Penetration Testing Agreement Lawyers Adelaide: Authorisation, Scope, Rules of Engagement and Liability
Penetration testing agreements in South Australia
A penetration test is an attack a business pays for, and in practice, written authorisation from a person entitled to give it is what makes the tester’s access authorised. Talon Legal drafts and reviews penetration testing agreements, authorisation letters and rules of engagement for Adelaide businesses commissioning tests, and for the testing firms and red teams that run them. Book a same-day free 30-minute consultation or call (08) 7094 2021.
Penetration testing agreement key facts
| Issue | Position in South Australia |
|---|---|
| When access is unauthorised | When the person causing it is not entitled to cause it (Criminal Code section 476.2(1)). In practice, written authorisation from a person entitled to give it is what makes the tester entitled. |
| Commonwealth offences | Up to 10 years imprisonment for unauthorised modification of data, reckless as to impairing data (section 477.2); 2 years for unauthorised access to restricted data (section 478.1). |
| South Australian offence | Operating a restricted-access computer system without proper authorisation: $2,500, or $2,500 or 6 months imprisonment if done for a benefit or to cause a detriment (Summary Offences Act 1953 (SA) section 44). |
| Personal information | Reasonable steps to protect it, including technical and organisational measures (APP 11.1 and 11.3). |
| Tester's copy lost | On reasonable grounds to suspect an eligible data breach, an assessment is required, with all reasonable steps taken to finish within 30 days (Privacy Act section 26WH). |
| Unfair terms | Void in a standard form small business contract (ACL section 23(1)). Making such a contract containing an unfair term the person proposed, or applying or relying on an unfair term, is a contravention (section 23(2A) and (2C)). |
| Report privilege | A third-party report's purpose is usually judged when it is commissioned (Singtel Optus v Robertson at [88]). |
| First step | Same-day free 30-minute consultation. Call (08) 7094 2021. |
Need a penetration testing agreement lawyer in Adelaide?
Our penetration testing agreement lawyers in Adelaide act for businesses commissioning penetration tests and red team exercises, and for the testing firms that run them. The computer offences in Part 10.7 of the Criminal Code, in the Schedule to the Criminal Code Act 1995 (Cth), and in the Summary Offences Act 1953 (SA) turn on authorisation. The Privacy Act 1988 (Cth) governs personal information the tester sees, and the Australian Consumer Law (ACL) in the Competition and Consumer Act 2010 (Cth) limits unfair terms. This page states the law current to 7 November 2026.
This guide is part of our cybersecurity practice. Related guides cover cyber incident response, data security clauses and IT services and support agreements.
Free Consultation. Send us the scope and draft authorisation before testing starts. Book a same-day free 30-minute consultation or call (08) 7094 2021.
On this page
- Why does a penetration test need written authorisation?
- Which computer offences matter to testers?
- Who can authorise a penetration test?
- What should the scope and rules of engagement cover?
- What about personal information the tester sees?
- Who owns the findings, and how are they kept confidential?
- Can the agreement limit the tester's liability?
- Is a penetration test report privileged?
- What do regulated businesses need to show?
- How should vulnerability disclosure and bug bounties work?
- How similar matters tend to play out
- How we act on penetration testing agreements
- Case law
- Frequently asked questions
Why does a penetration test need written authorisation?
Because the Commonwealth computer offences turn on it. Under the Criminal Code, access to data held in a computer is unauthorised if the person causing it is not entitled to cause it (section 476.2(1)). The same applies to modifying data, impairing electronic communication to or from a computer, and impairing data on a disk, credit card or other storage device.
Access includes displaying data and copying or moving it. Modification means altering or removing data, or adding to it (section 476.1(1)).
Access is not unauthorised merely because the person has an ulterior purpose (section 476.2(2)). The question is entitlement. A person causes access, modification or impairment if their conduct substantially contributes to it (section 476.2(3)). Scanning tools run because someone started them, so the authorisation should cover what the tools do as well as the testers.
The practical effect is this. Written authorisation from a person entitled to give it is what makes the tester entitled. Testing outside the authorised scope, or testing systems the client does not own or control, risks unauthorised access. A penetration testing agreement is built around that authorisation: who gives it and what it covers.
Which computer offences matter to testers?
