Australian Businesses Navigate Growing Cyber Reporting Requirements
Australian cyber reporting requirements are placing greater pressure on businesses to prepare for regulatory obligations following a cyber incident. Organisations must understand when to report breaches, which authorities to notify, and what financial penalties may apply.
Global professional services firm Aon plc (NYSE: AON) has highlighted these challenges in its latest regional research. Its report, The Changing Cyber Risk Landscape in APAC, examines how cyber regulations are changing across Asia Pacific.
According to Aon, regulators across the region are strengthening breach notification rules, increasing penalties, and expanding enforcement activity. These developments create additional responsibilities for organisations responding to cyber incidents.
Australian Cyber Reporting Requirements and Financial Penalties
Australia has one of the region’s more established cyber regulatory frameworks. Businesses already face mandatory breach notification requirements, while regulators have become increasingly active in enforcement.
Under Australian privacy legislation, serious interference with privacy can attract substantial financial penalties. The maximum penalty is the greater of AU$50 million, three times the benefit obtained from the breach, or 30% of adjusted turnover.[1]
These penalties highlight why businesses must consider regulatory exposure alongside the technical and operational impact of a cyber incident. Restoring affected systems does not necessarily resolve an organisation’s legal or financial obligations.
“Cyber incidents can create challenges long after systems are restored,” said Quinton Kotze, Head of Cyber Solutions, Australia, Aon. “Australian organisations can encounter regulatory investigations, reporting requirements, financial penalties and insurance challenges. Understanding these obligations before an incident can help organisations make faster, more informed decisions when it matters most.”
Cyber Reporting Rules Differ Across Asia Pacific
Aon’s research examines cybersecurity and privacy regulations across 14 Asia Pacific locations. The findings reveal significant differences in reporting deadlines, financial penalties, and insurance arrangements.
Of the 14 locations examined, 13 require mandatory data breach reporting. Around half also apply penalties linked to organisational revenue. Reporting deadlines range from one hour to 30 days, depending on the location and applicable requirements.[2]
The report also examines whether organisations can insure against cyber-related fines. According to Aon, cyber fines may be insurable in 13 locations, depending on local legislation and the circumstances surrounding an incident.[2]
These differences matter for organisations operating across multiple jurisdictions. A cyber incident may create reporting and compliance obligations under more than one regulatory framework.
Can Australian Businesses Insure Against Cyber Fines?
Cyber insurance can form part of an organisation’s broader risk management strategy. However, the availability of insurance coverage for regulatory penalties depends on legal and contractual considerations.
In Australia, no legislation specifically prohibits indemnification of fines resulting from non-compliance with the Privacy Act. Nevertheless, whether a particular fine is insurable may depend on the conduct that led to the penalty.[3]
This distinction is important for businesses reviewing their cyber insurance arrangements. Organisations should not assume that insurance will automatically cover every regulatory fine following a cyber incident.
Instead, businesses need to understand their policy terms and the legal circumstances that may affect coverage.
Ransomware Payments Carry Additional Reporting Obligations
Australian cyber reporting requirements also extend to certain ransomware and cyber extortion payments.
Since 30 May 2025, certain organisations that make a ransomware or cyber extortion payment have been required to report that payment to the Australian Signals Directorate within 72 hours.[4]
The requirement adds another consideration for organisations managing ransomware incidents. Businesses must assess their reporting responsibilities while responding to operational disruption, financial demands, and other incident-related decisions.
Understanding these obligations before an attack can help organisations establish clearer reporting and escalation procedures.
Incident Response Planning Is a Board-Level Responsibility
Aon also highlights the importance of governance in managing cyber incidents. Businesses need more than technical recovery procedures to meet their regulatory responsibilities.
Incident response plans should identify who makes critical decisions, which regulators require notification, and how organisations will meet reporting deadlines.
“Cyber preparedness is also a governance issue. Boards need confidence that incident response plans define who makes key decisions, which regulators must be notified and how reporting deadlines will be met,” added Kotze. “Regular testing can help identify gaps in accountability, escalation pathways and communication before an incident occurs.”
Regular incident response exercises can help organisations identify weaknesses before a real event. They also provide an opportunity to test communication procedures, decision-making responsibilities, and regulatory escalation processes.
For Australian businesses, the central issue extends beyond preventing cyberattacks. Organisations must also prepare to manage the legal, financial, and operational consequences when incidents occur.
About the Report
The Changing Cyber Risk Landscape in APAC: Regulation, Fines and Insurability examines cybersecurity and data privacy regulation across 14 Asia Pacific locations.
Aon produced the report in collaboration with Wotton Kearney, drawing on local legal insights. The research reviews regulatory developments as of June 2026.
It covers breach notification requirements, enforcement mechanisms, financial penalties, the insurability of cyber fines, and the legality of ransom payments.
Read The Changing Cyber Risk Landscape in APAC here.
About Aon
Aon plc (NYSE: AON) is a global professional services firm providing risk and people-related advisory services.
The company operates in more than 120 countries. Its services combine analytics, Risk Capital, and Human Capital expertise to support organisational decision-making.
Follow Aon on LinkedIn, X, Facebook, and Instagram.
Visit Aon’s newsroom for company updates or sign up for news alerts here.
Source Disclaimer
Aon Risk Services Australia Limited (Aon) has taken care in the production of this document. The information contained in it is general in nature and is provided for informational purposes only. It has been obtained from sources that Aon believes to be reliable but is not intended to be comprehensive, nor does it constitute legal, regulatory or professional advice. You should seek independent professional advice before acting or relying on any of the content of this document. Aon does not make any representation as to the accuracy or completeness of the information, including information received from third parties, and is unable to accept liability for any loss, damage, cost or expense incurred by anyone who relies on it. The recipient of this document is responsible for their use of it.
© 2026 Aon Risk Services Australia Limited ABN 17 000 434 720 AFSL 241141
- Privacy Act 1988 (Cth), Federal Register of Legislation.
- The Changing Cyber Risk Landscape in APAC: Regulation, Fines and Insurability, Aon and Wotton Kearney, June 2026, p. 4.
- The Changing Cyber Risk Landscape in APAC: Regulation, Fines and Insurability, Aon and Wotton Kearney, June 2026, p. 53.
- Cyber Security Act 2024 (Cth); Cyber Security (Ransomware Payment Reporting) Rules 2025 (Cth), Federal Register of Legislation.