Global Data and Cyber Handbook Lite

Australia

Select a Topic
Start Comparison
Key Data and Cybersecurity Laws
Jump to
Key Data and Cybersecurity Laws Start Comparison
What are the key data privacy laws and regulations?

Last review date: 31 December 2025

Privacy (Commonwealth):

Privacy (State and Territory - public sector only):

Health sector-specific (Commonwealth):

Health sector-specific (State / Territory):

Note: The responses that follow focus primarily on the Privacy Act but also mention (where specifically relevant) State and Territory public sector privacy laws, health records laws, surveillance laws, telecommunications laws and critical infrastructure laws.

What are the key cybersecurity laws and regulations?

Last review date: 31 December 2025

In November 2024, Australia passed the Cyber Security Act 2024 (Cth) ("Cyber Security Act"), being the first broadly applicable cybersecurity-specific law.

The Cyber Security Act:

  • Requires manufacturers and suppliers to comply with minimum security standards for smart devices acquired in Australia, with the standards to be specified in Ministerial rules
  • Requires businesses that make themselves or have made for them a ransomware payment in relation to a cybersecurity incident to report the payment to the Commonwealth within 72 hours (of making or finding out the payment was made)
  • Establishes a limited use obligation to restrict the sharing of information provided to the National Cyber Security Coordinator, to promote business confidence in sharing information following an incident, and
  • Establishes a Cyber Incident Review Board to conduct reviews after some cyber security incidents

The main sector-specific cybersecurity-related law is the Security of Critical Infrastructure Act 2018 (Cth) ("SOCI Act"). This applies in relation to 22 critical infrastructure asset classes in 11 sectors, including: communications, financial services and markets, data storage or processing, the defense industry, higher education and research, energy, food and grocery, health care and medical, space technology, transport, and water and sewerage.

For the telecommunications sector, given existing security regulations, relevant requirements have historically been split between the SOCI Act and instruments issued pursuant to the Telecommunications Act 1997 (Cth) that apply to carriers and eligible carriage service providers. 2024 reforms uplifted, enhanced and clarified security and related obligations for critical telecommunications assets and moved them into the SOCI Act.

Additionally, the privacy laws and rules listed in the previous question also have implications for cybersecurity. For example, the Privacy Act contains APP 11, which requires APP entities to take reasonable steps to protect personal information that they hold from misuse, interference and loss and from unauthorized access, modification or disclosure. Given that most APP entities store personal information digitally, this effectively requires them to take at least reasonable cybersecurity measures to protect that personal information.

Public sector agencies are also subject to security requirements as a matter of government policy (e.g., see the Protective Security Policy Framework (PSPF)), which does not have the force of law but with which Australian Commonwealth government entities are expected to comply. The PSPF is complemented by the Information Security Manual (ISM) issued by the Australian Cyber Security Centre. The ISM outlines a cybersecurity framework that organizations can apply to protect their systems and data from cyber threats. Compliance with the ISM is not mandatory unless legislation or a lawful direction specifically requires it.

Many of Australia's privacy laws have cybersecurity implications, while various other laws deal with aspects of national security in Australia, which may have implications for data security and computer-related offenses, including:

What are the key laws and regulations relating to non-personal data?

Last review date: 31 December 2025

Commonwealth public sector data:

Telecommunications-specific:

Surveillance (including workplace surveillance):

Freedom of information (FOI) laws:

Other:

{{ $store.state.loadingScreen.message }} ...