Privacy and Data Breach Lawyers Adelaide: Privacy Act Compliance and Breach Response
Privacy and data breaches in South Australia
A data breach starts a 30 day clock, and the first civil penalty case under the Privacy Act ended with penalties of $5.8 million. Talon Legal advises Adelaide businesses on Privacy Act compliance before an incident and on assessment, notification and regulator contact after one. Book a same-day free 30-minute consultation or call (08) 7094 2021.
Privacy and data breach key facts
| Issue | Position in South Australia |
|---|---|
| Who the Privacy Act covers | Businesses with annual turnover over $3,000,000, and smaller businesses that provide a health service and hold health information, trade in personal information, are Commonwealth contracted service providers or are credit reporting bodies (Privacy Act 1988 (Cth) section 6D). |
| Security obligation | Take such steps as are reasonable in the circumstances to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure (APP 11.1), including technical and organisational measures (APP 11.3). |
| Eligible data breach | Unauthorised access to or disclosure of information that a reasonable person would conclude would be likely to result in serious harm to any affected individual, or loss of information where that is likely (section 26WE). |
| Suspected breach | Carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days (section 26WH). |
| Confirmed breach | Give the Information Commissioner a statement as soon as practicable (section 26WK), then notify affected individuals as soon as practicable (section 26WL). |
| Maximum penalty, serious interference | Body corporate: the greatest of $50,000,000, three times the benefit, or 30% of adjusted turnover. Anyone else: $2,500,000 (section 13G). |
| Other civil penalties | 2,000 penalty units for an interference with privacy (section 13H). 200 penalty units, enforceable by infringement notice, for breaches such as having no APP privacy policy (section 13K). |
| First civil penalty case | $5,800,000 in penalties and $400,000 towards costs, with a separate contravention for each of more than 223,000 affected individuals (AIC v Australian Clinical Labs (No 2) [2025] FCA 1224, orders and [60]). |
| Ransomware payments | A business with turnover over $3,000,000 must report a ransomware payment within 72 hours (Cyber Security Act 2024 (Cth) section 27; Rules section 6). Maximum 60 penalty units. |
| Offshore disclosure | Reasonable steps so the overseas recipient does not breach the APPs (APP 8.1); the discloser can be liable for the recipient's acts (section 16C). |
| Automated decisions | From 10 December 2026, privacy policies must explain decisions made by computer programs that could significantly affect individuals (APP 1.7 and 1.8). |
| Serious invasions of privacy | Since 10 June 2025, individuals can sue for a serious invasion of privacy; damages for non-economic loss and exemplary damages are capped at the greater of $478,550 and the defamation cap (Schedule 2, clauses 7 and 11). |
| First step | Same-day free 30-minute consultation. Call (08) 7094 2021. |
Need a privacy lawyer in Adelaide?
Our privacy lawyers in Adelaide advise on the Privacy Act 1988 (Cth), the notifiable data breaches scheme in Part IIIC, the ransomware reporting rules in the Cyber Security Act 2024 (Cth), and the statutory action for serious invasions of privacy. The Act was substantially amended by the Privacy and Other Legislation Amendment Act 2024, with the last of those changes commencing on 10 December 2026. This page states the law current to 24 October 2026.
This guide is part of our information technology law practice. Related guides cover software licences and SaaS agreements, IT services and support agreements, software development agreements and technology IP and IT disputes.
If you collect customer details through a competition, or use customer photos and testimonials in marketing, see our guides to trade promotions and competitions and testimonial and image consents.
For the privacy side of apps, subscriptions, online courses and marketplaces, see our guides to app terms and conditions, subscription and membership terms, online course terms and disclaimers and online marketplace and platform terms.
For a data breach or ransomware attack, see our guide to cyber incident response. For security terms in supplier contracts, and for AI tools that use personal information, see our guides to data security clauses and AI and privacy.
Free Consultation. If you think there has been a breach, the 30 day assessment may already have started. Book a same-day free 30-minute consultation or call (08) 7094 2021.
On this page
- Does the Privacy Act apply to your business?
- What does APP 11 require?
- What happens after a data breach?
