Cybersecurity law & regulation in Australia (2026)

Legal framework

Cyber Security Act 2024 (Cth) (Australia's first standalone cyber law), supported by the Security of Critical Infrastructure Act 2018 (SOCI Act), the Privacy Act 1988 Notifiable Data Breaches (NDB) scheme, and sectoral rules such as APRA Prudential Standard CPS 234; administered by the Department of Home Affairs, the Australian Signals Directorate (ASD/ACSC), OAIC and APRA.

Key points: cybersecurity in Australia

1. 01Cyber Security Act 2024 — standalone national law

   Australia's first standalone cyber security statute establishes four pillars: mandatory security standards for smart devices, mandatory ransomware/extortion payment reporting, limited-use protections for information voluntarily shared with the National Cyber Security Coordinator, and a Cyber Incident Review Board (CIRB) to conduct no-fault post-incident reviews.

   homeaffairs.gov.au twobirds.com

2. 02Mandatory ransomware-payment reporting

   From 30 May 2025, entities carrying on business in Australia with annual turnover above A$3 million, and all responsible entities for critical infrastructure assets regardless of turnover, must report any ransomware or cyber-extortion payment to the Australian Signals Directorate (ASD) within 72 hours of making or becoming aware of the payment.

   homeaffairs.gov.au claytonutz.com

3. 03SOCI Act — critical infrastructure duties

   The Security of Critical Infrastructure Act 2018 imposes an all-hazards regime on 11 sectors (including energy, telecommunications, data storage/processing and finance): asset registration, a Critical Infrastructure Risk Management Program (CIRMP), and mandatory cyber-incident notification to ASD within 12 hours for critical incidents and 72 hours for other reportable incidents; further amendments were opened for consultation on 25 March 2026 following the first Independent Review delivered 31 January 2026.

   homeaffairs.gov.au allens.com.au

4. 04Smart-device security standards in force

   The Cyber Security (Security Standards for Smart Devices) Rules 2025 commenced on 4 March 2026 and apply to internet- and network-connectable consumer products manufactured or supplied on or after that date, requiring unique/user-set passwords, a public vulnerability disclosure process, and transparency about security-update support periods; the regime has extraterritorial reach to overseas manufacturers selling into Australia.

   homeaffairs.gov.au hsfkramer.com

5. 05Privacy Act — Notifiable Data Breaches (NDB) scheme

   APP entities (Commonwealth agencies, businesses with turnover over A$3 million, health service providers, credit reporting bodies, TFN recipients and CDR/Digital ID accredited entities) must notify the OAIC and affected individuals of any 'eligible data breach' likely to result in serious harm; entities generally have 30 days to assess whether a breach is notifiable.

   oaic.gov.au oaic.gov.au

6. 06Financial-sector rule: APRA CPS 234

   Prudential Standard CPS 234 requires all APRA-regulated entities (banks, insurers, superannuation funds) to maintain an information-security capability commensurate with the threat, ensure third-party providers meet equivalent controls, and notify APRA of any material information-security incident as soon as possible and no later than 72 hours after becoming aware; board-level accountability is mandatory.

   apra.gov.au apra.gov.au

Timeline of decisions

1. 8 Aug 2025Enforcement · official
   OAIC sues Optus in Federal Court over 2022 breach

   The Australian Information Commissioner commenced civil penalty proceedings alleging Optus failed to take reasonable steps to protect 9.5 million customers' data, with potential penalties of up to A$2.22 million per contravention. It is the first major test of the Privacy Act's serious-interference provisions against a large breach.

   OAIC

2. 30 May 2025Law · official
   Mandatory ransomware payment reporting commences

   Part 3 of the Cyber Security Act 2024 took effect, requiring entities with turnover above A$3 million or operating critical infrastructure to report ransom/extortion payments to cyber.gov.au within 72 hours. It establishes Australia's first mandatory ransomware-payment reporting regime.

