Data Security Clause Lawyers Adelaide: Supplier Contracts, Breach Notification, Audits and Liability
Data security clauses in South Australia
A supplier’s data breach can be its customer’s breach too, and the contract decides how fast the customer finds out. Talon Legal drafts and negotiates data security clauses, security schedules and data processing terms for Adelaide businesses that outsource data handling, and for the IT, cloud, payroll, marketing and call centre suppliers asked to sign them. Book a same-day free 30-minute consultation or call (08) 7094 2021.
Data security clause key facts
| Issue | Position in South Australia |
|---|---|
| Security obligation | Reasonable steps to protect personal information, including technical and organisational measures (Privacy Act, APP 11.1 and 11.3). |
| Outsourcing | Overreliance on third party providers was among the matters listed in Clinical Labs ([52](g)). |
| Overseas suppliers | Unless an APP 8.2 exception applies, reasonable steps so the overseas recipient does not breach the APPs (APP 8.1). Where APP 8.1 applied, the recipient's breach can be treated as the discloser's (section 16C). |
| Shared breaches | Where one entity complies with the assessment duty, or the statement and notification duties, those duties do not apply to the others (sections 26WJ and 26WM). |
| Ransomware | A reporting business entity must report a ransomware payment it makes, or becomes aware was made on its behalf, within 72 hours of the payment or of becoming aware of it. The turnover threshold is $3,000,000. Maximum 60 penalty units (Cyber Security Act 2024 sections 26 and 27; Rules section 6(1)). |
| End of contract | Reasonable steps to destroy or de-identify personal information no longer needed (APP 11.2). |
| Critical infrastructure | A responsible entity that becomes aware that a data storage or processing service relating to business critical data is provided to it commercially must take reasonable steps to inform the provider as soon as practicable. Maximum 50 penalty units (SOCI Act section 12F(3)). |
| Unfair terms | Void in a standard form small business contract (ACL section 23(1)). |
| First step | Same-day free 30-minute consultation. Call (08) 7094 2021. |
Need a data security clause lawyer in Adelaide?
Our data security clause lawyers in Adelaide act for businesses that outsource data handling. We also act for the IT, cloud, payroll, marketing and call centre suppliers asked to sign security schedules and data processing agreements. The Privacy Act 1988 (Cth) sets the security, offshore and breach rules a clause must support. The Cyber Security Act 2024 (Cth) adds ransomware payment reporting. The Security of Critical Infrastructure Act 2018 (Cth) reaches suppliers to critical infrastructure, and the Australian Consumer Law (ACL) in the Competition and Consumer Act 2010 (Cth) limits unfair terms. This page states the law current to 7 November 2026.
This guide is part of our cybersecurity practice. Related guides cover cyber incident response, penetration testing agreements and IT outsourcing, cloud and hosting.
Free Consultation. Send us the supplier’s security schedule before you sign it. Book a same-day free 30-minute consultation or call (08) 7094 2021.
On this page
- Why does a data security clause matter?
- What security obligations should a supplier accept?
- What if the supplier holds data overseas?
- Who assesses and notifies when a supplier is breached?
- What should a ransomware clause say?
- What happens to the data when the contract ends?
- Should the customer have audit and testing rights?
- What extra applies to critical infrastructure and financial services?
- Can a supplier limit its liability for a data breach?
- Do confidentiality clauses still matter?
- How similar matters tend to play out
- How we act on data security clauses
- Case law
- Frequently asked questions
Why does a data security clause matter?
Because a supplier’s failure can become the customer’s legal problem. An APP entity must take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure (APP 11.1). Those steps include technical and organisational measures (APP 11.3).
Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224 was the first civil penalty proceeding the Commissioner brought under the Act ([6]). Halley J said the reasonable steps standard is objective, and the circumstances are given a broad construction. They can include the sensitivity of the information, the potential harm, the entity’s size and sophistication, the cybersecurity environment and previous threats or attacks ([50]).
The company consented to declarations that it had not taken reasonable steps. The matters the judgment lists include its overreliance on third party service providers, without adequate procedures of its own to detect and respond to cyber incidents ([52](g)). The Court approved agreed penalties totalling $5,800,000 (orders). The data protection and privacy guide covers the penalty tiers.
A data security clause gives the customer obligations to rely on and rights to check them. A data security clause lawyer reads it with the customer’s incident plan.
What security obligations should a supplier accept?
Specific ones. A promise to follow “industry best practice” gives the customer little to enforce. The schedule should name what matters: access controls and logging, encryption, data location, staff vetting and training, patching and backups. It can also adopt a benchmark, such as the ASD Essential Eight. The split in APP 11.3 between technical and organisational measures makes a useful checklist.
