Data Retention Industry Grants Programme January 2016 Contents 1. Purpose of this guide .................................................................................................................3 2. Programme overview ..................................................................................................................3 3. Grant amount ..............................................................................................................................3 4. Relevant dates .............................................................................................................................4 5. Who can apply .............................................................................................................................4 5.1 Group data retention applications ....................................................................................5 6. Before you apply .........................................................................................................................5 7. Eligible projects ..........................................................................................................................5 8. Direct costs .................................................................................................................................5 8.1 Types of direct costs that you can include in your budget ...............................................6 8.2 Costs that you cannot include in your budget ..................................................................6 9. How to apply ................................................................................................................................7 9.1 Late applications ..............................................................................................................7 10. Assessment information ............................................................................................................7 10.1 Enterprise scale ...............................................................................................................7 10.2 Typical implementation impact ........................................................................................7 11. How the grant is determined......................................................................................................9 11.1 Final decision .................................................................................................................10 12. If your application is successful .............................................................................................10 12.1 Grant agreement ............................................................................................................10 12.2 How the grant will be paid ..............................................................................................10 12.3 Project reporting .............................................................................................................10 12.4 Project variations ...........................................................................................................11 12.5 Tax obligations ...............................................................................................................11 13. Other things you should know ................................................................................................11 13.1 Conflicts of interest ........................................................................................................11 13.2 How we use your confidential information .....................................................................12 13.3 How we use your personal information..........................................................................13 13.4 Freedom of information ..................................................................................................13 14. Public announcement ...............................................................................................................13 15. Enquiries and feedback............................................................................................................13 Appendix A - List of service types in the application form .........................................................15 Appendix B - Accountant declaration ...........................................................................................17 Appendix C - Statement of Capital Work for compliance with data retention obligations ......18 Data Retention Industry Grants Programme Jan 2016 Page 2 of 21 1. Purpose of this guide This guide provides assistance with completing applications for the Data Retention Industry Grants Programme. It should be read in conjunction with the Programme Guidelines. In the event of any inconsistency, the Programme Guidelines prevail. You should read these documents carefully before you start filling out an application. 2. Programme overview The Attorney-General’s Department (AGD) is responsible for administering the Data Retention Industry Grants Programme. The AusIndustry division of the Department of Industry, Innovation and Science (DIIS) will provide grants administration services in partnership with AGD. This programme of up to $128.4 million aims to assist eligible telecommunications service providers meet their data retention obligations, required under the Telecommunications (Interception and Access) Amendment (Data Retention) Act 2015 (Cth)1 (the Act), by making a financial contribution to the typical up-front costs of compliance. Businesses were required to have complied with their data retention obligations by 13 October 2015. Where you did not fully comply by this date you must apply to the Communications Access Coordinator (CAC) for: an extension of up to 18 months by lodging a Data Retention Implementation Plan (DRIP) detailing how you will achieve compliance by 13 April 2017; and/or an exemption from your data retention obligations; and/or a variation of your data retention obligations in relation to the services you provide. The CAC is a statutory position within the AGD. Detailed information regarding data retention obligations is available from the AGD website. 