Australia has toughest data breach fines in APAC: report

Australia has the largest maximum possible fines for data breaches in the Asia–Pacific region, according to a report from business insurance broker Aon.

The report found that with fines of up to the greater of $50 million, three times the benefit derived from the breach or 30% of annual turnover, Australia is one of the region’s more mature cyber regulatory markets. Australia also has a mandatory data breach reporting scheme in place, as well as mandatory cybersecurity breach notification requirements for critical infrastructure or other regulated entities.

Australia’s data privacy regime is primarily governed by the Privacy Act, which applies to most organisations with an annual turnover of more than $3 million as well as small businesses in some other sensitive sectors, Aon said. A notifiable breach occurs when there is unauthorised access to, disclosure or loss of personal information held by an entity, the access is more likely than not to result in serious harm to any individuals to whom the information relates, and remedial action has not been able to prevent the likelihood of harm.

When becoming aware of a suspected eligible data breach, organisations must take reasonable steps to complete an assessment within 30 days. If the threshold is met, notification should be made to the Office of the Australian Information Commissioner and any impacted individuals as soon as practicable.

Australia’s privacy framework has seen significant reform over the past 12–18 months, with recent amendments creating an additional pathway for civil claims arising from serious invasions of privacy, and more reforms are underway, the report notes. In parallel, additional cyber-related regulatory obligations apply under sector-specific legislation, including the Security of Critical Infrastructure Act 2018 and the Cyber Security Act 2024.

The report found that in Australia, cyber insurance coverage is generally available for fines and penalties issued against entities and individuals, unless the fine or penalty is uninsurable by law. For example, the Corporations Act prohibits the indemnification of directors and officers of companies for certain conduct, and the Financial Accountability Regime applies to the banking, insurance and superannuation industries.

There is currently no Australian legislation prohibiting the indemnification of fines issued as a result of non-compliance with the Privacy Act. For non-serious interference with privacy, fines can be up to $660,000 for a person and $3.3 million for bodies corporate.

While there is no legislation prohibiting the payment of ransomware and other ransoms in Australia, since May last year, relevant organisations have been required to report to the Australian Signals Directorate within 72 hours of making a ransom payment.

Aon Head of Cyber Solutions Quinton Kotze said the research demonstrates that cyber incidents can create challenges long after systems are restored.

Image credit: iStock.com/narvo vexar