The Privacy Act 1988 doesn't hand you a fixed security checklist, but Australian Privacy Principle 11 requires every business it covers to take "reasonable steps" to protect the personal information it holds, and since December 2024 the law says those steps include technical and organisational measures. In practice that means controls such as multi-factor authentication, patching, access control, logging and encryption, plus regular testing to prove they work. If a breach is likely to cause serious harm, the Notifiable Data Breaches scheme also requires you to notify affected people and the OAIC.
This guide explains who the Privacy Act covers, what "reasonable steps" looks like for an SMB, where penetration testing fits, what the first civil penalty case tells us, and how to build evidence you can stand behind. It pairs with our guides on cyber insurance and penetration testing, Essential Eight compliance for SMBs and how often to get a penetration test.
Does the Privacy Act apply to my business?
The Privacy Act applies to Australian Government agencies and to most businesses and not-for-profits with annual turnover above $3 million, plus some smaller businesses regardless of turnover. If you're covered, you're an "APP entity" and the 13 Australian Privacy Principles apply to you, including APP 11 on security.
According to the OAIC's small business guidance, the Act covers these businesses regardless of turnover:
- ▸health service providers (including allied health, GPs, clinics and many wellness businesses that hold health information);
- ▸businesses that trade in personal information;
- ▸contractors providing services under a Commonwealth contract;
- ▸operators of residential tenancy databases and credit reporting bodies; and
- ▸reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.
Annual turnover for this test includes all income from all sources, so check the number carefully before assuming you're exempt.
Even if you're exempt, you may not be off the hook
Three practical points for businesses under the $3 million line:
- Your clients may be covered. If you're a SaaS vendor, MSP, bookkeeper or marketing agency handling a covered client's customer data, expect contract clauses requiring security controls, breach notification and evidence of testing.
- The exemption is under review. The Attorney-General's Department's Privacy Act Review proposed removing the small business exemption, and the Government agreed to that in principle in its 2023 response, subject to further consultation and impact analysis. Treat it as a moving target.
- Insurers and tenders ask anyway. Cyber insurance proposal forms and government or enterprise supplier questionnaires ask about controls like MFA, backups and testing whether or not the Privacy Act applies to you.
What does APP 11 actually require?
APP 11.1 requires you to take such steps as are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. APP 11.2 requires you to destroy or de-identify personal information you no longer need, unless a law requires you to keep it.
The Privacy and Other Legislation Amendment Act 2024 added APP 11.3, which states that those reasonable steps include "technical and organisational measures". The OAIC's APP 11 guidelines say APP 11.3 applies to personal information held from 11 December 2024, regardless of when it was collected.
Technical vs organisational measures
The OAIC describes the two types like this:
- ▸Technical measures are technological and physical controls over software and hardware, such as securing premises, encrypting data, anti-virus software and strong passwords.
- ▸Organisational measures are policies, processes and procedures, such as staff training on privacy and security obligations and standard operating procedures for handling personal information.
The OAIC also says entities should use a layered approach "to avoid a single point of failure". One control on its own, like a firewall or an MFA prompt, is not a security program.
What "reasonable" depends on
The OAIC lists factors that shape what's reasonable for your business:
- ▸the nature of your business, including size, resources, complexity and business model;
- ▸the amount and sensitivity of the personal information you hold;
- ▸the possible adverse consequences for individuals if there's a breach;
- ▸the practical implications, including time and cost; and
- ▸whether a security measure is itself privacy-invasive.
Note the line on cost. The OAIC says an entity "is not excused from taking particular steps to protect information by reason only that it would be inconvenient, time-consuming or impose some cost to do so." Small doesn't mean nothing is expected. It means the expectation is scaled.
Does the Privacy Act require penetration testing?
No. The Privacy Act doesn't name penetration testing, but the OAIC's own guidance says ICT systems should be tested regularly and points to penetration or vulnerability testing as a way to find weaknesses. For a business holding customer, patient or employee data on internet-facing systems, it's one of the clearest ways to show your "reasonable steps" actually work.
The OAIC's Guide to securing personal information says testing of ICT systems "should occur during their development, transition to operations and regularly once they are operational," and that, depending on the situation, you may wish to consider "penetration (or vulnerability) testing to discover security weaknesses, or configuration reviews."
The same guide asks questions worth answering in writing before your next test:
- ▸How often is testing conducted?
- ▸Does it cover all aspects of the system, or only discrete parts that might miss systemic issues?
- ▸Who does the testing: internal staff or an independent party?
- ▸Is real personal information or dummy data used in testing?
- ▸If testing finds weaknesses, how are they reported and fixed?
If you can answer those clearly, with dated reports and remediation records behind each answer, you're in a far stronger position than a business that can only point to a policy document.
Scan or pentest?
