AICD submission on access to information on the companies register

On 12 October 2026, the AICD made a submission to ASIC on proposed access arrangements to information on the companies register, including director personal information. These proposals follow the passage of legislation in early 2026 requiring companies to provide director IDs to ASIC to enable directors IDs to be linked to the companies register from 1 July 2027.

Our submission is supportive of linking director IDs to the companies register. This step is key to achieving the policy aims of the director ID regime and strengthening the integrity and utility of information on the companies register.

Critically, it also provides the opportunity to resolve the significant privacy and safety risks of director personal information being publicly available on the companies register. Reflecting the strong concerns of AICD members, we have long advocated for the removal of sensitive director personal information on the companies register, including residential address and dates of birth information.

Directors face significant privacy, cyber and personal safety risks arising from the public availability of personal information. These risks are not confined to large listed entities or high-profile directors. They extend across the director community, including directors of small and family-owned businesses, community and NFP organisations. Importantly, the impacts of publicly disclosing a residential address go beyond directors themselves, exposing their families to the same privacy and safety risks.

The key points in our submission were:

• Tiered access: We strongly supported ASIC’s proposed tiered access arrangements, which contemplates different layers of access for different user groups across four main categories: general public, company, business and government. We consider it is appropriate that users of the companies register with legitimate administrative, business, professional (including journalistic) or regulatory purposes for accessing officeholder personal information continue to be given full access to this information.

• Residential addresses: We did not support ASIC’s proposal to enable directors’ residential addresses to be publicly available on the companies register where an alternative service address is not provided. We consider that residential addresses should be removed from public availability on a permanent basis. There is no legitimate public interest in continuing public access to directors’ residential address information. Authenticated company, business (including media) and government users with legitimate needs will continue to have access to this information under the proposed tiered access settings. The linkage of director IDs to the companies register and their proposed public disclosure will also mean that directors’ residential addresses are no longer required as identifying information for the general public.

• Service address: We recommended that a company’s registered office address be disclosed as the publicly available service address by default, unless a director elects to provide an alternative service address. This would ensure ongoing protection and mitigate the risk of directors not taking the step of nominating a service address, recognising the significant awareness raising challenge for over 3 million Australian directors - including directors of small family-owned businesses, community organisations and NFPs.

• Date of birth information: We strongly supported ASIC’s proposal to restrict public access to directors’ full dates of birth and instead provide access to a year of birth only. Full dates of birth are sensitive personal information and public disclosure, both on their own and together with residential address information, creates unnecessary and elevated privacy, fraud and cyber security risks.

• Director ID numbers: We supported the publication of director IDs, provided residential address information is not made publicly available. However, if ASIC proceeds with allowing residential addresses to become publicly available by default where a service address is not provided, the AICD would not support the public disclosure of the full director ID. In these circumstances, we recommended that director IDs be only partially disclosed for general public users. Publishing a director ID number in full publicly together with a director’s name and a residential address will increase the potential for misappropriation online by cyber criminals, including the risk of identity theft, fraud or impersonation attempts.