Operational Procedure: Professional services agencies shared Portal access

This Operational Procedure is issued under the authority of the Commissioner and should be read together with the ACNC Policy Framework which sets out the scope, context, and definitions common to our policies.

Operational Procedure statement

This Operational Procedure sets out how to process requests from professional services agencies (such as legal and accounting firms) to use a single shared Charity Portal (‘Portal’) account to manage the records of multiple charity clients.

Context

1. The ACNC’s Portal access is designed for individual users (Responsible or Authorised People) with a personal email address. This approach creates a clear audit trail to show who has accessed protected information in the Portal. The approach is also consistent with the Office of the Australian Information Commissioner (OAIC) guidance on privacy for not-for-profits and charities.
2. Some professional services agencies (PSAs) require multiple staff to access records of and provide services to registered charities. These staff submit information such as registration applications, Annual Information Statements, subtype reviews and other approved forms via the Portal on behalf of clients.
3. Multiple agency staff may be tasked to work on the same submission. For some form types such as a registration application this is not possible as the forms are linked to the Portal account that started the form. In addition, making each staff member an Authorised Person with an individual login account creates an administrative burden for the charity and PSAs.
4. A PSA shared Portal account set up in accordance with this procedure will:
   1. enable the use of multi-factor authentication
   2. prevent privacy breaches that result from individuals sharing personal Portal account login details
   3. help manage the risk of unauthorised access to charity information.
5. The ACNC permits use of shared accounts for PSAs where a request is made in writing and they can commit to managing shared access in a way that is consistent with OAIC guidance.

Principles

6. The ACNC will consider requests for shared Portal access on a case-by-case basis, having regard to the individual circumstances of the agency and their ability to manage the risks involved.
7. Requests made by PSAs that manage a large number of charities using multiple staff are more likely to be approved.

Requests for shared Portal accounts

8. A PSA can request a shared Portal account by contacting Advice Services or Registration who will send them an email requesting the following information is returned to the email of the team managing the request (advice@acnc.gov.au or registration@acnc.gov.au during the charity registration process):
   1. explanation of how a shared Portal account will improve their ability to manage charity obligations to the ACNC and reduce the administrative burden of their agency
   2. confirmation that they understand the risks involved in using a shared Portal account and will implement security measures to manage the risk of unauthorised access to charity records. These measures should include:
      1. controlled access to the shared email associated with the Portal account
      2. strong password protection protocols including updating passwords when a staff member leaves or no longer requires access
      3. educating staff about security and privacy obligations and the importance of good security and information handling practices
      4. access controls to ensure that staff can only access what is needed to perform their duties
      5. keeping operating systems up to date to guard against malware.
9. PSAs that are authorised to use a shared Portal account will be required to enable multi-factor authentication.
10. Generic PSA details will be added to the Portal account to prevent unauthorised access to an individual’s personal information such as date of birth and phone number.
11. To add new charities to their shared Portal account, PSAs will need to follow the normal process to be added as an Authorised Person by:
    1. submitting Form 3B: Change of Charity Details form
    2. getting an existing Responsible or Authorised Person to add them through the Portal, or
    3. by providing Portal account details to the Registration Analyst at point of registration of a new charity.
12. Once a shared Portal account is established, Proof of Identity procedures cannot be passed over the phone using the shared details. All requests for charity information or changes to charity details will need to be sent in writing from the nominated agency email address attached to the Portal account or via an approved form.
13. The ACNC will maintain a record of agencies with approved shared Portal accounts.
14. Agencies with approved share Portal account access must email advice@acnc.gov.au to notify the ACNC if their circumstances have changed and they no longer require streamlined Portal access.

References

• Professional Services Agencies Shared Portal Access Work Instruction