Cybersecurity law & regulation in Australia (2026)

The Australian Information Commissioner commenced civil penalty proceedings alleging Optus failed to take reasonable steps to protect 9.5 million customers' data, with potential penalties of up to A$2.22 million per contravention. It is the first major test of the Privacy Act's serious-interference provisions against a large breach.

Part 3 of the Cyber Security Act 2024 took effect, requiring entities with turnover above A$3 million or operating critical infrastructure to report ransom/extortion payments to cyber.gov.au within 72 hours. It establishes Australia's first mandatory ransomware-payment reporting regime.

The Act progressed 23 reforms from the Privacy Act Review, including a new statutory tort for serious invasions of privacy (effective by 10 June 2025) and stronger enforcement powers. It marks the most significant overhaul of Australian privacy law since the Privacy Act 1988.

The government published its roadmap to make Australia a 'world leader in cyber security by 2030', built on six cyber 'shields' and delivered across three horizons, backed by A$586.9 million in new funding. It set the policy direction for the Cyber Security Act and SOCI/Privacy reforms that followed.

Health insurer Medibank disclosed a breach in which attackers exfiltrated ~520GB of data on 9.7 million current and former members; after Medibank refused a ~US$10 million ransom, data was published on the dark web. The incident, alongside Optus, catalysed Australia's cyber and privacy law overhaul.

Optus disclosed a breach exposing personal data, including driver licence, passport and Medicare numbers, of around 9.5 million Australians, accessed via an unprotected API. The breach prompted emergency government data-sharing regulations and a national rethink of cyber obligations.

The Security Legislation Amendment (Critical Infrastructure Protection) Act received Royal Assent, requiring responsible entities to adopt and maintain a Critical Infrastructure Risk Management Program and introducing enhanced cyber-security obligations for systems of national significance. It completed the two-part SOCI reform package.

The Security Legislation Amendment (Critical Infrastructure) Act commenced, extending the SOCI Act to 11 critical sectors and mandating reporting of significant cyber incidents to the ACSC (within 12 hours for critical impacts) plus government 'last resort' intervention powers. It transformed SOCI into a broad cyber-resilience regime.

The mandatory prudential standard required APRA-regulated banks, insurers and superannuation funds to maintain information-security capability, clarify board accountability, and notify APRA of material security incidents within 72 hours. It established baseline cyber obligations for the financial sector.

The original SOCI Act created a register of critical infrastructure assets and information-gathering and ministerial directions powers across electricity, gas, water and ports. It laid the foundation for Australia's later critical-infrastructure cyber-security obligations.

Amendments to the Privacy Act 1988 made breach notification mandatory, requiring covered entities to notify affected individuals and the OAIC of eligible data breaches likely to cause serious harm. It introduced Australia's first economy-wide mandatory breach-reporting obligation.

The Act inserted modern computer-related offences (unauthorised access, modification and impairment of data) into the Criminal Code, aligning Australia with the Council of Europe Convention on Cybercrime. It remains the foundational criminal-law basis for prosecuting cyber intrusions.