Australian Privacy and Cyber Rules Guide: Privacy Act, SOCI and NDB

Australian organisations now answer to several overlapping privacy and cyber laws, each with its own regulator, trigger and clock, and a single ransomware incident can engage all of them at once. The Privacy Act 1988 and its Australian Privacy Principles set the baseline for personal information, the Notifiable Data Breaches scheme sets the breach rules, the Security of Critical Infrastructure Act 2018 adds risk management and incident reporting for critical assets, and the Cyber Security Act 2024 adds mandatory ransomware payment reporting and a Cyber Incident Review Board. The Privacy and Other Legislation Amendment Act 2024 started the first tranche of Privacy Act reform. This guide sets out who each law covers, what security teams must do, which timelines apply and how to build one response process that meets them all. It is written for security, privacy and risk teams in Australia and for multinationals with Australian operations.

Key takeaways

• APP 11 is the security duty. APP entities must take reasonable steps to protect personal information, and since December 2024 the Act states those steps include "technical and organisational measures".
• The NDB clock starts at suspicion. A suspected eligible data breach must be assessed reasonably and expeditiously, within a maximum of 30 days, then notified to the OAIC and affected individuals as soon as practicable.
• Critical infrastructure runs faster. SOCI responsible entities report critical cyber incidents to ASD's ACSC within 12 hours and other incidents within 72 hours.
• Paying a ransom is now reportable. Businesses with annual turnover above AUD 3 million, and SOCI Part 2B entities, must report ransomware payments within 72 hours, an obligation active since 30 May 2025.
• Reform is still arriving. The statutory tort for serious invasions of privacy commenced in June 2025 and automated decision-making transparency rules commence on 10 December 2026.

The Australian regime at a glance

Regulated financial institutions also face APRA's CPS 234, with its own 72-hour notification. For how these laws compare internationally, see the Global Privacy Regulatory Map and the Global Cybersecurity Regulatory Map.

The Privacy Act 1988 and the Australian Privacy Principles

The Privacy Act regulates "APP entities": most Australian Government agencies and private organisations with annual turnover above AUD 3 million, plus some smaller organisations the Act brings in. The 13 Australian Privacy Principles cover the whole life of personal information, from open and transparent management (APP 1) through collection, use and disclosure, cross-border disclosure (APP 8), quality, and security (APP 11) to access and correction.

Australian Privacy Principle 11

• APP 11.1: take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.
• APP 11.2: take reasonable steps to destroy or de-identify personal information that is no longer needed for any permitted purpose, unless law or a court order requires it to be kept.
• APP 11.3 (from 11 December 2024): the reasonable steps "include technical and organisational measures", applying to information held after commencement whenever it was collected.

The OAIC's APP guidelines (chapter 11, updated October 2025) list the factors that set what is reasonable: the entity's size, resources and outsourcing; the amount and sensitivity of the information; the possible harm from a breach; practical cost and time; and whether a measure is itself privacy invasive. The OAIC states an entity "is not excused from taking particular steps" because they are inconvenient or costly. The guidelines expect a layered approach across governance and training, ICT security, access security, third-party and cloud providers, data breach response, physical security, and destruction or de-identification. Outsourcing storage does not remove responsibility where the entity keeps the right to deal with the data.

APP 11 does not name controls, so practitioners translate it. The Essential Eight Guide covers the ASD baseline most Australian organisations use as evidence of reasonable steps.

The Notifiable Data Breaches scheme

The NDB scheme, inserted by the Privacy Amendment (Notifiable Data Breaches) Act 2017, applies to breaches from 22 February 2018. Under section 26WE, an eligible data breach occurs when personal information is accessed or disclosed without authorisation, or lost, in circumstances likely to result in serious harm to any of the individuals concerned, judged from the viewpoint of a reasonable person in the entity's position. If remedial action prevents the likely serious harm, the breach is not eligible (section 26WF).

• Serious harm is broad: the OAIC notes harm can include psychological, emotional, physical and reputational harm. Breaches of credentials, identity documents and health information often meet it.
• Thirty days is a ceiling: the assessment must be expeditious, not a full forensic investigation. Start the assessment record on the day of suspicion.
• Credential leaks are breaches: exposed API keys or service account passwords that unlock personal information are an unauthorised-access risk. See the Leaked Credential Response Playbook.

Privacy and Other Legislation Amendment Act 2024

This Act, which received Royal Assent on 10 December 2024, is the first tranche of Australian Privacy Act reform. Its commencement is staged.