Part 10.7 sets out these offences. For each of sections 477.1 to 478.2, the person must know the access, modification or impairment is unauthorised.
| Offence | Section | Maximum penalty |
|---|---|---|
| Unauthorised access, modification or impairment to commit or facilitate a serious offence | 477.1 | The penalty for the serious offence |
| Unauthorised modification of data, reckless as to impairing access to data, or its reliability, security or operation | 477.2 | 10 years imprisonment |
| Unauthorised impairment of electronic communication | 477.3 | 10 years imprisonment |
| Unauthorised access to, or modification of, restricted data | 478.1 | 2 years imprisonment |
| Unauthorised impairment of data on a disk, credit card or other storage device | 478.2 | 2 years imprisonment |
| Possessing or controlling data, intending it to be used to commit or facilitate a Division 477 offence | 478.3 | 3 years imprisonment |
| Producing, supplying or obtaining data with that intent | 478.4 | 3 years imprisonment |
A serious offence is one punishable by life imprisonment or by 5 years or more (section 477.1(9)). Restricted data is data held in a computer to which access is restricted by an access control system associated with a function of the computer (section 478.1(3)).
Part 10.7 does not exclude or limit State law (section 476.4(1)). Under section 44 of the Summary Offences Act 1953 (SA), operating a restricted-access computer system “without proper authorisation” is an offence. The maximum is $2,500, or $2,500 or 6 months imprisonment if the person intended to obtain a benefit or cause a detriment (section 44(2)). A system is restricted-access if a particular code of electronic impulses is needed to access information stored in it or operate it, and the person entitled to control its use has withheld the code from others or restricted it to authorised people (section 44(3)).
Section 44A covers causing an unauthorised impairment of data held in a credit card, computer disk or other electronic storage device, knowing it is unauthorised and intending or reckless as to harm or inconvenience (maximum 2 years imprisonment). An impairment is unauthorised unless made by the owner of the data or with the owner’s authorisation or licence, express or implied (section 44A(2)).
Who can authorise a penetration test?
For systems the client owns and runs, someone with authority to approve the test for the business. The authorisation letter should name the business, the testing firm, the testers, the systems and the dates. Check the signatory’s authority: the IT manager who arranged the test may not have it.
Systems hosted or run by others need more. Cloud platforms, managed service providers, website hosts and data centres run infrastructure the client uses but does not control. Get the provider’s written permission before testing anything it hosts or runs, or its written confirmation that its terms allow the planned test.
Staff devices need a separate decision. Staff-owned phones and computers are safer left out of scope, or included only with the staff member’s written consent. The same goes for personal email and social media accounts in a social engineering test.
A customer that wants to test a supplier’s systems needs the supplier’s written permission, best given in advance by an audit and testing clause in the supply contract (see data security clauses). Wherever the client does not own or control a system, the agreement should record each permission, with its scope and date.
What should the scope and rules of engagement cover?
Everything the testers may do, and what they may not, usually in a schedule signed before testing starts. It should cover:
- targets in and out of scope: systems, applications, domains, network ranges and sites;
- whether testers start with public information only, or are given accounts and system details;
- dates, times and blackout periods, with a client contact on call;
- excluded techniques, such as denial of service testing, destructive testing, or taking more records than needed to show a finding;
- social engineering: whether phishing, phone calls or impersonation are allowed, and who may be targeted;
- physical testing: which sites and when, and who can confirm the engagement at any hour; and
- stopping: who can halt the test, how fast critical findings are reported, and what happens if testers find a real intruder.
A real intruder turns a test into an incident, and the client’s legal clock may start (see cyber incident response). Scope changes need written approval from the same authority. A tester who agrees on a phone call to check one more server is outside the paperwork. The agreement should also say who bears the risk of disruption from careful in-scope testing, and from testing outside scope.
What about personal information the tester sees?
Testers often see customer records and emails. For a business covered by the Privacy Act, three rules apply to personal information.
An APP entity must take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure (APP 11.1), including technical and organisational measures (APP 11.3). The agreement should limit what testers copy, require encrypted storage of evidence, and require deletion at the end.
Personal information collected for a primary purpose must not be used or disclosed for a secondary purpose without consent, unless an exception applies (APP 6.1), such as a related purpose the individual would reasonably expect (directly related, for sensitive information) (APP 6.2(a)). The simplest course is to keep personal information out of the test where possible.