   Department of Home Affairs

3. 21 Nov 2023Guidance · official
   2023-2030 Australian Cyber Security Strategy released

   The government published its roadmap to make Australia a 'world leader in cyber security by 2030', built on six cyber 'shields' and delivered across three horizons, backed by A$586.9 million in new funding. It set the policy direction for the Cyber Security Act and SOCI/Privacy reforms that followed.

   Department of Home Affairs

4. 13 Oct 2022Incident · official
   Medibank ransomware breach disclosed

   Health insurer Medibank disclosed a breach in which attackers exfiltrated ~520GB of data on 9.7 million current and former members; after Medibank refused a ~US$10 million ransom, data was published on the dark web. The incident, alongside Optus, catalysed Australia's cyber and privacy law overhaul.

   OAIC

5. 22 Sept 2022Incident · official
   Optus data breach exposes 9.5 million customers

   Optus disclosed a breach exposing personal data, including driver licence, passport and Medicare numbers, of around 9.5 million Australians, accessed via an unprotected API. The breach prompted emergency government data-sharing regulations and a national rethink of cyber obligations.

   Queensland Government

6. 2 Apr 2022Law · official
   SLACIP Act 2022 strengthens critical infrastructure protection

   The Security Legislation Amendment (Critical Infrastructure Protection) Act received Royal Assent, requiring responsible entities to adopt and maintain a Critical Infrastructure Risk Management Program and introducing enhanced cyber-security obligations for systems of national significance. It completed the two-part SOCI reform package.

   Department of Home Affairs

7. 2 Dec 2021Law · official
   SLACI Act 2021 expands SOCI Act with mandatory incident reporting

   The Security Legislation Amendment (Critical Infrastructure) Act commenced, extending the SOCI Act to 11 critical sectors and mandating reporting of significant cyber incidents to the ACSC (within 12 hours for critical impacts) plus government 'last resort' intervention powers. It transformed SOCI into a broad cyber-resilience regime.

   Cyber and Infrastructure Security Centre

8. 1 Jul 2019Guidance · official
   APRA CPS 234 Information Security standard takes effect

   The mandatory prudential standard required APRA-regulated banks, insurers and superannuation funds to maintain information-security capability, clarify board accountability, and notify APRA of material security incidents within 72 hours. It established baseline cyber obligations for the financial sector.

   APRA

9. 11 Jul 2018Law · official
   Security of Critical Infrastructure Act 2018 enacted

   The original SOCI Act created a register of critical infrastructure assets and information-gathering and ministerial directions powers across electricity, gas, water and ports. It laid the foundation for Australia's later critical-infrastructure cyber-security obligations.

   Cyber and Infrastructure Security Centre

10. 1 Oct 2001Law · official
    Cybercrime Act 2001 establishes core computer offences

    The Act inserted modern computer-related offences (unauthorised access, modification and impairment of data) into the Criminal Code, aligning Australia with the Council of Europe Convention on Cybercrime. It remains the foundational criminal-law basis for prosecuting cyber intrusions.

    Federal Register of Legislation

Sources

1. 1.homeaffairs.gov.au/cyber-security-subsite/Pages/cyber-security-act.aspx
2. 2.homeaffairs.gov.au/about-us/our-portfolios/cyber-security/security-standards-for-smart-d
3. 3.homeaffairs.gov.au/about-us/our-portfolios/cyber-security/strategy/security-of-critical-
4. 4.oaic.gov.au/privacy/notifiable-data-breaches/about-the-notifiable-data-breaches-s
5. 5.apra.gov.au/standards/cps-234
6. 6.twobirds.com/en/insights/2024/australia/australias-first-standalone-cyber-security
7. 7.claytonutz.com/insights/2024/december/navigating-australia-s-first-standalone-cyber-
8. 8.hsfkramer.com/insights/2026-03/malfunctioning-machines-to-mandatory-standards-cyber
9. 9.allens.com.au/insights-news/insights/2026/04/three-papers-one-message-why-australia
10. 10.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/pr
11. 11.apra.gov.au/information-security-requirements-for-all-apra-regulated-entities