Compliance Guide · Updated 18 May 2026
Every Australian state regulates skin-penetration services (piercing, tattoo, cosmetic tattoo, dermal needling, microblading) under public-health law. This guide covers registration, sterilisation, autoclave records, and the breach findings that most commonly cost operators their licence.
First — What Counts?
Skin penetration is broadly defined across Australian jurisdictions as any procedure that pierces, punctures, tears, or cuts the skin. Wax that lifts the outer layer of skin in routine application is generally NOT classified as skin penetration. Procedures that intentionally break the skin barrier always are.
In scope — needs registration
Body piercing
All sites — ear cartilage, nose, navel, oral, intimate.
Tattoo / cosmetic tattoo
Including microblading, lip blushing, scalp micropigmentation.
Dermal needling
Skin needling / microneedling / Dermapen — pen-based or roller.
Dermal fillers / cosmetic injectables
Always in scope. Plus additional therapeutic-goods and practitioner requirements.
Electrolysis (epilation)
Needle-based hair removal. Distinct from IPL/laser (which is regulated separately).
Acupuncture
Even when offered alongside spa services. Practitioner registration also required.
Usually out of scope (check council)
Waxing
In most states. NSW, VIC and QLD specifically classify waxing as 'not penetrating intact skin' in routine cases.
Threading
Hair removal by twisted thread. Out of scope in all states.
Eyelash extensions
Adhesive-based, no penetration. Out of scope, but allergic-reaction risk drives treatment liability cover.
Ear piercing with gun
Out of scope in some states, in scope in others (e.g. QLD treats earlobe piercing as in scope). Check council.
Laser / IPL
Separate state regulator — Radiation Safety Acts. Not skin-penetration legislation.
Spray tan / facials
Topical only. Out of scope.
State-by-State
Each state has its own Public Health Act framework and a different mix of council-level vs centralised registration. Multi-site operators must register in every state where they trade.
Act & regulator
Public Health Act 2010 + Public Health Regulation 2022
NSW Health + Local Council
Operators carrying out skin penetration must notify the local council in writing under the Public Health Regulation 2022 (replacing the 2012 instrument). Notification is free in most LGAs but the inspection cycle is routine — councils typically inspect annually or after a complaint. Sterilisation must comply with AS/NZS 4815 (office-based health-care) or AS/NZS 4187 (hospital-grade) depending on procedure.
Key compliance points
Act & regulator
Public Health and Wellbeing Act 2008 + Public Health and Wellbeing Regulations 2019
Department of Health + Local Council
Victoria runs a council-registration model. Salons offering body art (tattoo, piercing, cosmetic tattoo) must register with their local council under Part 6 of the Public Health and Wellbeing Act and pay an annual fee (typically $200–$600 depending on council). Hairdressers and beauty therapists who do NOT do skin penetration may be exempt from registration but are still subject to the Infection Control Guidelines.
Key compliance points
Act & regulator
Public Health (Infection Control for Personal Appearance Services) Act 2003 + Public Health Regulation 2018
Local Council (Public and Environmental Health Officer)
Queensland is the tightest regulator. The Public Health (Infection Control for Personal Appearance Services) Act 2003 splits services into 'higher-risk' (tattoo, piercing, dermal, cosmetic tattoo) and 'general' (manicure, pedicure, hair removal). Higher-risk operators must hold a licence from the local council; general operators must comply with the Infection Control Guidelines but do not need a separate licence. Note: Queensland also separately regulates ear-lobe piercing as in-scope.
Key compliance points
Act & regulator
South Australian Public Health Act 2011
SA Health + Local Council
South Australia uses notification rather than licensing. Operators must notify their local council under the SA Public Health Act 2011 before commencing skin penetration. Councils inspect on notification and at intervals (typically 1–2 years). The SA Health Infection Control Guidelines for Hairdressing and Beauty Therapy set the technical standards.
Key compliance points
Act & regulator
Health (Miscellaneous Provisions) Act 1911 + Health (Hairdressing Establishments) Regulations 1972
Local Council (Environmental Health Officer)
Western Australia regulates 'hairdressing establishments' broadly and uses additional Department of Health guidance for skin penetration. Operators must notify the local council in writing. WA also has a separate regulator (the Radiological Council) for laser/IPL services, which sit alongside but distinct from skin-penetration permits.
Key compliance points
Act & regulator
Public Health Act 1997 + Public Health (Skin Penetration) Regulations
Department of Health + Local Council
Tasmanian operators register with their council under the Public Health Act 1997. Council EHOs inspect on registration and at routine intervals. Tasmania has additional licensing for laser/IPL through the Radiation Protection Act 2005.
Key compliance points
Act & regulator
Public Health Act 1997 (ACT) + Public Health Regulation 2000
ACT Health (Health Protection Service)
The ACT uses a centralised registration model — operators register directly with ACT Health rather than a local council. Annual registration fee applies. The Health Protection Service inspects on registration and at risk-based intervals (more frequent for tattoo and piercing studios).
Key compliance points
Act & regulator
Public and Environmental Health Act 2011 + Public and Environmental Health Regulations 2014
NT Department of Health (Environmental Health Branch)
NT registers skin-penetration operators centrally through the Department of Health Environmental Health Branch. Operators in remote communities are still subject to the same standards, though inspection cycles can be longer. The NT Code of Practice for Skin Penetration Industries sets the technical standards.