- What are the penalties?
- Do ransomware payments have to be reported?
- What about overseas providers and cloud hosting?
- What must a privacy policy say?
- Can individuals sue for a serious invasion of privacy?
- How similar matters tend to play out
- How we act on privacy and data breaches
- Case law
- Frequently asked questions
Does the Privacy Act apply to your business?
If its annual turnover is over $3,000,000, yes. A business with turnover of $3,000,000 or less is a small business (section 6D(1)). A small business operator is excluded from the definition of organisation (section 6C), which takes it outside the Act’s private sector obligations unless an exception applies.
The exceptions catch many small businesses (section 6D(4)). A business that provides a health service and holds health information, other than in an employee record, is covered. So is a business that discloses personal information about others for a benefit, service or advantage, or provides one to collect it. Commonwealth contracted service providers and credit reporting bodies are covered too, as is a business that has had a turnover over $3,000,000 in any financial year since it started.
A business that is outside the Act may still be bound by contract. Customers, government agencies and larger partners often require their suppliers to comply with the Australian Privacy Principles (APPs) as if they were covered.
What does APP 11 require?
An entity covered by the Act must take such steps as are reasonable in the circumstances to protect the personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure (APP 11.1). Those steps include technical and organisational measures (APP 11.3).
What is reasonable depends on the entity. In Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224, Halley J said the standard is objective and the circumstances should be given a broad construction. They could include the sensitivity of the information, the potential harm if it were accessed or disclosed, the size and sophistication of the entity, the cybersecurity environment and previous threats or attacks ([50]).
The company in that case had acquired another pathology business and its systems. The Court found it had not taken reasonable steps, having regard to the size of its business, the volume and sensitivity of the health information and the high cyber risk. The deficiencies in the acquired systems counted, as did its failure to identify them before the acquisition and its delay in identifying them afterwards. The last factor was its overreliance on third party service providers without adequate procedures of its own to detect and respond to cyber incidents ([52]). Each of those is a lesson for a business buying another, or outsourcing its IT.
What happens after a data breach?
The Act sets two triggers. The first is suspicion. If an entity is aware of reasonable grounds to suspect there may have been an eligible data breach, it must carry out a reasonable and expeditious assessment (section 26WH). The question is whether there are reasonable grounds to believe there has been one. The entity must take all reasonable steps to complete the assessment within 30 days after it became aware.
An eligible data breach is unauthorised access to or disclosure of personal information where a reasonable person would conclude it would be likely to result in serious harm to any of the individuals it relates to. It also covers loss of information in circumstances where unauthorised access or disclosure is likely to occur and would be likely to cause that harm (section 26WE(2)).
The second trigger is belief. Once there are reasonable grounds to believe there has been an eligible data breach, the entity must prepare a statement and give it to the Commissioner as soon as practicable (section 26WK). It must then notify each affected individual, or each individual at risk, where that is practicable. Otherwise it must publish the statement on its website and take reasonable steps to publicise it. That must be done as soon as practicable after the statement is prepared (section 26WL(2) and (3)).
One breach can belong to several entities, such as a provider and its customers. Where one of them complies with sections 26WK and 26WL, those sections do not apply to the others for that breach (section 26WM). The contract between them should say who will do it.
The Australian Clinical Labs case shows how each step is judged. The company relied on an external cyber provider’s assessment that had monitored only 3 of at least 127 affected computers, reviewed one firewall log and made only a limited investigation of whether the attackers remained connected ([77]). Because the company knew the assessment was limited, it was unreasonable to rely on it alone to conclude that no personal information had been taken ([78]). On notification, the company admitted it could have given the statement within two to three days of having reasonable grounds to believe there had been an eligible data breach on 16 June 2022 ([89]). It gave the statement on 10 July 2022, and that contravened section 26WK(2) ([90]).
What are the penalties?