3. Grant amount The total pool of funding for this programme is up to $128.4 million. Grants will be determined by the funding model. The funding model is the mechanism that will determine how funds will be distributed to eligible applicants. The Attorney-General will allocate funding, including minimum and maximum amounts, based on the funding model and departmental advice. For more information regarding the funding model, refer to the Programme Guidelines. The grant funding is a financial contribution to the typical up-front costs of data retention for eligible businesses, not the actual costs incurred by a business. It is unlikely that applicants will receive reimbursement of their full costs of compliance. 1 https://www.comlaw.gov.au/Details/C2015A00039 Data Retention Industry Grants Programme Jan 2016 Page 3 of 21 4. Relevant dates 30 October 2014 to 13 October 2015 Date range for businesses submitting a Statement of Work to undertake activities and incur direct costs 30 October 2014 to 13 April 2017 Date range for businesses with DRIPs to undertake activities and incur direct costs 13 October 2015 Date at which businesses must be compliant with their data retention obligations under the Act* 7 January 2016 Data Retention Industry Grants Programme round open date 5 February 2016 Last date for late DRIPs to be submitted to the CAC to be considered for the Data Retention Industry Grants Programme** 19 February 2016 Date by which the CAC will advise businesses of late DRIP status for the purpose of the Data Retention Industry Grants Programme Round 23 February 2016 Data Retention Industry Grants Programme round closing date 13 April 2017 End date for businesses with DRIPs to be compliant with the Act and all projects to be complete *Noting service providers may apply to the CAC for approval of a DRIP. **The Programme Delegate may, at their discretion, agree to accept late DRIP applications. 5. Who can apply To be eligible to apply, you must: have an ABN offer at least one eligible service own or operate, in Australia2, infrastructure that enables the provision of any of its eligible services have incurred or will incur direct costs since 30 October 2014 associated with delivering your DRIP or Statement of Work have a DRIP or a Statement of Work as follows: If not compliant by 13 October 2015 have a DRIP or be included as a subsidiary or related body in a group DRIP, that is submitted to the Communications Access Coordinator (CAC) and is agreed (or agreed in-principle) at the application closing date. If fully compliant by 13 October 2015 submit a Statement of Work as detailed in the Data Retention Industry Grants Programme application form which details the steps you have undertaken between 30 October 2014 and 13 October 2015 to become fully compliant. 2 For more information, refer to FAQ 2.6 within https://www.ag.gov.au/NationalSecurity/DataRetention/Documents/DataRetentionIndustryFAQS.pdf Data Retention Industry Grants Programme Jan 2016 Page 4 of 21 If you submitted your DRIP on or before the due date of 5 February 2016 and have not yet received advice from the CAC on the status of the DRIP, you may still submit your application. The CAC must agree or agree in principle to the DRIP before the application can be assessed. The CAC will advise you and AusIndustry of the outcome of the DRIP assessment. If you have a DRIP, the information you provide in your application form must be consistent with the information in your DRIP. If you have questions, about the DRIP process call the contact centre on 13 28 46 or visit us at business.gov.au. When you apply for the Data Retention Industry Grants Programme, you must also submit a mandatory Accountant Declaration that confirms your business gross annual revenue (turnover) for the most recent financial year using the template provided at Appendix B of this Customer Information Guide. You are not eligible to apply if you are a: trust (however, an incorporated trustee may apply on behalf of a trust); Commonwealth, state and local government agency; or business which began operation on or after 13 October 2015. 5.1 Group data retention applications The entity applying for a grant must be the same entity applying for a DRIP, including where the entity applied via a group structure. 6. Before you apply If you are interested in applying you may call the contact centre on 13 28 46, or contact us at business.gov.au. We can discuss your eligibility and guide you through the process should you decide to proceed with your application. Note that if you are not yet compliant with your data retention obligations, you must submit a DRIP to the CAC by 5 February 2016 to apply for a grant under this programme. If you had not submitted a DRIP by this date your application may not be eligible for assessment. If you wish to find out more about the DRIP process call the contact centre on 13 28 46, or contact us at business.gov.au. You should also read and understand the terms and conditions of the sample general grant agreement before completing an application. View the sample grant agreement at business.gov.au. 7. Eligible projects Your project activities must relate to building technical data retention capabilities for your eligible services to be compliant to the Act. Your project can include the provision of eligible services at different locations, provided they are all located in Australia. 