Cyber Incident Lawyers Adelaide: Ransomware, Data Breach Notification and the First 72 Hours
Cyber incident response in South Australia
A cyber incident can start several legal clocks at once. A ransomware payment may have to be reported within 72 hours, and a suspected eligible data breach assessed, with all reasonable steps taken to finish within 30 days. Talon Legal advises Adelaide businesses hit by ransomware, data theft or email compromise, and the managers running the response. Book a same-day free 30-minute consultation or call (08) 7094 2021.
Cyber incident key facts
| Issue | Position in South Australia |
|---|---|
| Suspected data breach | Assess, taking all reasonable steps to finish within 30 days (Privacy Act 1988 (Cth) section 26WH). |
| Eligible data breach | Unauthorised access to, disclosure of or loss of personal information, likely to result in serious harm (sections 26WA and 26WE). |
| Reasonable grounds to believe there was an eligible data breach | A statement to the Australian Information Commissioner, then notice to individuals, each as soon as practicable (sections 26WK and 26WL). |
| Ransomware payment | A reporting business entity must report a payment to the designated Commonwealth body within 72 hours. That is either an entity carrying on business in Australia with turnover over $3,000,000 in the previous financial year (not a Commonwealth or State body or a critical infrastructure responsible entity), or a Part 2B critical infrastructure entity (Cyber Security Act 2024 (Cth) sections 26(2) and 27(1); Rules section 6(1)). Maximum 60 penalty units. |
| Critical infrastructure | Part 2B assets: 12 hours for a critical cyber security incident, 72 hours for others (Security of Critical Infrastructure Act 2018 (Cth) sections 30BC and 30BD). |
| Forensic report | The Full Court refused Optus leave to appeal from a ruling that its report was not shown to have a dominant legal purpose (Singtel Optus v Robertson at [83]). |
| Maximum penalty | Serious interference with privacy by a body corporate: the greatest of $50,000,000, three times the benefit if it can be determined, or otherwise 30% of adjusted turnover during the breach turnover period. Anyone else: $2,500,000 (Privacy Act section 13G). |
| First civil penalty case | $5,800,000 in agreed penalties, including $800,000 each for the assessment and the late statement (Clinical Labs, orders). |
| First step | Same-day free 30-minute consultation. Call (08) 7094 2021. |
Need a cyber incident lawyer in Adelaide?
Our cyber incident lawyers in Adelaide act for businesses facing ransomware, data theft or email compromise. The duties come from Part IIIC of the Privacy Act 1988 (Cth), Parts 3 and 4 of the Cyber Security Act 2024 (Cth) and, for critical infrastructure, the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act). This page states the law current to 7 November 2026.
This guide is part of our cybersecurity practice. Privacy Act compliance generally is covered in our data protection and privacy guide. Related guides cover data security clauses, penetration testing agreements and AI and privacy.
Free Consultation. If an incident is under way, the 30-day assessment may already have started. Book a same-day free 30-minute consultation or call (08) 7094 2021.
On this page
- What starts the legal clock after a cyber incident?
- When is a cyber incident a notifiable data breach?
- How long does a business have to assess a suspected breach?
- What must the statement and notifications say?
- Does a ransomware payment have to be reported?
- Should the National Cyber Security Coordinator be told?
- Is the forensic report privileged?
- What do contracts and insurers require?
- Is the attack a crime, and should police be told?
- What should a business do after an email compromise?
- What are the penalties?
- How similar matters tend to play out
- How we act in a cyber incident
- Case law
- Frequently asked questions
What starts the legal clock after a cyber incident?
Different facts start different clocks, and several can run at once.
| Trigger | Duty | Time | Provision |
|---|---|---|---|
| Reasonable grounds to suspect an eligible data breach | Assess | All reasonable steps to finish within 30 days | Privacy Act section 26WH |
| Reasonable grounds to believe there was one | Statement to the Commissioner, then notices | As soon as practicable | Sections 26WK and 26WL |
| A ransomware payment by or for a reporting business entity | Report to the designated Commonwealth body | 72 hours | Cyber Security Act sections 26(2) and 27 |
| Critical cyber security incident, Part 2B asset | Report to the relevant Commonwealth body | Within 12 hours | SOCI Act section 30BC |
| Other relevant incident, Part 2B asset | Report to the relevant Commonwealth body | 72 hours | SOCI Act section 30BD |
| Significant cyber security incident | Optional information to the National Cyber Security Coordinator | Any time | Cyber Security Act section 35 |
Record when the business became aware of each fact. The 30 days run from awareness of the grounds for suspicion, and the 72 hours from the payment or learning of it. A ransomware report does not replace the Privacy Act steps.