The Act now has three tiers of civil penalty for interferences with privacy.
| Contravention | Section | Maximum penalty |
|---|---|---|
| Serious interference with the privacy of an individual | 13G | Body corporate: the greatest of $50,000,000, 3 times the benefit, or 30% of adjusted turnover during the breach turnover period. Anyone else: $2,500,000 |
| Interference with privacy, without the seriousness element | 13H | 2,000 penalty units |
| Breach of listed APPs, such as APP 1.3 (having an APP privacy policy) and APP 1.4 (its contents) | 13K | 200 penalty units, with infringement notices available |
These figures are current to 24 October 2026. In deciding whether an interference is serious, the court may consider the kind and sensitivity of the information, the consequences for individuals and the number affected (section 13G(1B)). It may also consider whether a child or a person with vulnerability was affected, whether the conduct was repeated or continuous, and any failure to implement practices, procedures and systems to comply.
The number of contraventions matters as much as the maximum. In the Australian Clinical Labs case, the parties agreed and the Court was satisfied that there was a separate contravention in respect of each of the more than 223,000 individuals whose information was held on the affected systems ([60]). The Court approved agreed penalties totalling $5,800,000: $4,200,000 for the failure to protect the information, $800,000 for the failure to assess, and $800,000 for the late notification, plus $400,000 towards the Commissioner’s costs (orders). The Court measured the assessment and notification contraventions against a maximum of $2.2 million each ([121]), well below the current maximum in section 13G.
Free Consultation. If the Commissioner has written to you, take advice before you respond. Book a same-day free 30-minute consultation or call (08) 7094 2021.
Do ransomware payments have to be reported?
Yes, for most businesses of any size. Part 3 of the Cyber Security Act 2024 applies where a cyber security incident has a direct or indirect impact on a reporting business entity and an extorting entity makes a demand (section 26(1)). It is triggered when the entity makes a ransomware payment, or knows one was made on its behalf.
A reporting business entity includes a business carrying on business in Australia with annual turnover for the previous financial year over the threshold (section 26(2)), which the Cyber Security (Ransomware Payment Reporting) Rules 2025 set at $3,000,000 (section 6). Commonwealth and State bodies are excluded, and responsible entities for critical infrastructure assets are covered separately.
The report must be given to the designated Commonwealth body within 72 hours of making the payment or becoming aware that it was made (section 27(1)). The maximum civil penalty for failing to do so is 60 penalty units. The reporting obligation applies from May 2025. Reporting a payment does not replace the Privacy Act assessment and notification steps, which run in parallel.
What about overseas providers and cloud hosting?
Before an entity discloses personal information to a person outside Australia, it must take such steps as are reasonable in the circumstances so that the overseas recipient does not breach the APPs, other than APP 1 (APP 8.1).
The consequence of getting it wrong is accountability for someone else’s conduct. Section 16C applies where APP 8.1 applied to the disclosure and the APPs do not apply to the overseas recipient. If the recipient then does something that would have breached the APPs, the act is taken to have been done by the disclosing entity, and to be its breach.
That makes the contract with an offshore provider a compliance document. It should bind the provider to handle the information consistently with the APPs, give the entity audit and incident information, and deal with return and deletion at the end. The IT services, SaaS, cloud services and IT offshoring guides cover those clauses.
What must a privacy policy say?
An entity must have a clearly expressed and up to date APP privacy policy about how it manages personal information (APP 1.3), with the contents APP 1.4 requires. Breaches of APP 1.3 and 1.4 are among those that attract a civil penalty of up to 200 penalty units and can be dealt with by infringement notice (section 13K).
From 10 December 2026, a privacy policy must also deal with automated decisions. The trigger is a decision made by a computer program, or a thing substantially and directly related to making it, that uses personal information and could reasonably be expected to significantly affect an individual’s rights or interests. Where an entity has arranged for that, the policy must contain the information specified in APP 1.7 and 1.8. APP 1.7 is added to the list of APPs that attract infringement notices. Businesses using automated credit, pricing, eligibility or fraud decisions should review their policies before that date.
The Commissioner must also develop a Children’s Online Privacy Code (section 26GC). Services likely to be used by children should watch for it.
Can individuals sue for a serious invasion of privacy?
