Australian Compliance Frameworks: Which Security and Privacy Rules Apply to Your Company?

Short answer: Most Australian compliance frameworks fall into two groups. Laws such as the Privacy Act 1988, the Notifiable Data Breaches scheme, APRA prudential standards and the SOCI Act bind specific organisations. Frameworks such as the Essential Eight, ISO 27001 and SOC 2 are voluntary for most private companies but are often required by buyers through contracts and tenders.

Related guides:

• Australian Privacy Principles for small business
• Essential Eight for government suppliers
• APRA CPS 234 checklist

Key takeaways

• Start with the Privacy Act. It covers businesses with annual turnover above $3 million, and smaller businesses in some categories, including health service providers and Commonwealth contractors.
• If the Privacy Act covers you, so does the Notifiable Data Breaches (NDB) scheme. Plan your breach assessment and notification process before you need it.
• The Cyber Security Act 2024 adds a 72-hour duty to report ransomware payments, based on turnover or critical infrastructure status.
• The Essential Eight, the ISM and IRAP come from the Australian Signals Directorate (ASD). They are mandatory for many federal agencies, and suppliers usually meet them through contract terms.
• APRA CPS 234, CPS 230 and the SOCI Act bind regulated entities directly, and in our experience those entities push matching requirements onto their suppliers.
• ISO 27001 and SOC 2 are commercial expectations, not laws. Pick the one your buyers ask for and map Australian requirements onto the same control set.

Which compliance frameworks apply in Australia?

The frameworks that apply to you depend on three things: whether you handle personal or health information, who your customers are, and whether you are regulated yourself. This guide focuses on how the main options fit together.

Framework	What it is	Who it applies to
Privacy Act 1988 and the Australian Privacy Principles (APPs)	Federal privacy law	Organisations over $3 million turnover, plus listed categories regardless of turnover
Notifiable Data Breaches scheme	Breach notification rules in the Privacy Act	Entities covered by the Privacy Act
Cyber Security Act 2024	Mandatory reporting of ransomware and cyber extortion payments	Businesses over the $3 million turnover threshold, and responsible entities for critical infrastructure assets
My Health Records Act and Rules	Rules for using the national My Health Record system	Healthcare provider organisations registered with the system
ASD Essential Eight	Prioritised mitigation strategies with maturity levels	Mandatory baseline for many federal agencies, guidance for everyone else
ISM and IRAP	ASD's security controls and the assessor program that tests them	Government systems and the suppliers whose contracts require it
APRA CPS 234 and CPS 230	Prudential standards for information security and operational risk	APRA-regulated entities such as banks, insurers and super funds
SOCI Act	Critical infrastructure security law	Responsible entities for critical infrastructure assets
ISO 27001 and SOC 2	Certification standard and attestation report	Voluntary, usually driven by customers

Which Australian frameworks are mandatory and which are voluntary?

Laws and prudential standards are mandatory for the organisations they name. Everything else becomes mandatory only when a contract, tender or regulator makes it so.

The practical test: does the obligation come from legislation or a regulator, or from a customer? For a growing SaaS or HealthTech company, customer requirements often drive more day-to-day work, because every enterprise or government buyer adds its own security schedule.

• Mandatory by law or regulation: the Privacy Act and APPs, the NDB scheme, ransomware payment reporting under the Cyber Security Act, My Health Records obligations for registered organisations, APRA prudential standards for regulated entities, and SOCI Act obligations for responsible entities.
• Voluntary unless a contract requires it: the Essential Eight for private businesses, IRAP assessments against the ISM, ISO 27001 and SOC 2.

Does the Privacy Act apply to your company?

It applies if your annual turnover is above $3 million, or if you fall into a covered category regardless of turnover. According to the OAIC's small business guidance, most businesses with turnover of $3 million or less are not covered, but the Act still covers businesses that are, for example, health service providers, traders in personal information, contractors providing services under a Commonwealth contract, or related to a covered business. The OAIC's start-up guidance gives "a product or service that tracks and holds health data" as an example of a health service, so many health apps are likely to be in scope from day one.