Suppliers should resist obligations they cannot meet or measure. A clause written for a cloud host rarely fits a payroll bureau.
A supplier with annual turnover of $3,000,000 or less is generally outside the Privacy Act, subject to exceptions (sections 6C, 6D(1) and 6D(4)). Then the contract is all the customer has, so it should require the supplier to handle personal information as if the Australian Privacy Principles (APPs) applied.
Subcontractors need the same treatment: the customer’s consent first, a current list with locations, the same obligations passed down in writing, and the supplier answerable for their conduct.
What if the supplier holds data overseas?
Then the customer can be liable for what the supplier does. Unless an exception in APP 8.2 applies, an APP entity must take reasonable steps, before disclosing personal information to an overseas recipient, so that the recipient does not breach the APPs, other than APP 1 (APP 8.1).
If APP 8.1 applied, the APPs do not otherwise apply to the recipient, and the recipient does something that would breach them, the act is taken to be the Australian entity’s own breach (section 16C).
The breach rules follow the data. If the overseas recipient holds information disclosed where APP 8.1 applied, the Notifiable Data Breaches provisions apply as if the Australian entity held it (section 26WC(1)). In effect, where APP 8.1 applied, a breach at an offshore supplier can be the customer’s to assess and notify.
The contract should bind the supplier to the APPs, give prompt notice of incidents, control onward transfers, and deal with return and deletion. The IT offshoring agreements guide covers the rest.
Who assesses and notifies when a supplier is breached?
Each entity whose breach it is, unless another of them complies. The contract should say who does the work. One incident can be an eligible data breach of several entities, such as a supplier and its customers. If one entity complies with the assessment duty, that duty does not apply to the others (section 26WJ). If one complies with the statement and notification duties, those do not apply to the others (section 26WM). Both exceptions turn on actual compliance. A contract that leaves the work to the supplier does not protect the customer if the supplier falls short.
The duties are tight. An entity aware of reasonable grounds to suspect an eligible data breach must carry out a reasonable and expeditious assessment. It must take all reasonable steps to complete it within 30 days (section 26WH). Once there are reasonable grounds to believe there was one, it must give the Commissioner a statement as soon as practicable (section 26WK). It must then notify the individuals where practicable, or otherwise publish the statement and take reasonable steps to publicise it, in each case as soon as practicable (section 26WL).
Speed helps everyone. If an entity acts before the access or disclosure results in serious harm, and a reasonable person would then conclude serious harm is not likely, there is no eligible data breach for that entity or any other (section 26WF(1)).
A data breach notification clause should require the supplier to:
- notify the customer within a short fixed period of suspecting an incident, then give updates;
- contain the incident and preserve logs and other evidence;
- give the customer the forensic findings and the information behind them;
- agree who assesses and who notifies, and when; and
- meet the costs of a breach it caused.
Access to evidence matters. In Clinical Labs, the external assessment the company relied on had monitored 3 of at least 127 affected computers and reviewed one firewall log. The judgment records that, because the company knew it was limited, relying on it alone was unreasonable ([77] to [78]). The cyber incident response guide covers the steps after an incident.
What should a ransomware clause say?
Who may pay, and who must be told. Part 3 of the Cyber Security Act 2024 applies where a cyber security incident has, or could reasonably be expected to have, a direct or indirect impact on a reporting business entity. An extorting entity must have made a demand of that entity or any other entity. The trigger is that the reporting business entity provides, or is aware that another entity has provided on its behalf, a payment or benefit directly related to the demand (section 26(1)).
A reporting business entity includes a business carrying on business in Australia with turnover over $3,000,000 in the previous financial year, other than a Commonwealth or State body or a critical infrastructure responsible entity (section 26(2)(a); Cyber Security (Ransomware Payment Reporting) Rules 2025, section 6(1)). A critical infrastructure responsible entity is covered only where Part 2B of the SOCI Act applies to its asset (section 26(2)(b)).
The entity must give the designated Commonwealth body a report within 72 hours of making the payment or becoming aware that it was made (section 27(1)). The report covers the entity’s details and those of any other entity that paid, the incident and its impact, the demand, the payment and communications with the extorting entity, so far as known or findable by reasonable search or enquiry (section 27(2)). The maximum civil penalty for not reporting is 60 penalty units (section 27(5)).