If the tester’s copy is lost or stolen, the client may need to assess whether there has been an eligible data breach (section 26WE), taking all reasonable steps to finish within 30 days (section 26WH). The agreement should require the testing firm to report any loss at once and help with the assessment. The cyber incident response guide covers the steps that follow.
Who owns the findings, and how are they kept confidential?
The agreement should say. An assignment of copyright has no effect unless it is in writing signed by or on behalf of the assignor (Copyright Act 1968 (Cth) section 196(3)), so a client that wants to own the report needs one. Otherwise it needs a licence wide enough to share the report with its board, auditors, insurers and regulators.
A test report is a map of the client’s weaknesses. Equity protects information identified with specificity, with the necessary quality of confidence, received in circumstances importing an obligation of confidence, against actual or threatened misuse without consent (Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21 at [39]). An exhaustive contractual definition of confidential information did not show an intention to exclude those obligations ([29]), and the Full Court saw no reason why parties could not agree that a party alleging misuse may elect between contract damages and an account of profits ([37]).
The clause should cover the report, working papers, credentials and anything the testers saw, limit who sees the findings, bar their use in marketing without consent, and require return or destruction at the end. See the confidentiality agreements guide.
Can a penetration testing agreement limit the tester’s liability?
Yes, within limits. A limitation clause is construed by its natural and ordinary meaning, read in the light of the whole contract and its nature and object, and against the party relying on it where appropriate in case of ambiguity (Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 at [16]). In that appeal from South Australia, the claim arose in connection with the broker and client relationship even though the transactions were unauthorised ([18]), and the clause limited the broker’s liability to $100 for each unauthorised contract ([19]). A tester’s cap may likewise reach out-of-scope testing if its words are wide enough, so the agreement should say whether it does.
An unfair term in a standard form small business contract is void (ACL section 23(1)). A contract is a small business contract if a party employs fewer than 100 persons or had turnover under $10,000,000 in its last income year (section 23(4)). A contract alleged to be standard form is presumed to be one (section 27(1)). A term is unfair if it would cause a significant imbalance, is not reasonably necessary to protect the legitimate interests of the party it advantages, and would cause detriment if relied on (section 24(1)). That party must prove the term is reasonably necessary (section 24(4)). A term limiting a party’s right to sue may be unfair (section 25(k)). The regime can protect a small testing firm on a client’s terms, as well as a small client.
In ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224, the Court accepted, on agreed facts, that an unlimited indemnity applying even where the loss was not the customer’s fault caused a significant imbalance ([56](g)). In ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928, the supplier conceded that terms in its small business templates were unfair, including a liability limitation term ([3]; declarations).
Since 9 November 2023, making such a contract containing an unfair term the person proposed, or applying or relying on an unfair term, has been a contravention (section 23(2A) and (2C)). For a body corporate, the maximum penalty is the greater of $100,000,000 and three times the benefit or, if the benefit cannot be determined, 30% of adjusted turnover during the breach turnover period. For anyone else it is $2,500,000 (section 224(3) and (3A)).
Indemnities can run both ways: the client covering third-party claims from authorised testing, the testing firm covering out-of-scope or careless testing and mishandled data.
Is a penetration test report privileged?
On the reasoning in the Optus case, only if a legal purpose was dominant, and that has to be proved. No case on this page concerned a penetration test report; the closest guidance is Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58, about a forensic report.
Optus commissioned the report after its September 2022 cyber attack, facing prospective class actions and regulatory investigations ([2]). The primary judge found it had several purposes and had not shown the legal purpose was dominant ([3]). The Full Court refused Optus leave to appeal. It considered the primary judge correct: the evidence did not establish that the report was procured for the dominant purpose of obtaining legal advice or for use in litigation or regulatory proceedings ([83]). For a report commissioned from a third party, purpose will usually be assessed at the time of commissioning, though later events can be relevant ([88]). The General Counsel’s own legal purpose did not establish Optus’s dominant purpose where Optus in fact had several purposes ([93]), and the report was commissioned before the law firm’s formal engagement letter ([94]).
A test commissioned to find and fix weaknesses has an operational purpose. Where a test is for legal advice, decide and document that purpose when it is commissioned, have the lawyers engage the testing firm, and sign the engagement letter before work starts.
What do regulated businesses need to show?