Part 2B of the SOCI Act applies only to assets specified in the rules or covered by a section 51 declaration (section 30BB). A critical cyber security incident has a significant impact on the asset’s availability, and must be reported as soon as practicable and within 12 hours (section 30BC).
When is a cyber incident a notifiable data breach?
When it is an eligible data breach of an APP entity, meaning a business bound by the Australian Privacy Principles. Part IIIC applies where an APP entity holds personal information and must comply with APP 11.1 for it (section 26WE(1)(a)). A business with annual turnover of $3,000,000 or less is generally outside the Act unless an exception applies (section 6D).
Personal information is information or an opinion about an identified or reasonably identifiable individual, whether true or not (section 6(1)). A breach is eligible where a reasonable person would conclude that unauthorised access to, or disclosure of, the information would be likely to result in serious harm to any of the individuals it relates to. Loss is caught where unauthorised access or disclosure is likely and would be likely to cause that harm (section 26WE(2)).
Serious harm is judged against listed matters, such as the kind and sensitivity of the information, its security and who has or could obtain it (section 26WG). For encrypted data, the question includes how likely it is that people intending harm have or could obtain the means to get around it, such as the key (section 26WG(h)).
Remedial action can take an incident outside the scheme. If the business acts before serious harm results, and a reasonable person would then conclude that serious harm is not likely, there is no eligible data breach for any entity (section 26WF(1)). The rule also works person by person (section 26WF(2)). Record what was done, and when.
How long does a business have to assess a suspected breach?
The business must take all reasonable steps to complete its assessment within 30 days. The duty arises when it is aware of reasonable grounds to suspect an eligible data breach, but not of reasonable grounds to believe one has happened. The assessment must be reasonable and expeditious, and the 30 days run from awareness (section 26WH).
Where one entity complies with section 26WH, and the same access, disclosure or loss is an eligible data breach of other entities, section 26WH does not apply to the others (section 26WJ).
Quality matters as much as speed. In Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224, where the duty was described in the same terms ([71]), the company relied on an external provider’s assessment. It had monitored 3 of at least 127 affected computers, reviewed one firewall log and made only a limited check of whether the attackers had kept access. The company knew it was limited, so relying on it alone was unreasonable ([77] to [78]). Ask what the forensic work covered and what it left out.
What must the statement and notifications say?
The statement must give the business’s identity and contact details, describe the breach, list the kinds of information concerned and recommend steps for individuals (section 26WK(3)). It goes to the Commissioner as soon as practicable once there are reasonable grounds to believe there has been an eligible data breach (section 26WK(2)). A statement that does not comply with section 26WK(3) is itself a contravention, with a maximum of 200 penalty units (section 13K(2) and (4)).
The business must then notify each individual the information relates to, or each individual at risk, if practicable. If not, it must publish the statement on its website, if it has one, and take reasonable steps to publicise it. This must happen as soon as practicable after the statement is prepared (section 26WL). Where one entity complies with sections 26WK and 26WL for a shared breach, those sections do not apply to the others (section 26WM).
Clinical Labs shows how delay is measured. The obligation was engaged by at least 16 June 2022 ([86]), and the company admitted that two to three days was practicable ([89]). Its statement on 10 July 2022 contravened section 26WK(2) ([90]).
The Commissioner may, by written notice, declare that sections 26WK and 26WL do not apply, or extend the time to notify individuals (section 26WQ). While a business’s application is pending, those sections do not apply (section 26WQ(9)). The Commissioner may also direct a business to notify, and it must comply as soon as practicable (section 26WR(10)).
Does a ransomware payment have to be reported?
Yes, by a reporting business entity, within 72 hours. Since May 2025, Part 3 of the Cyber Security Act has applied where a cyber security incident has had, is having or could reasonably be expected to have a direct or indirect impact on a reporting business entity (section 26(1)). It also requires a demand by an extorting entity, of the business or any other entity, to benefit from the incident or its impact (section 26(1)(d)). Part 3 applies only if the business then makes a payment or provides a benefit directly related to the demand, or is aware that another entity has done so on its behalf (section 26(1)(e)).