8. Direct costs When completing your application, you are required to include a budget detailing your estimated or actual costs in implementing your DRIP or, if applicable, actual costs incurred when delivering your Statement of Work. To be considered direct costs for this grant programme, costs must: be incurred by you within the period 30 October 2014 to 13 April 2017, and be a direct cost incurred in meeting your data retention obligations under the Act. Data Retention Industry Grants Programme Jan 2016 Page 5 of 21 8.1 Types of direct costs that you can include in your budget Plant and equipment Hardware - Could include servers, data storage, networking, encryption devices (including transport and freight). Software - Perpetual license or not licensed beyond 13 April 2017. Facilities Building Infrastructure and modifications - Could include modification of, or additions to, premises to accommodate new plant and equipment. Workforce Direct labour - Can include up to an extra 30 per cent in labour on-costs and administration. Project management - Can be both technical and administrative, but must not exceed 10 per cent of total labour costs. Commissioning of plant and equipment - Can include installation, integration and set to work testing of new plant and equipment Training Staff training - Must be in direct support of data retention requirements. Contract expenditure Contract expenditure - Must be proportional, reasonable and is subject to the same provisions as direct labour costs Other Other - Applicant needs to specify any other costs included in the budget. Costs must be directly related to data retention requirements. 8.2 Costs that you cannot include in your budget Examples of costs that would not be considered direct costs for the purposes of this grant programme and therefore cannot be included in your budget: Any expenditure not directly incurred in meeting your data retention obligations under the Act financial costs, including interest depreciation of plant and equipment costs of purchasing, leasing, depreciation of, or development of land opportunity costs relating to any production losses as a result of allocating resources to the agreed grant project costs related to obtaining resources used on the project, including interest on loans, job advertising and recruiting, and contract negotiations routine operational expenses, including communications, accommodation, office computing facilities, printing and stationery, postage, legal and accounting fees and back charges costs related to preparing the grant application, preparing any project reports (except costs of independent audit reports) and preparing any project variation requests Data Retention Industry Grants Programme Jan 2016 Page 6 of 21 activities you paid for using non-cash considerations. Other specific expenditure may be ineligible as determined by the Programme Delegate. 9. How to apply You can only submit an application during the single funding round. The opening and closing date for this round will be published on business.gov.au. To apply, you must: complete the online form provided at business.gov.au submit a mandatory Accountant Declaration that confirms your business gross annual revenue (turnover) for the most recent financial year using the template provided at Appendix B provide all the information that is needed for us to assess your application. As noted above, to be eligible to apply for this programme you are required to have submitted a DRIP by 5 February 2016, or, where your business is fully compliant by 13 October 2015 include a Statement of Work in your application using the template provided at Appendix C. Any information you provide that is considered intentionally misleading or inaccurate will be investigated by AusIndustry and may jeopardise your application. 9.1 Late applications Applications must be submitted by the closing date. Applications lodged after this date may only be accepted due to exceptional circumstances (e.g. natural disaster). The decision to accept late applications will be at the discretion of the Programme Delegate. If you wish to discuss your case for a late application call the contact centre on 13 28 46, or contact us at business.gov.au. 10. Assessment information To be considered for funding, you will need to provide specific information about your business and the services you provide in your application. If the applicant entity is applying on behalf of a group, all information provided should be on that basis. 10.1 Enterprise scale This is the size of your business based on gross annual revenue (turnover) for the most recent financial year. For group applications the gross annual revenue (turnover) of the group will be used to determine the enterprise scale score. The gross annual revenue (turnover) of your business is to be expressed in a $ figure to the nearest thousand dollars (do not include hundred dollars or cents). The submitted Accountant Declaration must certify the figures provided in your application. 10.2 Typical implementation impact You will be required to provide following information in your application: number of eligible service(s) your business provides for latest financial year types of eligible service(s) your business provides for latest financial year total number of subscribers for all eligible services as at 13 October 2015 Data Retention Industry Grants Programme Jan 2016 Page 7 of 21 anticipated data storage volume for all eligible services as at 13 April 2017 gross annual revenue (turnover) for latest financial year. Number and type(s) of eligible service To provide this information, select the services you offer from the drop down menu on the application form. You may select one or more from the table listed in Appendix A. For each service, you will also be asked whether you operate or resell the service: Select ‘operate’ if you operate the service’s underlying infrastructure, such as line links, switches, routers or servers that are necessary for the operation of the service. If you have visibility of traffic data on the service, you are typically the operator of the service. Select ‘resell’ if you purchase capacity on the service from a