“On its behalf” is where supplier contracts matter. A managed service provider that pays a demand during an incident affecting a customer may be paying on the customer’s behalf, which is a question of fact. If so, the customer’s 72 hours run from when it becomes aware. The clause should require immediate notice of any demand, bar any payment on the customer’s behalf without written agreement, and supply the information the customer’s report needs.
Whether to pay is a decision with legal dimensions that need advice at the time, and the clause should leave it with the customer.
What happens to the data when the contract ends?
It should come back, and then be destroyed. An APP entity must take reasonable steps to destroy or de-identify personal information it no longer needs for any permitted purpose, unless it is in a Commonwealth record or the law requires it to be kept (APP 11.2).
The clause should require the supplier to return the data in a usable format, delete it from live systems and backups within a set time, cover its subcontractors’ copies, and certify that it has done so. Any retention the law requires should be named in the clause. Transition help, at agreed rates, stops the supplier holding the data hostage to a final invoice.
Should the customer have audit and testing rights?
Yes, and they should be usable. A right to audit on reasonable notice, to receive the supplier’s own audit and test results, and to require fixes within set times lets the customer check what the schedule promises. After Clinical Labs, a customer should also be able to see the information behind any assessment the supplier gives it.
A customer that wants to test the supplier’s systems itself needs the supplier’s written authorisation, which the clause can give in advance with scope and timing rules. The penetration testing agreements guide explains why that permission matters.
What extra applies to critical infrastructure and financial services?
Notice and reporting duties under the SOCI Act and, for financial services licensees, the guidance in RI Advice. A responsible entity for a critical infrastructure asset may become aware that another entity provides it, on a commercial basis, with a data storage or processing service relating to business critical data. It must then take reasonable steps to inform that entity, as soon as practicable (Security of Critical Infrastructure Act 2018 (Cth) section 12F(3)). The maximum civil penalty is 50 penalty units. Business critical data includes personal information relating to at least 20,000 individuals (section 5). A supplier that receives such a notice should take advice on its own position.
Where Part 2B applies to the customer’s asset (section 30BB), the customer must report a critical cyber security incident, one with a significant impact on availability, to the relevant Commonwealth body as soon as practicable and within 12 hours (section 30BC). Other incidents with a relevant impact must be reported within 72 hours (section 30BD). Supplier notice periods need to fit inside those windows.
For financial services licensees, the key case is ASIC v RI Advice Group Pty Ltd [2022] FCA 496. The Federal Court declared, on agreed facts, that RI Advice, a licensee, contravened the Corporations Act. It had failed to have documentation and controls for cybersecurity and cyber resilience adequate to manage risk across its authorised representative network. Rofe J said adequacy is assessed with the technical expertise of a relevantly skilled person ([46] to [47]). It is in the end for the Court, likely informed by expert evidence ([55]). Cyber risk cannot be reduced to zero, but it can be materially reduced to an acceptable level ([58]).
The declarations concerned a financial services licensee only. For a licensee, supplier schedules and audit results may form part of the documentation of its controls.
Can a supplier limit its liability for a data breach?
Yes, but read the cap before signing. A limitation clause is construed by its natural and ordinary meaning, read in the light of the whole contract and its nature and object. Where appropriate, an ambiguity is resolved against the party relying on it (Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 at [16]). In that appeal from South Australia, a clause limited a broker’s liability to $100 for each unauthorised contract ([19]).
Data incidents test the drafting. Notification, forensic and credit monitoring costs and claims by individuals may be argued to be consequential loss, so a customer that wants them recovered should list them. A separate, higher cap for data incidents is worth negotiating, and a supplier should keep its cap within its insurance.
Standard form terms meet a further limit. An unfair term in a standard form small business contract is void (ACL section 23(1)). A small business contract is one where a party employs fewer than 100 persons or had turnover under $10,000,000 in its last income year (section 23(4)). A contract alleged to be standard form is presumed to be one unless another party proves otherwise (section 27(1)). Bargaining power and any effective opportunity to negotiate are among the factors (section 27(2)).
A term is unfair if it would cause a significant imbalance, is not reasonably necessary to protect the legitimate interests of the party it advantages, and would cause detriment (section 24(1)). That party must prove it is reasonably necessary (section 24(4)). A term limiting one party’s vicarious liability for its agents may be unfair (section 25(i)), as may one limiting a right to sue (section 25(k)).
In ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224, the Court accepted, on agreed facts, that an unlimited indemnity, applying even where the loss was not the customer’s fault, caused a significant imbalance ([56](g)). In ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928, a supplier of office equipment, software and support services ([1]) conceded that terms in its small business templates were unfair, including a liability limitation term ([3]; declarations).