They do different jobs. An automated vulnerability assessment is fast and cheap and catches known issues across many targets. A human-led penetration test shows whether those issues can be chained into real access to personal information. Our guide on vulnerability assessment vs penetration testing breaks down when each makes sense. Most SMBs benefit from both: scans between tests, and a manual test at least annually or after major change.
What happened in the first Privacy Act civil penalty case?
In October 2025 the Federal Court ordered Australian Clinical Labs to pay $5.8 million in civil penalties over a 2022 cyberattack on its Medlab Pathology business, the first civil penalties ever ordered under the Privacy Act. The case shows that APP 11 failures and slow breach assessment are both enforceable.
According to the OAIC's announcement, the breach involved unauthorised access to and exfiltration of the personal information of more than 223,000 people. The penalty was made up of:
- ▸$4.2 million for failing to take reasonable steps to protect personal information under APP 11.1;
- ▸$800,000 for failing to carry out a reasonable and expeditious assessment of whether an eligible data breach had occurred; and
- ▸$800,000 for failing to notify the Commissioner as soon as practicable.
Justice Halley found the contraventions were "extensive and significant" and resulted from ACL's "failure to act with sufficient care and diligence in managing the risk of a cyberattack." The court noted senior management was involved in decisions about integrating the acquired business's IT systems.
Lessons for SMBs
- ▸Acquired or inherited systems count. Integrating a newly acquired business, practice or platform without testing it is a risk the court took seriously.
- ▸Assessment speed matters. A slow, unclear decision on whether a breach is notifiable attracted its own penalty.
- ▸Uplift after the fact helps, but it's not a defence. The court reduced the penalty partly because ACL cooperated and started a cyber uplift program. Doing that work before an incident is far cheaper.
What are the penalties for breaching the Privacy Act now?
For a serious interference with privacy, a company now faces a maximum penalty of the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover during the breach period. ACL's penalties were calculated under the older regime, capped at $2.22 million per contravention, because its conduct happened before the higher penalties took effect on 13 December 2022.
The 2024 amendments added more tiers below that:
| Tier | What it covers | Maximum for a company |
|---|---|---|
| Serious interference | Serious interferences with privacy (s 13G) | Greater of $50m, 3x benefit, or 30% of adjusted turnover |
| Mid-tier | Interferences with privacy that aren't serious | 10,000 penalty units (about $3.3m when the law passed) |
| Administrative | Specific breaches such as a non-compliant privacy policy or data breach statement | Infringement notices; 60 penalty units for most companies, 200 for listed companies |
The OAIC can now issue infringement notices and compliance notices for some administrative breaches without going to court. Penalty unit values are indexed, so check the current figure on legislation.gov.au.
What does the Notifiable Data Breaches scheme require?
If you're covered by the Privacy Act and a data breach is likely to result in serious harm to someone whose personal information is involved, you must notify the affected individuals and the OAIC. If you only suspect an eligible breach, you must take reasonable steps to assess it, generally within 30 days.
Under the NDB scheme, a data breach happens when personal information is lost or subjected to unauthorised access or disclosure, for example a hacked database, a lost device or information sent to the wrong person. "Serious harm" can include identity theft, financial loss through fraud, serious psychological harm and serious harm to reputation.
How common are notifiable breaches?
The OAIC reported 1,205 data breach notifications in calendar year 2025, the highest since the scheme started in 2018 and 8% more than 2024's 1,112. Of those:
- ▸716 were attributed to malicious or criminal activity, with cyber incidents the leading cause;
- ▸health service providers were the most affected sector, with 225 notifications (19%); and
- ▸legal, accounting and management services recorded 81 notifications, alongside education.
The financial side is significant too. The ASD's Annual Cyber Threat Report 2024–25 puts the average self-reported cost of cybercrime per report at $56,600 for small businesses and $97,200 for medium businesses.
Preparation is a security control
Testing helps here too. A good penetration test report tells you what an attacker could reach, which systems log what, and where personal information actually lives. That's exactly what you need to answer "was data accessed?" quickly. If you don't yet have a response plan, the OAIC publishes an NDB quick reference guide and self-assessment checklist.
What "reasonable steps" look like for an Australian SMB
For most SMBs, reasonable steps means knowing what personal information you hold, cutting what you don't need, hardening the systems that store it, and testing those controls on a regular cycle. The OAIC's guidance expects steps across governance, ICT security, access security, third parties, data breaches, physical security, destruction and standards.
A practical, evidence-focused checklist:
- Map your personal information. Know which systems, SaaS platforms and backups hold customer, patient or staff data, and who can access them.
- Delete or de-identify what you don't need. APP 11.2 requires it, and data you no longer hold can't be breached.
