- Who these obligations catch
- Licences and EULAs: stay inside the permission you were given
- Privacy: protect personal information that comes with the download
- Consumer law: what you owe customers when you supply digital products
- What happens if you get it wrong
- A compliance checklist your team can use
- When a lawyer should be involved
- The second use is where businesses come unstuck
Downloading a file looks like one act: click, save, use. Under Australian law it lands inside at least four separate sets of obligations at once. Copyright rules decide whether you may copy the work at all. The licence or end user licence agreement (the EULA) sets the limits of the permission you were given. If the download contains personal information, the Privacy Act 1988 (Cth) attaches duties to how you collect, use and protect it. And if your business supplies digital products of its own, the Australian Consumer Law (the ACL) governs what you promise customers and how you back the product up.
None of these obligations turn on whether a file was "free". A lawful download used outside the terms of its licence, or a free image dropped into a client pitch deck, can each create real exposure. This guide sets out who the obligations catch, what each one actually requires, what the penalties are, and the practical steps a small to medium business can take to stay on the right side of them.
Who these obligations catch
The obligations do not apply uniformly, so it helps to check where your business sits before working through the duties:
- Copyright: every business that copies or uses protected material in Australia, whatever its size. There is no turnover threshold, and civil infringement does not require commercial gain. A business can also be liable for downloads it authorises staff to make.
- Licence terms: any business that accepts a EULA or other licence terms, by contract, regardless of size. The terms bind you whether you paid for the software or downloaded it free.
- Privacy: the Privacy Act 1988 (Cth) generally applies to organisations with an annual turnover above $3 million in the previous financial year. Businesses below that threshold are usually exempt as small business operators, although some below-threshold businesses are still covered because of the kind of information they hold or the activities they carry on.
- Consumer law: the ACL applies when you supply goods or services to consumers in trade or commerce. Computer software counts as goods, so businesses that sell apps, software, ebooks or templates to consumers are in scope.
Copyright: get permission before you copy
Copyright in Australia arises automatically. Under s 32 of the Copyright Act 1968 (Cth), protection subsists in an original work from the moment it is made. There is no registration system, so there is no public register to check before you copy something. The absence of a © symbol changes nothing.
The Act gives the copyright owner a bundle of exclusive rights, including, under s 31, the right to reproduce the work in a material form and to communicate it to the public. Downloading a file makes a copy of it, which is a reproduction. If you make that copy without the owner's permission and no exception applies, you infringe. It does not matter that you never sell or publish it, that it is only for internal use, or that you found the file on a free website.
Common business scenarios that carry this risk include:
- Images: using photos found through an image search in your website, pitch decks or marketing without a licence.
- Software: installing unlicensed or "cracked" programs on work devices.
- Content sharing: sending a paid ebook or training video to the whole team when your licence is single user.
- Copy-paste: reusing text, code or templates from other sites in your own materials without permission.
The exceptions are narrow
The Act recognises "fair dealing" purposes: research or study (s 40), criticism or review, parody or satire, reporting news, and professional advice. For research or study, copying is only fair dealing within defined limits, such as 10 per cent of a published work or a single chapter. These exceptions are purpose specific and rarely cover day-to-day commercial use such as marketing, client work or staff training. Material released under an open licence such as Creative Commons is usable, but only on the licence's terms: attribution, no commercial use, or no derivatives if those conditions are attached.
Your business can be liable for authorising downloads
Infringement includes authorising the infringing act. Under s 36 of the Act, a court looks at the extent of your power to prevent the act, the relationship between you and the person who did it, and whether you took reasonable steps to stop it. A business that gives staff unrestricted access to file-sharing sites and never sets download rules is harder to defend than one with a clear policy and monitoring.
Licences and EULAs: stay inside the permission you were given
Most software and many digital assets arrive with a licence or EULA that defines the permission. It typically covers who may use the product, how many devices or seats are included, whether backups are allowed, and any restrictions on redistribution or commercial use.
Breaching those terms is a breach of contract, separate from any copyright question. Using a personal-use plan for client work, or installing a single-user licence on five machines, may not infringe copyright but can still expose you to a claim and the loss of the licence itself.
Before you rely on a download, check three things:
- Business use: confirm the plan covers commercial use, not just personal use.
- Limits: confirm the number of seats, users and devices, and whether internal copies for training are allowed.
- Records: keep purchase receipts, licence keys and renewal dates where the team can find them, and review them when headcount or software changes.
Privacy: protect personal information that comes with the download
If a download contains personal information, whether a customer list, an analytics export, HR records or health data, the Privacy Act obligations are engaged. The Australian Privacy Principles (APPs) require you to collect only what you need and be transparent about it, to use and disclose information only for permitted purposes, and to keep it secure. In practical terms, that means a lawful basis for the collection, a privacy policy that matches what you actually do, access controls, encryption for sensitive files, and retention and deletion rules.