Key compliance points
Daily Practice
Common minimum standards across every Australian jurisdiction. AS/NZS 4815 (office-based health-care sterilisation) is the practical benchmark.
Wash hands with soap + water before each client; use 70% alcohol hand-rub between procedures. Gloves do NOT replace hand washing.
Surfaces wiped with hospital-grade detergent between clients. Treatment beds covered with disposable paper or sanitised vinyl cover.
Steam autoclave (134°C / 3.5 min vacuum or 121°C / 15 min) to AS/NZS 4815. Boiling, UV cabinet, or chemical sterilants are NOT compliant.
Mandatory in all states. Open in front of the client where practical. Dispose immediately into approved sharps container.
Time, temperature, pressure, load contents recorded for every cycle. Most modern autoclaves print or USB-export this automatically.
Weekly to monthly biological indicator testing (Geobacillus stearothermophilus). Sent to NATA-accredited lab. Results kept on file 3+ years.
Used linen bagged at point of use; not stored with clean linen. Wash at 65°C+ or use a commercial linen service.
AS 4031 approved containers; collected by licensed clinical-waste contractor. Retain manifest receipts.
Watchouts
The six findings every Australian environmental health officer says they see week after week. Most can be fixed in an afternoon — once you know to look.
By far the most common breach finding. Owning the autoclave is not enough — per-cycle records and spore tests are mandatory.
Inspectors find a UV cabinet on the bench used as a 'steriliser'. UV is at best a low-level disinfection step — never substitutes for steam autoclave.
Often justified by 'I sterilise them between uses'. Never compliant. Single-use means single-use. Prosecution risk is extreme.
Used needles, lancets, or microblade cartridges in the regular salon bin. Must be in AS 4031 sharps containers and disposed via clinical-waste contractor.
Most common in new operators offering cosmetic tattoo or microblading without realising it counts as skin penetration. Strict-liability offence.
QLD specifically requires worker training for higher-risk services; other states require documented competency. Inspectors check certificates.
Paper logs go missing — and the inspector always wants the previous 12 months. Most modern autoclaves print or USB-export per-cycle records; pair with a weekly calendar reminder for the spore test.
Council registration, sharps-disposal contract, spore results, staff training certificates, infection-control policy. When the EHO walks in, you produce everything in 60 seconds — that signals 'organised operator' and shortens the inspection.
Front-of-house staff don't perform procedures but they see how the back room operates. Brief everyone on the infection-control basics so they know what to flag if a contractor or a temp cuts corners.
A signed informed-consent form (covering allergies, medications, pregnancy, prior reactions) is both a clinical record and a treatment-liability defence. Digital consent in your booking software auto-files and timestamps it.
In most Australian states, waxing is classified as not breaking intact skin in routine cases and is out of scope of skin-penetration legislation. However, you still need to comply with general infection-control guidelines for personal appearance services, and your council may still inspect. Brazilian/intimate waxing is a grey area in some jurisdictions — always confirm with your local council.
Yes. Microblading uses a blade or pen to deposit pigment into the dermis — this is skin penetration in every Australian jurisdiction. You need skin-penetration registration plus, in some states, additional cosmetic-tattoo or body-art licensing. Operating microblading without registration is a strict-liability offence with significant fines.
No. UV cabinets provide at best low-level disinfection — they do not sterilise. The relevant standard (AS/NZS 4815) requires steam autoclaves for any reusable instrument that penetrates the skin. UV cabinets used as the primary sterilisation method are a guaranteed breach finding.
Routinely 1–2 yearly for general personal-appearance services, more frequently (annual or on opening) for high-risk skin-penetration premises like tattoo studios. Complaint-driven inspections happen any time. Treat record-keeping as if an inspector will walk in tomorrow — most operators we've spoken to had only 24–48 hours' notice.
Per-cycle autoclave records (time/temp/pressure/load), weekly to monthly spore-test results from a NATA-accredited lab, sharps-disposal manifests, client consent forms, staff infection-control training certificates, and product-batch records (for tattoo inks and cosmetic-tattoo pigments). Most regulators require retention for 3–5 years.
Strict-liability offence in every state. Fines start at low thousands and rise into tens of thousands per offence, with the council/health department empowered to issue prohibition orders that immediately stop you trading. Insurers will also typically deny treatment-liability claims for unregistered operators — meaning a single adverse incident becomes personally ruinous.
OneBookPlus stores per-client consent forms, treatment history, allergy flags, and infection-control records alongside your booking calendar — so the next EHO inspection is a five-minute event.
Last reviewed and updated: by Bishal Shrestha
About the author
Founder & CEO, OneBookPlus
Bishal has over a decade of experience in digital marketing, web development, and small business consulting across Australia. Bishal has walked Australian salons through council skin-penetration registration, autoclave records, and inspection responses across every state.
More in this guide
8-step founder guide — ABN, GST, premises, skin-penetration permit, insurance, equipment, pricing, opening week.
Read →Operator GuidePlain-English MA000005 — Level 1–6 classifications, junior rates, casual loading, Sunday penalties.
Read →ReferencePublic liability ($10–20M), workers comp, treatment/malpractice cover, equipment, premises, glass — premium ranges.
Read →From the blog
Practical guides and explainers from the OneBookPlus blog, grouped by topic.