For a financial services licensee, the declarations in RI Advice are the main guide. In ASIC v RI Advice Group Pty Ltd [2022] FCA 496, the Federal Court declared, on agreed facts, that RI Advice, a financial services licensee, contravened the Corporations Act between 15 May 2018 and 5 August 2021 by failing to have documentation and controls for cybersecurity and cyber resilience adequate to manage risk across its authorised representative network. It was ordered to engage a cybersecurity expert to identify further measures, report to ASIC and implement them, and to pay $750,000 towards ASIC’s costs. The orders include no pecuniary penalty.
Rofe J said cyber risk management is highly technical, so adequacy is assessed with the technical expertise of a relevantly skilled person, not by reference to public expectation ([46] to [47]). It is in the end a question for the Court, likely informed by expert evidence ([55]). Cyber risk cannot be reduced to zero, but it can be materially reduced to an acceptable level through adequate documentation and controls ([58]).
The declarations concerned a financial services licensee only. For a licensee, independent testing and a record of the fixes may form part of that documentation.
How should vulnerability disclosure and bug bounties work?
Through a written policy setting the rules for outside testers and the way they report. A vulnerability disclosure policy gives researchers a way to report; a bug bounty adds rewards. Either should state the systems in scope, testing that is not allowed (such as disrupting services or taking more data than needed), response times, confidentiality until a fix is ready, and any reward.
A policy speaks only for the business that publishes it, so systems its suppliers run should be out of scope unless they agree. A researcher’s report may be the first sign of an incident: if personal information may have been exposed, the 30 day assessment may have started (Privacy Act section 26WH).
How similar matters tend to play out
Illustrations of how the law on this page combines on ordinary facts, not predictions. Outcome depends on the documents, the evidence and the court.
Lower range. An Adelaide property manager with 30 staff signs a testing firm’s standard terms, which make it indemnify the firm for all loss “however caused”. The contract is a small business contract (ACL section 23(4)) and is presumed to be standard form (section 27(1)). An indemnity of that breadth was accepted as causing a significant imbalance in JJ Richards ([56](g)). The parties confine it to third-party claims from authorised testing.
Middle range. A consultant copies customer records to prove access, then loses the laptop holding them. If the client becomes aware of reasonable grounds to suspect an eligible data breach, it must carry out a reasonable and expeditious assessment, taking all reasonable steps to finish within 30 days (Privacy Act section 26WH). The laptop was encrypted, so the assessment turns partly on whether people intending harm could obtain the means to get around the encryption (section 26WG(h)).
Upper range. A testing firm misreads the scope and tests a network range belonging to the client’s hosting provider, slowing services for other customers. The client’s authorisation did not cover the provider’s systems, so the testing risks unauthorised access (Criminal Code section 476.2(1)). Whether the firm’s cap covers the client’s loss depends on its words, read in the light of the whole contract (Darlington at [16]), and on whether it is fair in a standard form small business contract (ACL section 24(1)).
How we act on penetration testing agreements
Our penetration testing agreement lawyers act for businesses commissioning tests and for testing firms, mostly before testing starts.
| Stage | What happens | What we do |
|---|---|---|
| Planning | The systems, sites and people to be tested are listed. | Map who controls each system and whose permission is needed. |
| Authorisation | The client approves the test in writing. | Draft the authorisation letter and check the signatory's authority. |
| Contract | The agreement, scope and rules of engagement are settled. | Draft or review the scope, data handling, confidentiality, liability and insurance terms. |
| Testing | Testing finds a real intruder or goes wrong. | Advise on stopping, incident steps and notification. |
| Report | The report is delivered and the findings are fixed. | Advise on ownership, sharing and any claim to privilege. |
We cannot promise an outcome, and no lawyer can. We can make sure the authorisation and the contract match what the testers will actually do.
Every hour matters. Book a same-day free 30-minute consultation, or call (08) 7094 2021 now.
