The Australian cyber and privacy regulatory calendar on one page

1 Jul 2025

APRA Prudential Standard CPS 230

Australian Prudential Regulation Authority (APRA)

CPS 230 commenced on 1 July 2025 for most APRA-regulated entities, consolidating five previous standards covering operational risk, business continuity and outsourcing. Boards are now accountable for identifying critical operations, setting tolerance levels for disruption, testing business continuity annually, and maintaining a register of material service providers with substitution plans. Smaller entities have until 1 July 2026 to comply. APRA finalised targeted amendments on 30 April 2026.

30 May 2025

Cyber Security Act 2024 (Cth), Part 3

Department of Home Affairs / National Cyber Security Coordinator

Businesses with annual turnover over $3 million, and all critical infrastructure entities, must report any ransomware payment to the National Cyber Security Coordinator within 72 hours of payment or commitment to pay. Reporting does not legalise the payment; it is a transparency obligation that sits alongside existing OAIC and AUSTRAC obligations.

10 Jun 2025

Privacy and Other Legislation Amendment Act 2024 (Cth)

Privacy Act 1988 (Cth)

For the first time in Australian law, individuals have a direct cause of action against any person or organisation that seriously invades their privacy, intentionally or recklessly, whether through intrusion on seclusion or misuse of information. The cause of action is not limited to entities covered by the Australian Privacy Principles. Small businesses currently exempt from the APPs are still exposed to the tort.

Ongoing

September 2024 release

Department of Industry, Science and Resources

Australia's voluntary AI governance framework. Ten guardrails covering accountability, risk management, data quality, testing, transparency, contestability, human oversight, supply chain, and stakeholder engagement. The Voluntary AI Safety Standard is the reference framework Australian regulators will use when assessing AI deployment, including under the Privacy Act and Australian Consumer Law.

5 Jun 2026

OAIC public consultation

Office of the Australian Information Commissioner

OAIC released the exposure draft of the Children's Online Privacy Code on 31 March 2026. Phase 3 consultation (with children, parents and providers) closes 5 June 2026. The Code introduces age assurance, default high privacy settings, and stricter handling rules for personal information of users under 18. The final Code must be registered by 10 December 2026.

12 Jul 2026

ASD public consultation

Australian Signals Directorate (ASD)

ASD ran public consultation on the evolution of the Essential Eight into a new framework called Essentials for enterprise IT. The consultation closed on 12 July 2026. ASD will now work through submissions before publishing the final framework, with the Essential Eight remaining current guidance throughout a roughly two-year transition. The mitigation strategies behind today's Essential Eight remain the foundation.

1 Jul 2026

APRA CPS 230 transition deadline

Australian Prudential Regulation Authority (APRA)

Smaller superannuation entities and non-significant financial institutions have until 1 July 2026 to comply with CPS 230 Operational Risk Management. The core obligations are the same as for larger entities; APRA applies proportionality to the depth of documentation and testing.

10 Dec 2026

Privacy (Children's Online Privacy) Code 2026

Office of the Australian Information Commissioner

The final Children's Online Privacy Code must be registered by 10 December 2026, which is also the commencement date for other Privacy Act reforms. The Code complements the broader Privacy Act reform and the Social Media Minimum Age legislation. Once registered, the Code is binding on providers within scope.

4 Mar 2026

Cyber Security (Security Standards for Smart Devices) Rules 2025

Department of Home Affairs

Part 2 of the Cyber Security Act 2024 (Cth) commenced on 4 March 2026, alongside the Security Standards for Smart Devices Rules 2025. Manufacturers, importers and distributors supplying relevant connectable products (consumer IoT and smart devices) to the Australian market must meet baseline security standards aligned with ETSI EN 303 645: unique default passwords, a vulnerability disclosure policy, and defined minimum security update periods. Products manufactured before 4 March 2026 are not required to comply.

Stage 1 in force

Scams Prevention Framework Act 2025 (Cth)

Treasury / ASIC / ACMA / ACCC

The Scams Prevention Framework Act 2025 (Cth) introduces a principles-based regime requiring designated sectors to prevent, detect, disrupt, respond to and report scams. Stage 1 of the SPF is in force. Treasury released the draft sector rules and codes on 28 May 2026, with mandatory sector obligations expected to commence in 2027 once the rules are finalised. Failure to meet obligations can result in significant civil penalties and customer reimbursement in some cases.

Tranche 2

Commencement subject to amending legislation

Attorney-General's Department

The Australian Government has accepted in principle the recommendation from the Privacy Act Review Report to remove the small business exemption. Once commenced, approximately 2.5 million Australian businesses currently exempt under the $3 million turnover rule will be brought under the Australian Privacy Principles, the Notifiable Data Breaches scheme, and OAIC enforcement.

Ongoing

Mandatory since 2018; small business extension pending

Office of the Australian Information Commissioner

Entities covered by the Privacy Act must assess suspected eligible data breaches within 30 days and notify the OAIC and affected individuals as soon as practicable once an eligible breach is identified. OAIC received 1,113 notifications across 2024, the highest annual total since the scheme commenced. The NDB scheme will extend to small business as the small business exemption is removed.

Ongoing

Cyber insurance renewal cycle

Australian cyber insurance market

Australian cyber insurance underwriters now consistently require evidence of six operational controls on proposal forms: MFA on all users (especially privileged), EDR or MDR on all endpoints, tested backups including Microsoft 365, an incident response plan, patch management cadence, and security awareness training. Renewals through 2025 and 2026 are also beginning to ask about the statutory privacy tort and AI governance.