A reporting business entity is one that carries on business in Australia with annual turnover over $3,000,000 for the previous financial year, other than a Commonwealth or State body or a critical infrastructure responsible entity (section 26(2)(a); Cyber Security (Ransomware Payment Reporting) Rules 2025 section 6(1)). A responsible entity for a critical infrastructure asset to which Part 2B of the SOCI Act applies is also one (section 26(2)(b)).
The report goes to the designated Commonwealth body within 72 hours of the payment or of learning of it (section 27(1)). It covers the business’s details, the incident, the demand, the payment and communications with the extorting entity, so far as known or findable by reasonable search or enquiry (section 27(2)). Failing to report carries a civil penalty of 60 penalty units (section 27(5)).
The Act protects the reporting business. There is no liability in damages for acts done in good faith in complying with section 27 (section 28). The designated Commonwealth body may use the information only for listed purposes, and not to enforce other laws against the business, apart from Part 3 and criminal offences (section 29). Other bodies that obtain it are bound the same way (section 30). Reporting does not otherwise affect a claim of legal professional privilege, subject to limited exceptions (section 31). With exceptions, the information is not admissible against the business (section 32).
Part 3 creates a reporting obligation. It does not deal with whether to pay, and that decision has legal dimensions that need advice at the time.
Should the National Cyber Security Coordinator be told?
That is the business’s choice. An impacted entity carrying on business in Australia may give the National Cyber Security Coordinator information about a significant cyber security incident at any time during the response, and need not respond to a request (Cyber Security Act section 35 and the note to section 35(3)).
An incident is significant if there is a material risk that it has seriously prejudiced, or could reasonably be expected to prejudice, the social or economic stability of Australia or its people, the defence of Australia or national security. It is also significant if it is, or could reasonably be expected to be, of serious concern to the Australian people (section 34).
The Coordinator may use the information only to help the business and for permitted cyber security purposes. It cannot be used to enforce other laws against the business, apart from Part 4 and criminal offences (section 38). Giving it does not otherwise affect privilege (section 41). With limited exceptions, it is not admissible against the business (section 42).
Is the forensic report privileged?
Not automatically. In Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58, the Full Court refused Optus leave to appeal from a ruling against its privilege claim over a forensic report into its September 2022 cyber attack. The Full Court considered the primary judge right on two points: Optus had several purposes, and the evidence did not establish that the report was procured for the dominant purpose of legal advice, or for use in litigation or regulatory proceedings ([83]).
Purpose will usually be judged when a third-party report is commissioned, though later events can matter ([88]). The General Counsel’s own legal purpose, carried into effect through the external law firm, did not establish the company’s dominant purpose where the company in fact had several purposes ([93]). The report had also been commissioned before the law firm’s formal engagement letter ([94]).
So decide and document the purpose when the report is commissioned. Where findings are also needed for remediation, insurers or public statements, consider commissioning that work separately.
What do contracts and insurers require?
Contracts may set their own deadlines, so read them on day one. Supplier and customer contracts may require notice within hours and access to forensic information, as the data security clauses guide explains.
A supplier’s incident can be an eligible data breach of both businesses. Where one of them complies with section 26WH, or with sections 26WK and 26WL, those sections do not apply to the other (sections 26WJ and 26WM), so agree who does each. If the business disclosed the information to an overseas recipient, APP 8.1 applied to the disclosure and the recipient holds it, Part IIIC applies as if the business held it (section 26WC(1)). Where the APPs do not otherwise apply to that recipient, its act that would breach the APPs (other than APP 1) is taken to be the business’s act and breach (section 16C).
Check any cyber insurance policy for notice terms before anyone is engaged.
A claim against an IT provider is likely to turn on the contract’s limitation clause. Such a clause is read according to its natural and ordinary meaning, in the light of the whole contract, and where appropriate against the party relying on it if it is ambiguous (Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 at [16]).
Is the attack a crime, and should police be told?
Part 10.7 of the Criminal Code (Cth) and the Summary Offences Act 1953 (SA) create offences of unauthorised access to, modification of or impairment of data. Each has its own elements, such as knowing it is unauthorised. Access, modification or impairment is unauthorised if the person is not entitled to cause it (Criminal Code section 476.2(1)).
| Offence | Provision | Maximum |
|---|---|---|
| Unauthorised access, modification or impairment to commit or facilitate a serious offence | Criminal Code section 477.1 | The penalty for that offence |
| Unauthorised modification of data, reckless as to impairment | Section 477.2 | 10 years |
| Unauthorised impairment of electronic communication | Section 477.3 | 10 years |
| Unauthorised access to or modification of restricted data | Section 478.1 | 2 years |
| Operating a restricted-access computer system without proper authorisation | Summary Offences Act section 44 | $2,500 or 6 months imprisonment if done to obtain a benefit or cause a detriment; otherwise $2,500 |
| Unauthorised impairment of stored data, intending or reckless as to harm | Summary Offences Act section 44A | 2 years |
Part 10.7 has extended geographical jurisdiction, category A (section 476.3), and does not limit State law (section 476.4(1)). Reporting to police is a practical decision: a report creates an independent record, and banks and insurers may ask for one.
