity Services Trust Framework Amendment Regulations 2026 (SL 2026/89)

Sort by