DSPANZ provided a submission to the Department of Home Affairs' consultation on introducing a voluntary code of practice for app store operators and app developers on 11 July 2025.
We recognised that there is an opportunity for the government to leverage existing standards, such as the Security Standard for Add-on Marketplaces (SSAM), which currently supports industry best practice security between app store operators and app developers in the tax ecosystem.
In this submission, we provided the following feedback:
- There is a need to clearly define "business-to-business API developers" within the Code of Practice to clarify its intended scope.
- The government should recognise the SSAM under the Code of Practice, given that it provides clear, actionable controls that meet the majority of the UK Government's Code of Practice.
- Following international examples for introducing best practice cybersecurity principles between app store operators and app developers, such as the UK's Code of Practice, supports interoperability for those operating in multiple jurisdictions and reduces the complexity in meeting differing standards. If the government follows international best practice, it could then consider providing additional guidance, tailored to an Australian audience.
- There is currently a gap between the UK and Australia's data protection and privacy requirements, which will create a challenge for Australia in aligning with the UK's Code of Practice.
- There is a need for Australia to consider establishing a "Digital Economy Regulator" who would have the authority to oversee the development and enforcement of security, certification, data standards and other requirements that organisations must typically meet to leverage digital services provided by the government and participate in the digital economy.
Access the full copy of the submission.