What should a business do after an email compromise?
Move on the money and the data together. Ask the bank to contact the receiving bank at once, report the matter to police, and keep the emails and login records. If the mailbox held personal information and someone had unauthorised access to it, consider whether there are reasonable grounds to suspect an eligible data breach (section 26WE). If there are, the 30-day assessment applies (section 26WH).
The contract points are practical. Terms of trade and invoices can say that bank details will not change by email alone. A change of payee details can be confirmed by phone, on a number already on file, with two people approving it. Supplier contracts can require prompt notice if a mailbox may be compromised. Calls and video can be faked too, so confirm using contact details already held. Where a payment has gone astray, speak to a cyber incident lawyer before paying again or refusing to pay.
What are the penalties?
The Privacy Act has three tiers of civil penalty, and the reporting laws add their own.
| Contravention | Provision | Maximum |
|---|---|---|
| Serious interference with privacy | Privacy Act section 13G | Body corporate: the greatest of $50,000,000, three times the benefit if it can be determined, or otherwise 30% of adjusted turnover during the breach turnover period. Anyone else: $2,500,000 |
| Interference with privacy | Privacy Act section 13H | 2,000 penalty units |
| Listed APP breaches, or a non-compliant statement | Privacy Act section 13K | 200 penalty units, with infringement and compliance notices |
| Not reporting a ransomware payment | Cyber Security Act section 27(5) | 60 penalty units |
| Not reporting a critical infrastructure incident | SOCI Act sections 30BC and 30BD | 50 penalty units |
These figures are current to 7 November 2026. Seriousness turns on matters such as the sensitivity of the information and the number of people affected (section 13G(1B)). If the court is not satisfied that an interference was serious, it may order a section 13H penalty (section 13J).
In Clinical Labs, the parties agreed, and the Court was satisfied, that there was a separate contravention for each of the more than 223,000 individuals whose information was held on the affected systems ([60]). The Court approved agreed penalties of $5,800,000: $4,200,000 for the security failure (APP 11.1(b)), $800,000 for the assessment and $800,000 for the late statement (orders, [7]).
How similar matters tend to play out
Illustrations of how the law on this page combines on ordinary facts, not predictions. Outcome depends on the facts, the evidence and the regulator.
Lower range. Someone uses a stolen password to log into a logistics business’s customer portal, which holds names and delivery addresses. Logs show a short session that viewed a few accounts. The business assesses (section 26WH) and, weighing the kind of information and who could have it (section 26WG), may conclude that serious harm is not likely. It records why, and no statement is needed.
Middle range. A manufacturer carrying on business in Australia, with turnover over $3,000,000 in the previous financial year, is hit by ransomware. The attackers say they copied customer bank details. If the business pays, or learns that someone paid on its behalf, it must report within 72 hours (Cyber Security Act sections 26(2) and 27(1)). The claim of theft would usually give reasonable grounds to suspect an eligible data breach, so the 30-day assessment starts (section 26WH). A forensic report commissioned with no record of its purpose may not be privileged (Optus at [83], [88]).
Upper range. An online retailer keeps customer identity documents with an overseas platform, which is breached, and 40,000 customers’ documents appear online. If APP 8.1 applied to the disclosure, Part IIIC applies as if the retailer held the information (section 26WC(1)). Each individual can be a separate contravention (Clinical Labs at [60]), with the section 13G maximums for a serious interference. Waiting weeks for the provider’s report before notifying risks the delay that contravened section 26WK(2) in Clinical Labs ([89] to [90]).
How we act in a cyber incident
Our cyber incident lawyers work alongside the business’s IT team and forensic firm, building a record of what the business knew and when.
| Stage | What happens | What we do |
|---|---|---|
| First hours | The incident is found and contained. | Record when the business learnt each fact, and engage forensic help with its purpose in writing. |
| Assessment | The forensic work shows what was taken. | Run the section 26WH assessment against the section 26WG matters, and test the evidence. |
| Ransom demand | A demand or a payment is made. | Advise on the legal dimensions at the time, and prepare the 72-hour report where Part 3 applies. |
| Notification | There are reasonable grounds to believe there was an eligible data breach. | Prepare the statement and notices, and coordinate with other entities. |
| Aftermath | The Commissioner, customers or suppliers raise claims. | Respond to the Commissioner and deal with contract claims. |
We cannot promise an outcome, and no lawyer can. We can make sure each step is taken on time, on evidence that will stand up.
