Four dates that changed the default
- 29 November 2024
The Cyber Security Act 2024 received assent
The Act bundles several measures, and not all of them stop at critical infrastructure. Ordinary businesses are inside the scope of the ransomware reporting rules, and anyone supplying a connectable product is inside the device security requirements.[3]
- 30 May 2025
Ransomware payments became reportable
Entities carrying on business in Australia with an annual turnover above the threshold prescribed in the reporting rules, and critical infrastructure entities regardless of turnover, must report a ransomware payment within 72 hours of making it. Check the current figure in the rules rather than in a summary.[3][4]
- 10 June 2025
A privacy claim that does not need the regulator
The statutory tort for serious invasions of privacy commenced. It is broader than the Privacy Act, extending to individuals and other entities that may not be Australian Privacy Principle entities, and the OAIC has no direct role in administering it.[1]
- 10 December 2026
Automated decisions have to be disclosed
From this date an APP entity whose computer program uses personal information to make decisions that could reasonably be expected to significantly affect a person must describe, in its privacy policy, the kinds of personal information used and the kinds of decisions made.[2]
The tort widened who can raise a privacy problem
Privacy exposure used to be discussed almost entirely as a regulator conversation: a complaint, an investigation, a remediation plan. The statutory tort sits outside that path. It reaches conduct by individuals and entities that are not necessarily APP entities, and the OAIC states plainly that it does not administer it.[1]
The practical effect on a build is small but real. Features that collect more than the task needs, log more than the feature needs, or make personal information visible to staff who have no reason to see it are no longer only a compliance argument. Data minimisation and access scoping are the cheapest response, and they are cheapest before launch.[1]
Ransomware reporting is a build-time decision
Seventy-two hours is not long to establish what was encrypted, which systems were affected, what was paid and by whom. Organisations that can answer quickly are the ones that already had an asset inventory, retained logs somewhere the attacker could not reach, and a named person able to authorise the report.[3][4]
None of that is bought during an incident. Treat centralised logging with a separate retention boundary, an inventory that matches production, and a rehearsed decision path as part of the delivery scope rather than as an operations afterthought.[3][4]
- Know which entity carries the reporting obligation
- Keep logs outside the blast radius of the production estate
- Name who decides and who reports, with a backup for each
- Rehearse the timeline once rather than reading it first during an incident
Automated decision-making disclosure starts at the design table
The obligation is a documentation obligation, but it is impossible to satisfy from documentation alone. A team can only describe the kinds of personal information used and the kinds of decisions made if someone recorded that while the feature was built. A scoring rule, a ranking model, an eligibility filter or an automatic price adjustment can all qualify when the outcome significantly affects a person.[2]
The amendments apply to decisions made from the commencement date regardless of when the arrangement for the program was made, so an existing feature is not exempt because it predates the rule. The useful move now is an inventory: which automated decisions exist, what personal information feeds them, what the decision affects, and who reviews an outcome a person disputes.[2]
Connectable products carry their own baseline
If the work involves a device rather than only a web application, the Act sets mandatory security requirements for internet-connectable and network-connectable products supplied new in Australia: no universal default passwords, a published way to report vulnerabilities, and transparency about the minimum period of security updates.[3]
Those three are unremarkable engineering practice, which is the point. They are cheap to design in and awkward to retrofit across a shipped fleet, so a hardware-adjacent project should confirm them at specification time.[3]