Penetration testing case law
None of the decisions below concerned a penetration testing agreement; each bears on a point that arises in one.
| Case | Court | Principle | Pinpoint |
|---|---|---|---|
| Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58 | Full Federal Court | Purpose of a third-party report usually judged when commissioned | [83], [88], [93], [94] |
| Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21 | Full Federal Court | Exhaustive contractual definition did not exclude equitable confidence | [29], [37], [39] |
| Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 | High Court | Construing limitation clauses | [16], [18], [19] |
| ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224 | Federal Court | Unlimited indemnity accepted as causing a significant imbalance | [56], [57] |
| ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928 | Federal Court | Liability limitation term declared unfair | [1], [3]; declarations |
| ASIC v RI Advice Group Pty Ltd [2022] FCA 496 | Federal Court | Licensee's cyber controls judged with technical expertise | [46], [47], [55], [58] |
Case notes
Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58
The Full Court refused Optus leave to appeal from the rejection of its privilege claim over a forensic report, considering the primary judge correct that the evidence did not establish a dominant legal purpose ([83]). Purpose is usually assessed when a third-party report is commissioned ([88]).
Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21
An exhaustive contractual definition of confidential information did not show an intention to exclude equitable obligations ([29]). Parties may agree to an election between contract damages and an account of profits ([37]). The Full Court stated the four elements of breach of confidence ([39]).
Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82
An appeal from South Australia. Limitation clauses are construed by their natural and ordinary meaning in light of the whole contract, and where appropriate against the party relying on them in case of ambiguity ([16]). A $100 limit applied to each unauthorised contract ([19]).
ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224
On agreed facts, Moshinsky J declared eight small business standard form terms unfair and void. An unlimited indemnity, applying even where the loss was not the customer’s fault, was accepted as causing a significant imbalance ([56](g)). The supplier bore the onus of showing the terms were reasonably necessary to protect its legitimate interests ([57]).
ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928
A supplier of office equipment, software and support services ([1]) conceded that terms in its small business templates were unfair ([3]). Stewart J declared them void, including liability limitation and unilateral variation terms (declarations).
ASIC v RI Advice Group Pty Ltd [2022] FCA 496
The Federal Court declared, on agreed facts, that a financial services licensee contravened the Corporations Act by failing to have cybersecurity documentation and controls adequate to manage risk. Rofe J said adequacy is assessed with technical expertise ([46] to [47]) and is for the Court, likely informed by expert evidence ([55]), and that cyber risk cannot be reduced to zero ([58]).
Frequently asked questions
Does a penetration tester need written permission?
In practice, yes. Access is unauthorised if the person causing it is not entitled to cause it (Criminal Code section 476.2(1)), and written authorisation from a person entitled to give it is what makes the tester entitled.
Is ethical hacking an offence in Australia?
Good intentions are not the test. Access is unauthorised if the person causing it is not entitled to cause it (Criminal Code section 476.2(1)), and an ulterior purpose does not by itself make it unauthorised (section 476.2(2)). Testing without authorisation, or outside it, risks unauthorised access.
What is a penetration testing authorisation letter?
A signed approval from someone with authority for the business that owns or controls the systems, naming the testing firm, testers, systems and dates. For hosted systems, get the provider’s written permission too.
What are rules of engagement in a pen test contract?
The agreed limits of the test: targets, dates and times, excluded techniques, social engineering and physical testing rules, contacts, and when testing stops. Testing outside them risks unauthorised access.
Can a penetration tester see customers' personal information?
Often, so the agreement should limit what testers may copy and keep. An APP entity must take reasonable steps to protect personal information it holds (APP 11.1), and a lost copy may need a 30 day breach assessment (Privacy Act section 26WH).
Can a testing firm cap its liability?
Yes, but a cap is read by its natural and ordinary meaning in the light of the whole contract (Darlington at [16]), and it may be unfair in a standard form small business contract (ACL sections 23(1) and 24(1)).
Is a penetration test report privileged?
On the Optus reasoning, only if a legal purpose was dominant, which has to be proved. The Full Court refused Optus leave to appeal from a ruling that its forensic report on a cyber attack was not shown to have a dominant legal purpose (Singtel Optus v Robertson at [83]).
Who owns the penetration test report?
It depends on the agreement. A client that wants to own it needs a written assignment signed by or on behalf of the copyright owner (Copyright Act section 196(3)).
How is a red team agreement different?
A red team exercise is usually wider, adding social engineering and sometimes physical entry. It needs the same authorisation, with extra rules for staff, sites and stopping.
Do I need a penetration testing agreement lawyer?
Before the first test, yes. A penetration testing agreement lawyer can match the authorisation and risk terms to what the testers will actually do. A free 30-minute consultation will tell you where you stand.