Three pillars. One obligation.
Security, Privacy, and Accessibility are not separate compliance exercises — they are three dimensions of a single duty of care owed to every user of a digital service.
Security
The infrastructure layer
Prevents breaches, tampering, and unauthorised access. Protects the integrity of systems, data, and digital assets from external and internal threats.
Privacy
The trust layer
Ensures personal information is handled ethically and legally. Empowers users with control and transparency over how their data is collected and used.
Accessibility
The completion layer
Makes sure everyone, regardless of ability, can benefit from digital assets. Without access, no user can exercise the security or privacy protections built for them.
"If a user cannot access a digital asset, every security control and privacy safeguard built into that asset provides them with zero protection."
Organisations invest enormously in ISO 27001 certifications, penetration testing, GDPR compliance, and privacy-by-design architectures. Yet if the interfaces through which users access those protections are inaccessible to people with disabilities, those users are effectively excluded from the security and privacy umbrella entirely. They may be forced into workarounds — phone calls, third-party intermediaries, printed forms — each of which introduces the very risks the digital security layer was designed to eliminate. Accessibility is not a bolt-on; it is the delivery mechanism for everything else.
View Sources and More Statistics
Framework Analysis
Explore how the three pillars interconnect, what breaks when accessibility is absent, and the design principles that organisations must apply.
Security enables Accessibility
Secure systems create the stable, trustworthy foundation users rely on when interacting with assistive technologies. Screen readers, switch access devices, and AAC tools all require stable, authenticated sessions — security makes that possible.
Privacy empowers Accessibility
Users with disabilities often share sensitive health and support information with digital services. Strong privacy controls create the trust necessary for these users to engage fully, rather than avoiding services due to data exposure concerns.
Accessibility validates Security
WCAG-compliant authentication flows ensure MFA, password managers, and secure login mechanisms work with screen readers and keyboard navigation. Inaccessible security UX forces users to disable protections — defeating the entire investment.
Accessibility validates Privacy
Cookie consent banners, privacy dashboards, and data subject request portals must be accessible. If a user cannot read or operate a consent dialog, their privacy rights cannot be exercised — a compliance failure masquerading as a UX problem.
The Convergence: All Three as One Requirement
The Australian Government's Digital Service Standard, WCAG 2.2, the Privacy Act 1988, and the Security of Critical Infrastructure Act all point toward a singular obligation: digital services must be secure, private, and accessible to all Australians. These are not three separate compliance exercises — they are three dimensions of a single duty of care. An organisation that achieves two out of three has failed its users. The person who needs a screen reader to access their Medicare account deserves the same security and privacy protections as everyone else — and cannot receive them without accessibility.
When accessibility is absent, the entire protection chain breaks for excluded users — regardless of how sophisticated the security and privacy systems are.
Scenario 1 — Inaccessible Authentication
- A visually impaired user cannot complete a CAPTCHA-based login — they call a support line instead
- Verbal account verification over phone creates an unencrypted, unaudited security gap
- The secure digital channel is bypassed entirely — the security investment is worthless for this user
- The organisation has created a two-tier system: secure access for some, insecure access for others
Scenario 2 — Inaccessible Privacy Controls
- A user with motor impairment cannot operate a cookie consent interface using keyboard-only navigation
- Implicit consent is assumed — their data is processed without informed agreement
- Under the Australian Privacy Act and GDPR, this is a compliance failure, not just a UX issue
- Privacy-by-design becomes privacy-by-exclusion for users who cannot operate the controls
Scenario 3 — Inaccessible Security Alerts
- A deaf user misses a critical audio-only security alert about unauthorised account activity
- No visual or text-based equivalent notification exists — a WCAG 1.4.2 / 1.3.3 failure
- Breach response time is delayed — the security system fails the person it was built to protect
- The investment in threat detection and alerting provides zero benefit to this user
Accessibility-First Security Design
Security mechanisms — authentication, session timeouts, alerts, MFA — must be designed with WCAG 2.2 compliance as a requirement, not an afterthought. Security UX that cannot be operated with a keyboard or screen reader is not secure UX; it is a barrier that forces users into less secure alternatives.
Privacy Controls are Accessibility Obligations
Every consent mechanism, data subject request portal, and privacy dashboard must meet WCAG 2.2 AA minimum. Consent obtained through an inaccessible interface is legally and ethically compromised. Organisations should treat inaccessible privacy UX as a reportable privacy incident.
Workarounds are Not Compliant Alternatives
Directing users with disabilities to phone lines or assisted channels as an alternative to inaccessible digital services does not satisfy accessibility obligations and actively undermines security and privacy by routing users through channels with weaker protections and audit trails.
The Duty of Care Extends to All Users
An organisation that has invested in ISO 27001 and GDPR compliance has demonstrated a duty of care to its users' security and privacy. That duty is not discharged for users with disabilities unless accessibility is also met. Partial compliance is institutional discrimination.
SPA Maturity is Measured at its Weakest Point
An organisation cannot claim high SPA maturity if any one of the three dimensions fails. Using the W3C Accessibility Maturity Model alongside security and privacy maturity frameworks reveals the true capability of an organisation to protect and serve all its users — not just those without disabilities.
Ready to close the accessibility gap in your SPA compliance?
Whether you're an Australian Government agency meeting the 2026 deadline or a private organisation with a duty of care, ExceedAbility can help you achieve all three pillars.