wholesale provider and market the service to end-customers, including where you operate infrastructure such as customer relationship management and billing systems used for your reselling of the service. If you do not have visibility of traffic data on the service and receive information about customer usage from another provider, you are typically the reseller of the service. If you operate and resell the service, select ‘operate’. If you are unclear about what your eligible services are, refer to correspondence you received from the CAC in response to the DRIP you submitted, or contact AusIndustry to discuss on 13 28 46 or at business.gov.au. Total number of subscribers across all eligible services as at 13 October 2015 This is the total number of all your registered subscribers across all your eligible services for your business as at 13 October 2015. In the case of wholesale providers, each retail provider will count as one subscriber of the wholesale provider. Wholesale providers should not count their retailer’s subscribers as their own subscribers, unless the wholesale provider has data retention obligations in respect of the customer information of those subscribers (such as names and addresses). If a provider outsources the operation of its customer relationship management system to a third party, subscribers whose details are contained in the outsourced system should still be counted as subscribers of the provider. This is because the third party is operating the system on behalf of the provider. If a provider (the first provider) outsources the operation of its customer relationship management system to a second provider (the second provider), those subscribers should be counted as the subscribers of the first provider. The second provider is operating the system on behalf of the first provider and should not count those subscribers. If a provider (the first provider) outsources the entry of data into its customer relationship management system via a portal to a second provider, those subscribers should be counted as the subscribers of the first provider. The second provider does not own or operate the system and should not count those subscribers. Where a service is offered for free and supported by alternative revenue sources, non-paying subscribers should still be counted as subscribers. Where a subscriber has multiple relevant services offered by the same provider, that subscriber should be counted only once. If a single subscriber allows the services to be used by multiple users, the provider should count the subscriber once and should not count each user. Data Retention Industry Grants Programme Jan 2016 Page 8 of 21 Total data storage volume capacity as at 13 April 2017 In the application form you will be required to enter, in either gigabytes or terabytes, your business’s anticipated data storage volume for retaining the prescribed data for the eligible services you provide as at 13 April 2017. If you submitted a DRIP, this number should be broadly consistent with information you provided in your DRIP. If there is significant variation you should include supporting documentation explaining the reason with your application. 11. How the grant is determined Prior to assessing your application, we will require confirmation from the CAC of the following: that you have submitted a DRIP and that the CAC has agreed, or agreed in principle, to your DRIP, or that your Statement of Work is eligible. Your application is then assessed against the eligibility criteria. If your application is eligible, the grant funding amount will be determined based on the funding model. The funding model is based on allocating scores against two categories: enterprise scale typical implementation impact, as described in 10 above. The enterprise scale category is designed to recognise small business in the funding model. Up to a maximum of 25 points (being 25 per cent of the overall score) will be allocated to the enterprise scale category. The enterprise scale score will be determined by your gross turnover for your most recent financial year. If your business has a gross turnover of up to $3 million, you will receive a score between 1 to 25 points. Businesses with the smallest turnover will receive the most points. The information you provide for the variables associated with the typical implementation impact category will be analysed by an independent consultant appointed by the Attorney-General’s Department. Variables which most or least impact on data retention implementation costs will be determined and weighted accordingly. Subsequently, a formula will be developed and applied to allocate a typical implementation impact score. Up to a maximum of 75 points will be allocated to the typical implementation impact category for each applicant. Your score for both the categories will be added together to give you a score out of 100, which will be used to allocate the available funding between the applicants using a modulation process. The Attorney-General’s Department will provide this analysis and the recommended variable weightings to the Implementation Working Group (IWG) prior to finalising recommendations to be made to the Attorney-General. The IWG will not be given identifiable information on application scores and recommended funding allocations, but will be able to provide feedback on the proposed weighting of variables. The IWG consists of industry representatives and Government and law enforcement agencies. The Attorney-General’s Department will advise the Attorney-General on the scale of dollar values aligned to scores. Data Retention Industry Grants Programme Jan 2016 Page 9 of 21 The Attorney-General will approve the allocation of funding, to ensure that the funding allocation across all eligible applicants is consistent with the programme objective and does not exceed the total funding pool of $128.4 million. All eligible applicants will receive a level of funding based on this funding model. 