The Notifiable Data Breaches scheme adds an obligation when things go wrong: if a breach of personal information is likely to result in serious harm, you must notify affected individuals and the Office of the Australian Information Commissioner.
A useful discipline is to ask before downloading whether the file is needed at all. Downloading a large dataset "in case it is useful later" creates storage, security and deletion obligations that a smaller, purposeful download avoids.
Consumer law: what you owe customers when you supply digital products
If your business supplies digital products to consumers, the Australian Consumer Law (the ACL, Schedule 2 of the Competition and Consumer Act 2010 (Cth)) treats you as a supplier. Computer software is expressly included in the definition of goods, so the consumer guarantees apply: products must be of acceptable quality, fit for purpose and match their description. A faulty app or an ebook that will not open can trigger a right to a repair, replacement or refund, and terms that try to exclude the guarantees are void.
The ACL also prohibits misleading or deceptive conduct in trade or commerce under s 18. Your website, app store listing and marketing must not overstate features, usage rights or compatibility, and any digital rights management or usage limits should be disclosed rather than buried. The safest approach is to make your customer-facing terms reflect the product's actual capability.
What happens if you get it wrong
The consequences differ by area, but none of them are trivial for a small business:
- Copyright: the owner can seek an injunction, damages or an account of profits, and a court can award additional damages where an infringement is flagrant or benefits the infringer. Infringement on a commercial scale is also a criminal offence carrying a fine of up to 550 penalty units, currently about $181,500, or up to five years' imprisonment, with corporations exposed to fines of up to five times the unit amount. Even short of court, a rights holder can send takedown notices and demand you stop using the material.
- Licence breach: you can be sued for breach of contract and lose the right to keep using the software, which can mean pulling a product or a tool from your operations mid-project.
- Privacy: serious or repeated interference with privacy attracts a maximum civil penalty for a body corporate of the greater of $50 million, three times the benefit obtained, or 30 per cent of adjusted turnover, with individuals exposed to up to $2.5 million. A breach can also trigger the Notifiable Data Breaches reporting obligations and compensation orders.
- Consumer law: penalties for ACL contraventions reach the greater of $100 million, three times the benefit, or 30 per cent of adjusted turnover for a body corporate, and up to $2.5 million for individuals. Customers can also pursue their own remedies such as refunds, and regulators can seek injunctions and adverse publicity orders.
Add the operational cost, a security incident from unvetted software, and the reputational damage when customers discover unlicensed or mishandled material, and the price of getting downloading wrong is often higher than the price of doing it properly.
A compliance checklist your team can use
Work through these steps as a standing routine rather than a one-off exercise:
- Source from legitimate suppliers only: Use official vendors, reputable marketplaces or the creator's site. Treat "free" versions of paid software as a red flag.
- Keep a licence register: Record what you downloaded, from whom, what the licence permits, how many seats you hold and when renewals fall due.
- Read the terms before you click download: Confirm whether installation on multiple devices, use in marketing, or internal copies are allowed. If the terms are unclear, ask the supplier or choose an alternative.
- Train staff: Run short updates on copyright basics, licence limits and privacy handling, and give the team a named person to ask when they are unsure.
- File permissions: For third-party content, keep written permission or the licence details on file, and comply with attribution and other conditions precisely.
- Treat personal information with care: Download only what you need, encrypt sensitive files, limit access, and set retention and deletion rules.
- Align customer terms with the product: If you supply digital products, make sure your website and EULA match what the product actually does, and honour the consumer guarantees.
- Have a takedown procedure: If you receive a takedown notice, pause use of the material immediately, assess your position, and respond deliberately rather than ignoring it.
When a lawyer should be involved
Many of these steps are administrative and can be handled in-house. A lawyer adds value at specific points: before you launch a product that depends heavily on third-party content, when a licence is ambiguous or a supplier refuses to clarify, when you receive a takedown or demand letter, when a data breach occurs, and when you are drafting your own EULA, website terms, privacy policy or acceptable use policy.
A practitioner can review your licences and terms, run a focused audit of the material your business relies on, assess whether a fair dealing exception or open licence covers a particular use, and respond to claims. Getting that assessment early, before a dispute crystallises, is considerably cheaper than defending a claim after the fact.
The second use is where businesses come unstuck
Most disputes about downloading do not start with the download itself. They start with the second use: the image that found its way into a pitch deck, the ebook forwarded to the whole team, the customer list imported into the CRM, the software installed on one machine too many. Each of those uses is a decision the download did not make for you.
The first action to take this week is an audit, not a policy rewrite. List every piece of third-party material your business actually relies on, and for each item confirm that the licence or permission covers the way you use it. For anything unlicensed, replace it or seek permission now, before a rights holder or a regulator does the audit for you. A lawyer can review the list and the terms with you, and set up the licence register and policies that keep the next download safe.