Since 9 November 2023, making such a contract containing an unfair term the person proposed, or applying or relying on an unfair term, has been a contravention, each term counting separately (section 23(2A) to (2C)). For a body corporate, the maximum penalty is the greater of $100,000,000 and three times the benefit or, if the benefit cannot be determined, 30% of adjusted turnover during the breach turnover period. For anyone else it is $2,500,000 (section 224(3) and (3A)).
Insurance sits behind all of this. Require cyber and professional indemnity cover suited to the data, see evidence of it, and check that the indemnity is a liability the policy will meet.
Do confidentiality clauses still matter?
Yes, and equity sits behind them. Equity protects information identified with specificity, with the necessary quality of confidence, received in circumstances importing an obligation of confidence, against actual or threatened misuse without consent (Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21 at [39]).
In that case, an exhaustive contractual definition of confidential information did not show an intention to exclude equitable obligations ([29]). The agreement preserved equitable rights, and the Full Court saw no reason why parties could not agree that a party alleging misuse may elect between contract damages and an account of profits ([37]).
For data, the definition should cover the customer’s data and anything derived from it, and limit its use to supplying the services. Both clauses should use the same definition. See the confidentiality agreements guide.
How similar matters tend to play out
Illustrations of how the law on this page combines on ordinary facts, not predictions. Outcome depends on the documents, the evidence and the regulator.
Lower range. A retailer’s mailing house, itself covered by the Privacy Act, emails the retailer’s customer list to the wrong client. The mailing house has the client delete it unread, and reports to the retailer that day under the notice clause. If that action, taken before any serious harm, means a reasonable person would conclude serious harm is not likely, it is not an eligible data breach of the mailing house or of the retailer (Privacy Act section 26WF(1)).
Middle range. An Adelaide subscription business’s offshore customer service provider is breached. Because APP 8.1 applied when the business disclosed the data, the notification rules apply as if the business held it (section 26WC(1)). Its 30 day assessment runs once it is aware of reasonable grounds to suspect a breach (section 26WH), and a 24 hour notice clause gets it the facts in time.
Upper range. A managed service provider hit by ransomware pays the demand without asking its customer, an Adelaide business with turnover of $40,000,000 last financial year. If the payment was made on the customer’s behalf, the customer must report within 72 hours of becoming aware of it (Cyber Security Act 2024 section 27(1)). The provider’s cap of three months’ fees, read by its natural and ordinary meaning (Darlington at [16]), then decides how much of the customer’s cost it recovers.
How we act on data security clauses
Our data security clause lawyers act for customers and suppliers. For customers, the aim is a clause that works on the day of an incident; for suppliers, obligations they can meet and insure.
| Stage | What happens | What we do |
|---|---|---|
| Mapping | The data, supplier, subcontractors and locations are identified. | Map what personal information goes where, and which laws apply. |
| Drafting | The security schedule or data processing terms are prepared or received. | Draft or review obligations, notice periods, audit rights and data return. |
| Negotiation | The parties settle the allocation of risk. | Negotiate caps, indemnities and insurance, and test terms against the unfair terms rules. |
| Incident | The supplier reports an incident. | Advise on assessment, notification, ransomware reporting and the contract. |
| Exit | The contract ends or the supplier changes. | Manage the return, destruction and transition of the data. |
We cannot promise an outcome, and no lawyer can. We can make sure the clause is drafted for the day it is needed.
Every hour matters. Book a same-day free 30-minute consultation, or call (08) 7094 2021 now.
Data security clause case law
None of the decisions below concerned a data security clause; each bears on a point that arises in one.
| Case | Court | Principle | Pinpoint |
|---|---|---|---|
| Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224 | Federal Court | Reasonable steps under APP 11; reliance on providers and their assessments | [6], [50], [52], [77], [78] |
| ASIC v RI Advice Group Pty Ltd [2022] FCA 496 | Federal Court | Licensee's cyber controls judged with technical expertise | [46], [47], [55], [58] |
| Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21 | Full Federal Court | Exhaustive contractual definition did not exclude equitable confidence | [29], [37], [39] |
| Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 | High Court | Construing limitation clauses | [16], [19] |
| ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224 | Federal Court | Unlimited indemnity accepted as causing a significant imbalance | [56], [57] |
| ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928 | Federal Court | Liability limitation term declared unfair | [1], [3]; declarations |
Case notes
Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224
The first civil penalty proceeding the Commissioner brought under the Privacy Act ([6]). Halley J said the APP 11.1 standard is objective ([50]). The declarations, made with the company’s consent, rest on matters including overreliance on third party providers ([52](g)). The judgment records that sole reliance on an assessment it knew was limited was unreasonable ([77] to [78]). The Court approved agreed penalties of $5,800,000 (orders).