• Statutory tort: individuals gain a cause of action where another person invaded their privacy "by intruding upon their seclusion or misusing information relating to them", among other elements. Defences include lawful authority, consent and necessity; exemptions cover intelligence agencies, law enforcement bodies, people under 18 and, in some circumstances, journalists.
• Automated decisions: Part 15 adds privacy policy requirements for automated decisions that use personal information. Organisations using AI agents in decision workflows should inventory them now.
• Enforcement: Part 8 changed the penalties for interference with privacy and Parts 9 to 14 changed court orders, inquiries, determinations and the OAIC's monitoring and investigation powers.

Security of Critical Infrastructure Act 2018

The SOCI Act covers responsible entities for critical infrastructure assets across 11 sectors and 22 asset types. The Cyber and Infrastructure Security Centre (CISC) in Home Affairs administers it. Security teams meet it in three places.

Critical infrastructure risk management program (CIRMP)

The CIRMP Rules (LIN 23/006) 2023, registered on 16 February 2023, apply to asset classes including data storage or processing, electricity, gas, water, liquid fuel, food and grocery, freight, broadcasting, domain name systems, designated hospitals and some financial market infrastructure. A responsible entity must identify material risks and minimise them as far as reasonably practicable across four hazard domains.

The cyber framework deadline is 12 months after an initial six-month period, giving roughly 18 months from when an asset comes into scope. Material risks named in the Rules include remote access to operational control systems.

Mandatory cyber incident reporting

CISC guidance sets two clocks for reports to ASD's ACSC. A critical cyber security incident, with a "significant impact on the availability" of an asset supplying essential goods or services, must be reported within 12 hours of becoming aware; an oral report must be followed by a written one within 84 hours. Other incidents with a "relevant impact on the availability, integrity or reliability" of the asset, or on the confidentiality of its information, must be reported within 72 hours, with a written follow-up to an oral report within 48 hours.

Systems of National Significance and enhanced cyber security obligations

The Minister for Home Affairs may privately declare an asset a System of National Significance under Part 6A. The Secretary can then apply any of four enhanced cyber security obligations under Part 2C: a written cyber incident response plan; cyber security exercises, with an evaluation report within 30 days of completion; vulnerability assessments, with a report within 30 days; and access to system information, which can require periodic or event-based reports of logs, telemetry and alerts to ASD or, as a last resort, installation of a specified program.

Cyber Security Act 2024 and ransomware payment reporting

The Cyber Security Act 2024 received Royal Assent on 29 November 2024. Part 2 sets security standards for smart devices, Part 3 creates ransomware reporting, Part 4 governs information shared voluntarily with the National Cyber Security Coordinator about significant incidents, and Part 5 establishes the Cyber Incident Review Board.

The report is about the payment, not the attack, and it does not replace NDB or SOCI notifications. The Caesars Entertainment breach, where a ransom was paid after social engineering of an IT vendor, is the kind of event that in Australia would trigger ransomware reporting, NDB assessment and possibly SOCI reporting together.

The Cyber Incident Review Board conducts post-incident reviews to recommend how similar incidents could be prevented, detected, responded to or minimised. A review needs a referral (from the Minister, the National Cyber Security Coordinator, an impacted entity or a Board member), an incident meeting criteria such as serious prejudice to national security or novel methods, the incident and immediate response to have ended, and ministerial approval of terms of reference.

ASD's Australian Cyber Security Centre

ASD's ACSC sits within the Australian Signals Directorate and leads the Australian Government's cyber security effort. It is not a regulator: it receives SOCI incident reports and ransomware payment reports, runs the 24/7 hotline 1300 CYBER1 (1300 292 371), publishes alerts and advisories, and maintains the Essential Eight and the Information Security Manual. Regulation sits with the OAIC (privacy), Home Affairs and CISC (SOCI and the Cyber Security Act) and sector regulators such as APRA.

Where identity fits

• Access security under APP 11: the OAIC lists access security as a core area; in practice that means MFA, least privilege and logging on systems holding personal information, including access by service providers. The Snowflake breach showed customer data exposed through accounts without MFA on a third-party platform.
• Critical workers under CIRMP: section 9 requires identifying who can access critical components and removing access on off-boarding. See the Joiner-Mover-Leaver Guide.
• Non-human identities: service accounts, API keys and AI agents that reach personal information or operational technology need owners, scoped privileges and rotation, and their compromise is a reportable path. See the Service Account Security Guide.