The NDB scheme comes with it. The OAIC's NDB guidance says an eligible data breach involves unauthorised access, disclosure or loss of personal information that is likely to cause serious harm, where remedial action has not prevented that harm. If you suspect one, you must assess it quickly, within 30 calendar days, and notify the OAIC and affected individuals as soon as practicable once you have reasonable grounds to believe it occurred.

Health data adds My Health Record rules. If your organisation registers with the My Health Record system, the OAIC's guidance on security and access policies says you need a written security and access policy under rule 21 of the My Health Records Rules 2026, regardless of size. It must cover access authorisation, staff training, physical and information security, and data breach reporting under section 75 of the Act.

State health laws can apply too. NSW and Victoria have their own health privacy laws that reach private organisations. NSW's HRIP Act binds private sector organisations that provide a health service or collect, hold or use health information, and Victoria's Health Records Act has no small business exemption. Check these if you handle health information about people in those states.

Ransomware payments have their own clock. Under section 27 of the Cyber Security Act 2024, a reporting business entity must report a ransomware payment within 72 hours of making it or becoming aware of it. ASD's reporting guidance covers how to report. The obligation has applied since 30 May 2025 and covers businesses over the $3 million turnover threshold and responsible entities for critical infrastructure assets. It is triggered by a payment, not by the attack or demand alone.

Reforms, as of November 2026. The Privacy and Other Legislation Amendment Act 2024 is law. The OAIC summarises its main changes: a statutory tort for serious invasions of privacy, new civil penalty tiers and infringement notices, a Children's Online Privacy Code, a mechanism to prescribe countries with adequate privacy protection, and transparency about substantially automated decisions in privacy policies. The OAIC's corporate plan 2026–27 says the automated decision-making reforms commence in December 2026, and that the government has announced its intention to bring forward a second tranche of reform. Treat anything in that second tranche, including changes discussed in the Privacy Act Review, as proposed until it is passed. Our APPs for small business guide covers the principles themselves.

What do government buyers expect: Essential Eight, ISM and IRAP?

Government buyers usually expect a stated Essential Eight maturity level, and for some systems an IRAP assessment against the ISM. Neither is a general law for private suppliers, but contracts frequently make them binding.

ASD publishes the Essential Eight maturity model, a set of prioritised mitigation strategies graded by maturity level. ASD's Blueprint for Secure Cloud notes that applicable government organisations must implement Maturity Level Two for each Essential Eight component to meet minimum requirements under the Protective Security Policy Framework (PSPF). That is why tenders often name a target level.

The Information Security Manual (ISM) is ASD's broader control catalogue. The Blueprint FAQ explains that the ISM and PSPF set the requirements used to assess cloud providers, and that IRAP assessors are ASD-certified professionals who evaluate a system's security posture and recommend mitigations. Pursue an IRAP assessment when a target buyer requires it. Our Essential Eight for government suppliers guide walks through tender evidence in detail.

What applies if you sell to banks, insurers or critical infrastructure?

Most suppliers are not regulated by APRA or the SOCI Act themselves, but their customers are, and those customers must manage the security of their suppliers.

APRA CPS 234. CPS 234 applies to APRA-regulated entities, including banks and other ADIs, general and life insurers, private health insurers and super fund trustees. It requires them to assess the information security capability of third parties that manage their information assets, and to notify APRA of material incidents within 72 hours and of material control weaknesses within 10 business days. Expect detailed security questionnaires and contract clauses. See our CPS 234 checklist.

APRA CPS 230. CPS 230 took effect on 1 July 2025 for all APRA-regulated entities and covers operational risk, business continuity and service provider management. If you are a material service provider to a regulated entity, expect questions on resilience and continuity as well as security.