ASIC v RI Advice Group Pty Ltd [2022] FCA 496
The Federal Court declared, on agreed facts, that a financial services licensee contravened the Corporations Act by failing to have cybersecurity documentation and controls adequate to manage risk. Rofe J said adequacy is assessed with technical expertise ([46] to [47]), is for the Court, likely informed by expert evidence ([55]), and that cyber risk cannot be reduced to zero ([58]).
Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21
An exhaustive contractual definition of confidential information did not show an intention to exclude equitable obligations ([29]). Parties may agree to an election between contract damages and an account of profits ([37]). The Full Court stated the four elements of breach of confidence ([39]).
Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82
An appeal from South Australia. Limitation clauses are construed by their natural and ordinary meaning in light of the whole contract, and where appropriate against the party relying on them in case of ambiguity ([16]). A $100 limit applied to each unauthorised contract ([19]).
ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224
On agreed facts, Moshinsky J declared eight small business standard form terms unfair and void. An unlimited indemnity, applying even where the loss was not the customer’s fault, was accepted as causing a significant imbalance ([56](g)). The supplier bore the onus of showing the terms were reasonably necessary to protect its legitimate interests ([57]).
ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928
A supplier of office equipment, software and support services ([1]) conceded that terms in its small business templates were unfair ([3]). Stewart J declared them void, including liability limitation and unilateral variation terms (declarations).
Frequently asked questions
What is a data security clause?
A contract term setting a supplier’s security obligations for the customer’s data, and what happens when they fail. It supports the customer’s own duty to take reasonable steps to protect personal information (APP 11.1).
Is a business responsible for its supplier's data breach?
It can be. The same breach can be an eligible data breach of both, and the duties fall away for one only if the other complies (Privacy Act sections 26WJ and 26WM). Overreliance on third party providers was among the matters listed in Clinical Labs ([52](g)).
How quickly must a supplier report a breach to its customer?
As fast as the contract says, so the contract should say. The customer must take all reasonable steps to complete its own assessment within 30 days of becoming aware of reasonable grounds to suspect a breach (section 26WH).
What if a supplier stores data overseas?
Unless an APP 8.2 exception applies, the business must first take reasonable steps so the recipient does not breach the APPs (APP 8.1). Where APP 8.1 applied, a breach by the recipient can be treated as the business’s own (section 16C), and the notification rules apply as if the business held the data (section 26WC(1)).
Must a ransomware payment by a supplier be reported?
Yes, if it was made on the customer’s behalf and the customer is a reporting business entity: the customer must report it within 72 hours of becoming aware of it (Cyber Security Act 2024 sections 26 and 27). That includes a business carrying on business in Australia with turnover over $3,000,000 in the previous financial year, other than a Commonwealth or State body or a critical infrastructure responsible entity; a critical infrastructure responsible entity is covered only where Part 2B applies to its asset (section 26(2); Rules section 6(1)). The clause should bar such payments without the customer’s written agreement.
What should happen to data at the end of the contract?
Return, then destruction. An APP entity must take reasonable steps to destroy or de-identify personal information it no longer needs (APP 11.2).
Can a supplier cap its liability for a data breach?
Yes, but the cap is read by its natural and ordinary meaning (Darlington at [16]), and an unfair term in a standard form small business contract is void (ACL section 23(1)).
What is a data processing agreement?
A contract or schedule setting how a supplier may handle personal information for its customer: purposes, security, subcontractors, location, breach notice and return.
Do critical infrastructure customers need extra terms?
Often. A responsible entity that becomes aware that another entity provides it, on a commercial basis, with a data storage or processing service relating to business critical data must take reasonable steps to inform that entity as soon as practicable (SOCI Act section 12F(3)). Where Part 2B applies, its incident reporting windows are 12 and 72 hours (sections 30BC and 30BD).
Do I need a data security clause lawyer?
If a supplier will hold personal information for the business, yes. A data security clause lawyer can align the clause with the Privacy Act and the business’s incident plan before signing. A free 30-minute consultation will tell you where you stand.
Related cybersecurity guides
Related guides
- Cybersecurity lawyers Adelaide
- Cyber incident response
- Penetration testing agreements
- Data protection and privacy
- IT outsourcing, cloud and hosting
- Cloud and utility computing agreements
- Web hosting and data centre agreements
- IT offshoring agreements
- IT services and support agreements
- Software and SaaS agreements
- Confidentiality agreements
- Agency and PR agreements