Yes, since 10 June 2025. Schedule 2 of the Privacy Act creates a cause of action in tort (clause 7(1)). The defendant must have invaded the individual’s privacy by intruding upon their seclusion or misusing information relating to them. A person in the individual’s position must have had a reasonable expectation of privacy in all the circumstances. The invasion must have been intentional or reckless, and serious. And the public interest in privacy must outweigh any countervailing public interest.
The action does not need proof of damage (clause 7(2)). Damages can include damages for emotional distress (clause 11(3)) and, in exceptional circumstances, exemplary or punitive damages (clause 11(4)). Damages for non-economic loss and exemplary damages together cannot exceed the greater of $478,550 and the maximum for non-economic loss in defamation (clause 11(5)).
Time is short. Proceedings must be started within one year after the plaintiff became aware of the invasion, and in any event within three years after it occurred (clause 14). A plaintiff under 18 has longer, and the court can extend time.
The film releases and clearances and script options and adaptation rights guides cover consent and releases for film, documentary and true story productions.
How similar matters tend to play out
Three illustrations of how the law on this page combines on ordinary facts. They are not predictions. Outcome depends on the facts, the evidence and the regulator.
Lower range. An employee emails a spreadsheet of customer names and addresses to the wrong recipient, who confirms it was deleted unread. The business must assess whether a reasonable person would conclude serious harm is likely (section 26WE). Recorded promptly, with the recipient’s confirmation, that assessment may conclude the breach is not eligible, and no notification is needed.
Middle range. A clinic with turnover under $3,000,000 assumes the Privacy Act does not apply. Because it provides a health service and holds health information, it is not a small business operator (section 6D(4)(b)). When its booking system is compromised, it has 30 days to assess (section 26WH) and must notify if the breach is eligible.
Upper range. A company with turnover over $3,000,000 suffers ransomware on systems run by its managed service provider and pays the ransom. It must report the payment within 72 hours (Cyber Security Act section 27), assess within 30 days, and notify the Commissioner and individuals as soon as practicable. Relying solely on the provider’s limited forensic report would repeat the error in the Australian Clinical Labs case ([77] to [78]).
How we act on privacy and data breaches
Before an incident, we review the business’s coverage, privacy policy, contracts with providers and breach response plan. After one, we work to the statutory timetable: the 30 day assessment, the statement to the Commissioner and the notification to individuals, with the ransomware report where it applies.
| Stage | What happens | What we do |
|---|---|---|
| Readiness | The business prepares for an incident it hopes will not happen. | Confirm coverage under section 6D, review the privacy policy, provider contracts and breach response plan. |
| Suspicion | An incident is detected. | Start and document the reasonable and expeditious assessment under section 26WH, and test the forensic evidence. |
| Ransomware | A ransom is demanded or paid. | Advise on the 72 hour report under section 27 of the Cyber Security Act. |
| Notification | There are reasonable grounds to believe there was an eligible data breach. | Prepare the statement to the Commissioner and the notifications to individuals under sections 26WK and 26WL. |
| Regulator and claims | The Commissioner investigates, or individuals claim. | Respond to the Commissioner, and advise on penalties, enforceable undertakings and claims under Schedule 2. |
We cannot promise an outcome, and no lawyer can. We can make sure each statutory step is taken on time and on evidence that will stand up.
Every hour matters. Book a same-day free 30-minute consultation, or call (08) 7094 2021 now.
Privacy Act case law
The Australian Clinical Labs decision was the first civil penalty proceeding brought by the Commissioner in the history of the Act ([6]). The notes below take each of its findings in turn.
| Case | Court | Principle | Pinpoint |
|---|---|---|---|
| Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224 | Federal Court | APP 11 reasonable steps; the 30 day assessment; notification as soon as practicable; penalties | [6], [7], [50], [52], [60], [77], [78], [89], [90] |
Case notes
Australian Clinical Labs: reasonable steps under APP 11
Halley J said APP 11.1(b) applies an objective standard ([50]). The circumstances are given a broad construction, including the sensitivity of the information, potential harm, the entity’s size and sophistication and the cyber environment. The company had not taken reasonable steps, given deficiencies in systems it acquired, its failure to identify them before and after the acquisition, and its overreliance on third party providers ([52]).