11.1 Final decision The Attorney-General is the final decision maker and decisions will not be reviewed. Eligible applicants will receive a written offer. In the event your application is ineligible, you will be notified in writing and be given an opportunity to discuss the outcome. 12. If your application is successful 12.1 Grant agreement You must enter into a grant agreement with the Attorney-General’s Department, acting on behalf of the Commonwealth. A sample grant agreement is available on business.gov.au. We will not make any grant payments until there is an executed grant agreement in place. An offer of funding may be subject to special conditions. You will have 30 days from the date of offer to execute a grant agreement with the Commonwealth (‘execute’ means both you and the Commonwealth Government have signed the agreement). We may withdraw the offer if the grant agreement is not executed within this time. You will have up to 13 April 2017 from the date the grant agreement is executed to complete your project. If you were compliant by 13 October 2015, you will still have to provide assurance that you are compliant under the terms of the grant agreement. The Commonwealth may recover grant funds if there is a breach of the grant agreement. 12.2 How the grant will be paid The grant agreement will state the maximum grant amount to be paid, which cannot be exceeded under any circumstances. Grant funding will be paid in two instalments: 50 per cent of the total payment will be paid on execution of the grant agreement; and the remaining 50 per cent you meet your final reporting obligations as outlined in the grant agreement, including any technical evaluation required for assurance purposes. 12.3 Project reporting Your reporting requirements will be specified in your grant agreement. You must submit progress reports as described in the grant agreement at least once every 6 months detailing the progress towards completing the activities in your project. You must also submit a final report as described in the grant agreement. Assurance requirements for larger projects and/or projects deemed to be higher risk may include a technical evaluation which will be at your expense. A technical evaluation will verify that you have undertaken the activities identified in the grant agreement and have the capacity to retain the relevant Data Retention Industry Grants Programme Jan 2016 Page 10 of 21 data for the eligible services you provide for a minimum period of two years. Details on the technical evaluation can be found in the Guide to Managing your Grant. 12.4 Project variations We recognise that unexpected events may affect project progress. In these circumstances, you can request a project variation. Note: for any variation to be considered it needs to be consistent with the programme policy objectives and purpose set out in the Programme Guidelines; the programme does not allow for an increase to the agreed amount of grant funds; and extensions of time beyond the end date of 13 April 2017 are unlikely to be favourably reviewed as entities must be compliant with the Act by this date. If you want to propose changes to the grant agreement, you must put them in writing before the grant agreement end date. We will not consider changes after the grant agreement end date. You should not assume that a variation request will be successful. 12.5 Tax obligations Where applicable, grants are subject to the Goods and Services Tax (GST). If you are registered for GST, your grant will be increased to compensate for GST payments. Grants are treated as assessable income for taxation purposes, unless exempted by a taxation law. We recommend you seek independent professional advice on your taxation obligations. We do not provide advice on tax. 13. Other things you should know 13.1 Conflicts of interest For staff, technical experts and others who help to manage, assess and evaluate the programme, a conflict of interest can exist if there is a conflict between: their programme duties, roles and responsibilities; and their private interests (where these interests could inappropriately influence the way they manage the programme). Private interests include an individual’s own personal, professional or business interests or the interests of individuals or groups with whom they are closely associated. This includes relatives, friends or other affiliations. A conflict of interest can be: real (or actual); apparent (or perceived) ; or potential. A real (or actual) conflict of interest exists when a person’s private interests or their programme duties, roles and responsibilities could improperly influence how they manage, assess and evaluate the programme. Data Retention Industry Grants Programme Jan 2016 Page 11 of 21 An apparent (or perceived) conflict of interest exists where it appears or is perceived by a third party that someone’s private interests or their programme duties, roles and responsibilities could improperly influence how they manage, assess and evaluate the programme, even if a real or actual conflict has not, or cannot, be established. A potential conflict of interest exists when someone has a private interest and an actual conflict of interest could arise if they make any decisions related to the programme. How we manage conflicts of interest We manage conflicts of interest according to the APS Code of Conduct (section 13 (7) of the Public Service Act 1999). Our conflict of interest policy is published on the Department of Industry, Innovation and Science website. Commonwealth officials and the Independent Consultants working on this programme must declare any conflicts of interest. All declarations must be submitted to, and will be held by a delegated authority. Each declaration will be assessed to determine whether a conflict of interest exists and whether it is significant. In the event that a conflict of interest is identified, that individual will be advised what they must do to manage the conflict. For example, if a conflict of interest is a cause for concern, that official will not take part in the assessment of applications under the programme. 