SOCI Act. The CISC SOCI obligations factsheet (April 2025) lists 11 sectors, including healthcare and medical, and data storage or processing. Depending on the asset, responsible entities must register assets, report significant cyber incidents within 12 hours and others with a relevant impact within 72 hours, and maintain a critical infrastructure risk management program (CIRMP). If you provide data storage or processing services, check the critical asset definitions with your advisors rather than assuming you are only a supplier. Our SOCI Act CIRMP guide covers what that means for suppliers.

Which frameworks does your type of company need?

Use your company type to find a starting point, then confirm against your own contracts and legal advice.

Company type	Usually mandatory	Usually expected by buyers
Health app or HealthTech handling health information	Privacy Act and APPs regardless of turnover, NDB scheme, My Health Record rules if registered	ISO 27001 or SOC 2, Essential Eight for public health buyers
B2B SaaS selling to banks, insurers or super funds	Privacy Act if covered	CPS 234 and CPS 230 terms in contracts, ISO 27001 or SOC 2
Commonwealth government supplier	Privacy Act (Commonwealth contractors are covered regardless of turnover)	Essential Eight maturity level in the contract, IRAP against the ISM where required
Supplier to critical infrastructure operators	Privacy Act if covered	SOCI-driven contract terms, ISO 27001
Small B2B SaaS under $3 million, no health data	Privacy Act may not apply yet	SOC 2 or ISO 27001 when buyers ask, Essential Eight as a baseline

Many companies fit more than one row. A HealthTech platform sold to a private health insurer, for example, picks up both. In any row, ransomware payment reporting also applies if you are over the $3 million turnover threshold.

How should you sequence Australian compliance frameworks?

Build the legal baseline first, then a security baseline, then the attestation your buyers want, then sector add-ons. Each step reuses the controls from the step before.

1. Privacy baseline. Confirm whether the Privacy Act covers you. If it does, map your personal information, update your privacy policy against the APPs and write a data breach response plan that fits the NDB timeframes.
2. Security baseline. Self-assess against the Essential Eight. Even where nobody requires it, it gives you a concrete set of technical controls to start from.
3. Attestation. Choose ISO 27001 or SOC 2 based on what your pipeline asks for. See our guides to ISO 27001 in Australia and SOC 2 in Australia.
4. Sector add-ons. Layer CPS 234 and CPS 230 evidence, SOCI contract terms or an IRAP assessment on top of the same control set, only when a specific customer or tender needs it.

In our experience, the costliest mistake is treating each framework as a separate project. The controls overlap heavily, so one control library with mapped evidence saves rework.

How SecureSlate helps

SecureSlate gives SMBs and HealthTech teams one place to run several frameworks at once. ISO 27001 and SOC 2 are built in. Australian frameworks such as the Privacy Act and APPs, the Essential Eight, the ISM, APRA CPS 234 and CPS 230 are set up as custom frameworks with custom controls, and multi-framework control mapping lets one control serve all of them.

Agentless read-only cloud integrations and the device agent help collect evidence. Access reviews, vendor risk management and risk management support supplier and third-party questions from regulated buyers. Security questionnaire automation helps you answer bank and government security schedules consistently, the trust center shares your documentation with buyers, and audit management keeps your ISO 27001 or SOC 2 audit organised. Code security and secrets detection cover your engineering stack.

FAQ

Is the Essential Eight mandatory for Australian businesses?

Not for private businesses in general. It is ASD guidance that many federal agencies must implement under the PSPF. A supplier becomes bound when a tender or contract names a maturity level, which is common in government work.

Does the Privacy Act apply to small businesses?

Most businesses with annual turnover of $3 million or less are not covered. The Act still applies regardless of turnover to certain categories, including health service providers, businesses trading in personal information and Commonwealth contractors.

Do Australian customers accept SOC 2, or do they want ISO 27001?

Both are recognised. In our experience, ISO 27001 is more familiar to many Australian and government buyers, while SOC 2 is common with US-linked SaaS customers. Follow what your target customers ask for.

Does my SaaS company need to comply with CPS 234?

CPS 234 binds APRA-regulated entities, not their vendors directly. But those entities must assess the security of third parties managing their information assets, so you will usually see its requirements in questionnaires and contracts.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.