Australian Clinical Labs: the 30 day assessment
Section 26WH requires a reasonable and expeditious assessment and all reasonable steps to complete it within 30 days ([71]). The company relied on an external provider’s assessment that monitored 3 of at least 127 affected computers and one firewall log ([77]). Knowing the assessment was limited, it was unreasonable to rely on it alone ([78]).
Australian Clinical Labs: notification as soon as practicable
The company had reasonable grounds to believe there was an eligible data breach by 16 June 2022 ([86]). It admitted it could have given the statement within two to three days ([89]), but did not do so until 10 July 2022, contravening section 26WK(2) ([90]).
Australian Clinical Labs: penalties
The parties agreed, and the Court was satisfied, that there was a separate contravention for each of more than 223,000 affected individuals ([60]). The Court found the agreed penalty of $5,800,000 within the permissible range for specific and general deterrence, given the serious nature of the contraventions ([7]), and ordered $400,000 towards the Commissioner’s costs (orders).
Frequently asked questions
Does the Privacy Act apply to small businesses?
Not generally, if turnover is $3,000,000 or less. But a small business is covered if it provides a health service and holds health information, trades in personal information, is a Commonwealth contracted service provider or is a credit reporting body (section 6D(4)).
What is an eligible data breach?
Unauthorised access to or disclosure of personal information that a reasonable person would conclude would be likely to result in serious harm to any affected individual, or loss of information where that access or disclosure is likely (section 26WE).
How long does a business have to assess a suspected breach?
The assessment must be reasonable and expeditious, and the business must take all reasonable steps to complete it within 30 days after becoming aware of the grounds for suspicion (section 26WH).
When must the Commissioner be notified?
As soon as practicable after the business has reasonable grounds to believe there has been an eligible data breach (section 26WK). In the Australian Clinical Labs case, notifying about three weeks after it was practicable was a contravention ([89] to [90]).
Do affected individuals have to be told?
Yes, for an eligible data breach. The business must notify each affected individual, or each individual at risk, where practicable, and otherwise publish and publicise the statement, as soon as practicable after preparing it (section 26WL).
Can a business rely on its IT provider's assessment of a breach?
Not blindly. In the Australian Clinical Labs case, relying solely on a provider’s assessment the company knew was limited was unreasonable ([77] to [78]).
What are the maximum penalties under the Privacy Act?
For a serious interference with privacy by a body corporate, the greatest of $50,000,000, three times the benefit, or 30% of adjusted turnover (section 13G). Lower tiers apply under sections 13H and 13K.
Does paying a ransom have to be reported?
Yes, by a business with annual turnover over $3,000,000 for the previous financial year. The report must be made within 72 hours of the payment or of becoming aware of it (Cyber Security Act 2024 section 27 and Rules section 6).
Is a business liable for an overseas provider's privacy breach?
It can be. Where APP 8.1 applied to the disclosure and the APPs do not apply to the overseas recipient, a breach by the recipient is treated as a breach by the disclosing business (section 16C).
What changes for privacy policies in December 2026?
From 10 December 2026, a privacy policy must explain automated decisions that use personal information and could reasonably be expected to significantly affect individuals (APP 1.7 and 1.8).
Can someone sue a business for invading their privacy?
Yes, since 10 June 2025, for a serious invasion of privacy that was intentional or reckless, by intrusion upon seclusion or misuse of information (Schedule 2 clause 7). Proceedings must generally be started within one year of becoming aware and three years of the invasion (clause 14).
Do I need a privacy lawyer after a data breach?
Usually, yes. A privacy lawyer can run the 30 day assessment on evidence that will stand up, prepare the notifications and deal with the Commissioner. A free 30-minute consultation will tell you where you stand.
Related privacy and technology guides
Related guides
- Information technology lawyers Adelaide
- IT services and support agreements
- Software licences and SaaS agreements
- Software development agreements
- Technology IP and IT disputes
- Cybersecurity
- Artificial intelligence
- Online business and e-commerce lawyers Adelaide
- Website terms of use
- Online sales terms and consumer law
- Commercial and business law