13.2 How we use your confidential information We’ll use the information you give us according to Australian laws, including: the Public Service Act 1999 (Cth) the Public Service Regulations 1999 (Cth) the Privacy Act 1988 (Cth) the Crimes Act 1914 (Cth) the Criminal Code Act 1995 (Cth). We’ll treat the information you give us confidentially if it meets all of the four conditions below: You clearly identify the information as confidential and explain why it should be treated as confidential. The information is commercially sensitive. Revealing the information would cause unreasonable harm to you or someone else. You provide the information with an understanding that it will stay confidential. When we may reveal confidential information We may reveal confidential information to: Commonwealth employees and contractors, to help us manage the programme effectively employees and contractors of our Department, so we can research, assess, monitor and analyse our programmes and activities other Commonwealth, state, territory or local government agencies in programme reports and consultations the Auditor-General, Ombudsman or Privacy Commissioner the responsible Minister or Assistant Minister a House or a Committee of the Australian Parliament. We may also reveal confidential information if: Data Retention Industry Grants Programme Jan 2016 Page 12 of 21 we are required or allowed by law to reveal it you agree to the information being revealed before we reveal it, or the confidential information has been made public by someone other than us. 13.3 How we use your personal information We must treat your personal information according to the Australian Privacy Principles (APPs) and the Privacy Act 1988 (Cth). This includes letting you know: what personal information we are collecting why we are collecting your personal information who we will give your personal information to. We will collect personal information from you, and we may give the information to our employees and contractors and other Commonwealth employees and contractors, so we can: manage the programme research, assess, monitor and analyse our programmes and activities. We, or our Minister or the Attorney-General, may: announce to the public the names of successful applicants publish personal information on the department’s websites. Please read our Privacy Policy on the Department of Industry, Innovation and Science website for more information on: what is personal information how we collect, use, store and reveal your personal information how you can access and correct your personal information. 13.4 Freedom of information The Freedom of Information Act 1982 (the FOI Act) applies to all documents we create, receive or store about the programme. If someone requests a document under the FOI Act, we will release it (though we may need to consult with you and/or other parties first) unless it meets one of the exemptions set out in the FOI Act. 14. Public announcement Successful projects may be publicly announced by the Attorney-General and may include: name of your business title of the project description of the project and its aims amount of grant funding awarded. Details of successful projects will be published on the Attorney-General’s Department website as well as at business.gov.au. 15. Enquiries and feedback For further information or clarification you can contact us on 13 28 46 or by web chat or through our online enquiry form. Data Retention Industry Grants Programme Jan 2016 Page 13 of 21 Questions you ask us may form the basis of a response that we will publish on our website as Frequently Asked Questions. Questions of a technical nature regarding your data retention obligations may be referred to the CAC at the Attorney-General’s Department as the need arises. The AusIndustry Customer Service Charter is available at business.gov.au. AusIndustry uses customer satisfaction surveys to improve its business operations and service. If you have a complaint, call the contact centre on 13 28 46 or contact us at business.gov.au. Your complaint will be referred to the appropriate manager. If you are not satisfied with the way your complaint is handled, you can contact: Head of Division AusIndustry - Business Services GPO Box 9839 CANBERRA ACT 2601 You can also contact the Commonwealth Ombudsman3 with your complaint (call 1300 362 072). There is no fee for making a complaint, and the Ombudsman may conduct an independent investigation. 3 http://www.ombudsman.gov.au/ Data Retention Industry Grants Programme Jan 2016 Page 14 of 21 Appendix A - List of service types in the application form An eligible service is a service, operated by an eligible applicant, that is: a. used for carrying communications, or enabling communications to be carried; and b. offered in Australia as at 13 October 2015; and c. operated by a carrier, carriage service provider or internet service provider. A service is not an eligible service if it is: a. is excluded from the data retention obligations (according to section 187B of the Act); or b. is exempted from the data retention obligations (according to section 187K of the Act); or c. is deemed ineligible by the Programme Delegate in consultation with the CAC. The Programme Delegate, upon the advice of the CAC, may deem that a service is not an Eligible Service for the purpose of the Programme if the service is subject to an agreed data retention variation application (according to section 187K of the Act) that has the effect of reducing the data retention obligations to an extent that funding under the Programme can no longer be justified. You will be required to select one or more of the following in the application form in order to list your services. You