According to this:
https://source.android.com/security/bulletin/2016-01-01.html
Google has released it via OTA but it hasn't reached my phone yet (I've checked for updates each day and nothing has appeared) - would it make a difference by the fact that I bought it from 2 Degrees/Noel Leeming rather than from Google?