Technology, Data & Cyber in Australia

Essentials guide · Source-checked research48% of statements checked against a source30 checked against an official source0 checked against a secondary sourceChecked 2026-10-1913 held back until checked against an official source10 topics include AI-written statements, not source-checkedNot yet professionally reviewed

• The federal Privacy Act 1988 and its 13 Australian Privacy Principles regulate how private sector organisations collect, use, disclose and secure personal information, with the Office of the Australian Information Commissioner as regulator.

  Applies to organisations with annual turnover above AUD 3 million and to some other organisations. The OAIC small business page lists health service providers and businesses that trade in personal information among those covered regardless of turnover.Office of the Australian Information Commissioner (OAIC) · checked 2026-10-19

• Entities covered by the Privacy Act must notify the OAIC and affected individuals of an eligible data breach that is likely to result in serious harm.

  Federal Notifiable Data Breaches scheme.Office of the Australian Information Commissioner (OAIC) · checked 2026-10-19

• Before disclosing personal information overseas, an organisation must take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, and generally remains accountable for the recipient's handling.

  Federal; exceptions in APP 8.2 include a recipient subject to a substantially similar law or scheme, informed consent, and disclosures required or authorised by Australian law.Office of the Australian Information Commissioner (OAIC) · checked 2026-10-19

• A statutory cause of action for serious invasions of privacy, in Schedule 2 of the Privacy Act 1988, commenced on 10 June 2025; it covers intrusion upon seclusion and misuse of information.

  Federal; the plaintiff must show a reasonable expectation of privacy and that the public interest in privacy outweighs any countervailing public interest. Exemptions cover bodies including intelligence agencies and law enforcement bodies and, in some circumstances, journalists. The OAIC has no direct role in administering the tort.Office of the Australian Information Commissioner (OAIC) · checked 2026-10-19

• Under Part 3 of the Cyber Security Act 2024, businesses with annual turnover above AUD 3 million, and responsible entities for critical infrastructure assets, must report ransomware or cyber extortion payments to the Australian Signals Directorate within 72 hours.

  Federal; reporting has applied since 30 May 2025, with an education-first approach to compliance until 31 December 2025. Critical infrastructure responsible entities are those under Part 2B of the Security of Critical Infrastructure Act 2018.Department of Home Affairs · checked 2026-10-19

Read the full guide: Data protection and cyber