can also add additional service types. Eligible Service Eligible Service Type Internet Access Internet Access Internet Access Internet Access Internet Access Internet Access Internet Access Internet Access Internet Access Internet Access Data Link Data Link Data Link Data Link Data Link Data Link Data Link Data Link Data Link Data Link Data Link Data Link Managed Service Managed Service Managed Service Managed Service Managed Service DSL/ADSL Broadband NBN Broadband Satellite Dial-up Cable Mobile Data (3G/4G/LTE) Wifi Transit Pairing Other Internet Access (use only if no other appropriate option) Hybrid Fibre Coaxial (HFC) Dark Fibre Ethernet Virtual Private Network (VPN) Multiprotocol Label Switching (MPLS) Mobile (3G/4G/LTE) Wireless Other Radio Frequency (RF) (use only if no other appropriate option) Wide Area Network (WAN) (non-internet access purposes) Radio Layer 2 or Layer 3 Service Other Data Link (use only if no other appropriate option) Cloud-based services Storage Other hosted services Web Hosting Telephony Data Retention Industry Grants Programme Jan 2016 Page 15 of 21 Eligible Service Eligible Service Type Telephony Telephony Telephony Telephony Telephony Telephony Telephony Telephony Telephony Messaging Messaging Messaging Messaging Messaging IP-based Comms IP-based Comms IP-based Comms Fixed Line/PSTN (Public Switched Telephone Network) Integrated Services Digital Network (ISDN) Multiline Fax Pager Mobile In-bound services (13, 1300 etc) Satellite telephony Other Telephony (use only if no other appropriate option) Email Hosting Email Relay and Transmission (SMTP, POP, IMAP) Short Messaging Service (SMS) Internet Chat and Messaging Other Messaging (use only if no other appropriate option) Voice over Internet Protocol (VoIP) Video Conferencing Other Over-the-top (OTT) Services (use only if no other appropriate option) In the application form, you must list all your eligible services and indicate your role in providing each particular services (operate or resell) (refer to section 10.2 of this guide). You will also be asked if you employ Network Address Translation (NAT) in delivering your service(s). Data Retention Industry Grants Programme Jan 2016 Page 16 of 21 Appendix B - Accountant declaration Data Retention Industry Grants Programme Accountant declaration Role of person making declaration [Accountant or Chief Financial Officer(CFO)] Name Contact details Qualification Chartered Accountant Certified Practicing Accountant CPA Australia Chartered Accountants Australia and New Zealand Institute of Public Accountants Membership number Applicant’s name Applicant’s ABN I declare that: On the basis of the evidence [Applicant Name] has supplied to me, I consider that [Applicant Name]’s gross annual revenue (turnover) for the most recent financial year [yyyy-yy] is $__________. Signature Signed on this day of Data Retention Industry Grants Programme Jan 2016 17 of 21 Appendix C - Statement of Work for compliance with data retention obligations This statement is to be completed by service providers who: 1. Were fully compliant with their data retention obligations by the data retention legislation commencement date of 13 October 2015; and 2. Completed capital works and/or made purchases between 30 October 2014 and 13 October 2015, for the purpose of complying with data retention obligations. Applicant name Applicant ABN Contact name Contact phone I ..................................................................... certify that the statements in this application are true, complete and correct to the best of my knowledge and beliefs, and are made in good faith. Signed ........................................................... Position .......................................................... Date ............................................................... Data Retention Industry Grants Programme Jan 2016 18 of 21 Retention practices This section should only be completed for eligible services that are compliant as of 13 October 2015 were not compliant on 30 October 2014, and required work and/ or purchases to meet data retention obligations that incurred a capital cost to the provider. Complete the following table detailing the data retained for the eligible service against each item of the data set listed in column 1. Replicate this table for each of the eligible services you provide. Name of eligible service ...................................................................................................... Item within data set 1. The subscriber of accounts, services, telecommunications devices and other eligible services relating to, the eligible service. 2. The source of a communication 3. The destination of a communication Data Retention Industry Grants Programme Retention practice for this service as at 30 October 2014 Jan 2016 Retention practice for this service as at 13 October 2015 19 of 21 Item within data set 4. The date, time and duration of a communication, or of its connection to a eligible service 5. The type of a communication or of a eligible service used in connection with a communication 6. The location of equipment, or a line, used in connection with a communication Data Retention Industry Grants Programme Retention practice for this service as at 30 October 2014 Jan 2016 Retention practice for this service as at 13 October 2015 20 of 21 Current measures Describe how you currently secure retained data for this service in line with your obligations. Detail what measures you have in place to protect the information from unauthorised interference or access. Do not include encryption keys, username, passwords or other similar information. Other relevant information Provide any additional information that might help the Communications Access Co-ordinator to agree to the Data Retention Implementation Plan or better explain any aspect of your approach to implementation. Data Retention Industry Grants Programme Jan 2016 21 of 21