How to implement: one response process for every clock

1. Map applicability: confirm whether you are an APP entity, a SOCI responsible entity (and which asset class), above the ransomware turnover threshold, APRA regulated, or a SoNS.
2. Build a clocks register: list every trigger and window (SOCI 12 and 72 hours, ransomware 72 hours, APRA 72 hours where relevant, NDB 30-day assessment then as soon as practicable) with owners and submission channels.
3. Fix the evidence of reasonable steps: pick one framework (Essential Eight or ISO/IEC 27001 suit both APP 11 and CIRMP), assess against it and record the gaps with dates.
4. Write the triage step: a single incident decision form that records awareness time and asks every regulatory question at once, with legal privilege considered from the start.
5. Exercise it: run a ransomware tabletop that forces payment, NDB and SOCI decisions, then update the playbook. See the Ransomware Response and Recovery Guide.
6. Prepare for December 2026: inventory automated decision systems, including AI agents, and draft the privacy policy disclosures.

Decision guidance

• Below AUD 3 million turnover: many small businesses sit outside both the Privacy Act and ransomware reporting, but health service providers and others are brought in, and SOCI responsible entities report regardless of size. Check before assuming exemption.
• Remediate or notify: if credentials are revoked and the data is confirmed unaccessed before harm is likely, section 26WF may remove the duty to notify. Document the evidence; if in doubt, notify.
• Which framework for CIRMP: Essential Eight Maturity Level One is the lightest route for IT-heavy assets; AESCSF or C2M2 suits energy and OT environments; ISO/IEC 27001 suits organisations already certified.
• Paying a ransom: reporting is not approval. Sanctions laws and the reporting duty both apply, and the 72-hour clock runs from the payment.

Detection and measurement

• Time to assessment: days from first suspicion to a documented NDB decision, against the 30-day ceiling.
• Regulatory clock compliance: percentage of SOCI, ransomware and NDB reports filed within their window.
• Framework conformance: CIRMP framework maturity per asset (for example Essential Eight maturity level by strategy).
• Access hygiene: percentage of systems holding personal information with MFA enforced for all human and privileged access.
• Retention: volume of personal information past its retention date and not yet destroyed or de-identified under APP 11.2.

Framework mapping

Common failure patterns

• Waiting for forensics: treating the 30-day assessment window as time to finish an investigation, then notifying late.
• Missing the 12-hour SOCI clock: incident teams focus on containment and nobody owns the regulatory call.
• Keeping data forever: APP 11.2 destruction never happens, so breaches expose years of former customers' records.
• Third-party blind spots: personal information in SaaS and processor systems sits outside monitoring and MFA policy.
• Ransom decisions without the reporting step: payments are arranged through negotiators or insurers and nobody files within 72 hours.

Practitioner checklist

• Confirm which regimes apply: Privacy Act, NDB, SOCI asset class, SoNS, ransomware threshold, APRA.
• Maintain a regulatory clocks register with owners and submission channels.
• Document APP 11 reasonable steps against a recognised framework, including technical and organisational measures.
• Run the NDB assessment from the day of suspicion and record the decision within 30 days.
• For SOCI assets, meet the chosen CIRMP cyber framework and identify critical workers.
• Rehearse 12-hour and 72-hour SOCI reports, including the written follow-up.
• Embed ransomware payment reporting in the incident and insurance playbooks.
• Enforce MFA and least privilege, for people and non-human identities, on systems holding personal information.
• Destroy or de-identify personal information that is no longer needed.

Standards and references

• OAIC: APP Guidelines Chapter 11, APP 11 Security of personal information
• OAIC: The Notifiable Data Breaches scheme, an overview
• Federal Register of Legislation: Privacy and Other Legislation Amendment Act 2024
• Federal Register of Legislation: Cyber Security Act 2024
• Federal Register of Legislation: Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023
• Department of Home Affairs: Ransomware payment reporting factsheet
• Cyber and Infrastructure Security Centre: Mandatory cyber incident reporting guidance
• Cyber and Infrastructure Security Centre: Systems of National Significance and enhanced cyber security obligations factsheet

Related NHI Mgmt Group resources: Global Privacy Regulatory Map · Global Cybersecurity Regulatory Map · Essential Eight Guide · Incident Response Guide · Financial Services Identity Security Guide. This guide summarises the Privacy Act 1988, the Notifiable Data Breaches scheme, the Privacy and Other Legislation Amendment Act 2024, the SOCI Act 2018 and the Cyber Security Act 2024 as of 18 October 2026 and is not legal advice.