Every hour matters. Book a same-day free 30-minute consultation, or call (08) 7094 2021 now.
Cyber incident case law
Clinical Labs was the first civil penalty proceeding brought by the Commissioner in the history of the Privacy Act ([6]).
| Case | Court | Principle | Pinpoint |
|---|---|---|---|
| Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224 | Federal Court | Assessment, late notification and agreed penalties | [7], [50], [60], [71], [77] to [78], [86], [89], [90] |
| Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58 | Full Federal Court | Leave to appeal refused; no dominant legal purpose shown for a forensic report | [83], [88], [93], [94] |
| Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 | High Court | Construing limitation clauses | [16] |
Case notes
Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224
After a cyberattack on systems it had acquired, the company consented to declarations of contraventions of APP 11.1(b), section 26WH(2) and section 26WK(2). Halley J approved agreed penalties of $5,800,000 ([7]). The reasonable steps standard is objective ([50]), and the Court was satisfied there was a separate contravention for each of more than 223,000 individuals ([60]).
Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58
The Full Court refused Optus leave to appeal from a ruling against its privilege claim over a forensic report, agreeing that Optus had several purposes and had not shown a dominant legal one ([83]). For a third-party report, purpose is usually judged at commissioning ([88]).
Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82
On appeal from South Australia, the joint reasons said exclusion and limitation clauses are construed according to their natural and ordinary meaning, read with the whole contract, and where appropriate against the party relying on them if ambiguous ([16]).
Frequently asked questions
What should a business do in the first 72 hours of a cyber incident?
Record when it became aware of each fact, because some periods run from awareness. A reporting business entity must report a ransomware payment within 72 hours of making it or becoming aware it was made (Cyber Security Act section 27(1)). A business covered by the Privacy Act must also take all reasonable steps to complete the assessment of a suspected eligible data breach within 30 days after becoming aware of the grounds (Privacy Act section 26WH).
Is every data breach notifiable?
No. Only an eligible data breach, likely to result in serious harm, must be notified (Privacy Act section 26WE), and prompt remedial action can mean there is none (section 26WF).
How long does a business have to notify the Commissioner of a data breach?
As soon as practicable once it has reasonable grounds to believe there has been an eligible data breach (section 26WK). In Clinical Labs, the company admitted that two to three days was practicable ([89]).
Does a ransomware payment have to be reported?
Yes, within 72 hours, by a reporting business entity. That is either an entity carrying on business in Australia with annual turnover over $3,000,000 for the previous financial year (not a Commonwealth or State body or a critical infrastructure responsible entity), or a Part 2B critical infrastructure entity (Cyber Security Act sections 26(2) and 27(1); Rules section 6(1)).
Can a ransomware report be used against the business?
Generally not. It cannot be used to enforce other laws against the business, apart from Part 3 and criminal offences (sections 29 and 30), and with exceptions it is not admissible against the business (section 32).
Is a forensic report about a cyber attack privileged?
Not automatically. In Singtel Optus v Robertson, the Full Court refused Optus leave to appeal from a ruling that its report was not shown to be for the dominant purpose of legal advice or litigation ([83]).
Do customers have to be told about a data breach?
Yes, for an eligible data breach: each affected individual, or each individual at risk, if practicable, and otherwise by publishing the statement, as soon as practicable (Privacy Act section 26WL).
What if the breach happened at a supplier?
It can still be the business’s breach. Where one entity that shares the breach complies with the assessment duty, or with the statement and notification duties, those duties do not apply to the others (sections 26WJ and 26WM).
Is hacking a crime in Australia?
It can be. Intentionally causing unauthorised access to restricted data, knowing it is unauthorised, carries up to 2 years. Causing unauthorised impairment of electronic communication, knowing it is unauthorised, carries up to 10 years (Criminal Code sections 478.1 and 477.3).
Do I need a cyber incident lawyer?
For a suspected data breach or a ransom demand, yes. A cyber incident lawyer can keep the assessment and notifications on time and put the purpose of the forensic work on record. A free 30-minute consultation will tell you where you stand.