- Baseline against the Essential Eight. The ASD's Essential Eight isn't a Privacy Act requirement, but MFA, patching, admin privilege restriction and backups map closely to the "technical measures" the OAIC describes. An Essential Eight assessment gives you a scored, documented baseline.
- Test what's exposed. Run automated assessments on websites, portals and APIs, and a human-led penetration test of the systems that hold personal information at least annually and after major change.
- Check your suppliers. The OAIC lists third-party providers and cloud computing as a security area. Ask your key vendors for recent independent test evidence.
- Train staff and write it down. Organisational measures need records: training logs, procedures, access reviews.
- Prepare your breach response. Know who decides whether a breach is notifiable, and how you'll meet the assessment timeframe.
- Keep the evidence. Dated reports, remediation tickets and retest results are how you show your steps were reasonable at the time.
Where Aussie Pentest fits
We test and assess; we don't run your IT. That independence matters when you need evidence that holds up with a client, insurer or regulator. If you need ongoing ownership of the program rather than one-off tests, a vCISO retainer provides advisory and oversight, not implementation or incident response.
How much does privacy-focused security testing cost?
On Aussie Pentest's published pricing, automated security assessments start at $80, human-led penetration tests start at $5,000, and a fixed-fee Essential Eight assessment for up to 50 seats is $4,950, all in AUD plus GST. The right mix depends on how much personal information you hold and where it lives.
| Service | Published price (AUD + GST) | Good fit for |
|---|---|---|
| Automated security assessment | $80 (1 target), $200 (1 domain), $500 (5 targets), $2,000 (10+ targets) | Fast, analyst-reviewed checks on websites, portals and APIs between manual tests |
| Penetration testing | From $5K (Basic), $12K (Standard), $20K (Advanced) | Proving whether an attacker can reach personal information; delivered in 5–10 business days |
| Essential Eight assessment | $4,950 fixed fee, up to 50 seats | Documented control baseline, maturity score and remediation roadmap |
| vCISO retainer | $2,500, $4,250 or $6,500 per month | Ongoing risk register, oversight and board-ready reporting |
An automated assessment is not a penetration test. It's a strong starting point, but it doesn't replace a human trying to chain weaknesses into access. See the full breakdown on our pricing page. MSPs that want to offer this testing under their own brand can ask about white-label partner rates.
Frequently asked questions
Is penetration testing mandatory under the Privacy Act?
No. The Privacy Act requires reasonable steps, including technical and organisational measures, but doesn't name specific tests. The OAIC's guidance recommends regular testing of ICT systems and mentions penetration or vulnerability testing as an option, so it's strong evidence of reasonable steps.
Does the Privacy Act apply to small businesses?
Most businesses with annual turnover of $3 million or less are exempt, but not all. Health service providers, businesses that trade in personal information, Commonwealth contractors and some others are covered regardless of turnover. The exemption is also under review.
What counts as "reasonable steps" under APP 11?
It depends on your size, the amount and sensitivity of the information, the potential harm from a breach and the practicality of each measure. Since December 2024, the law says reasonable steps include technical and organisational measures. Cost alone doesn't excuse skipping a step.
How long do we have to assess a suspected data breach?
If you suspect an eligible data breach, you must take reasonable steps to assess it, generally within 30 days. If it's likely to cause serious harm, notify the OAIC and affected individuals as soon as practicable.
Does Essential Eight compliance satisfy the Privacy Act?
Not automatically. The Essential Eight is an ASD framework, not a Privacy Act test. But its controls align well with APP 11's technical measures, and a documented assessment is useful evidence alongside penetration testing, policies and training.
The bottom line
APP 11 requires covered businesses to take reasonable technical and organisational steps to protect personal information, and the first civil penalty case shows those obligations are enforced. The law doesn't demand a specific test, but the OAIC expects regular testing, and a dated penetration test report with remediation evidence is one of the clearest ways to show your steps were reasonable. Know what you hold, delete what you don't need, harden what's left, and test it.
Want to know what an attacker could reach in your environment? Start with a penetration test or an Essential Eight assessment, or book a 1-on-1 scoping call with the Aussie Pentest team.
Sources
- ▸OAIC: Chapter 11, APP 11 Security of personal information (updated 3 October 2025)
- ▸OAIC: Guide to securing personal information
- ▸OAIC: Small business and the Privacy Act
- ▸OAIC: About the Notifiable Data Breaches scheme
- ▸OAIC: What is a notifiable data breach?
- ▸OAIC: Australian Clinical Labs ordered to pay penalties (9 October 2025)
- ▸OAIC: Data breach notifications increase to all-time high in 2025 (6 July 2026)
- ▸Federal Register of Legislation: Privacy and Other Legislation Amendment Act 2024
- ▸ASD: Annual Cyber Threat Report 2024–25
- ▸Aussie Pentest: Pricing
This article is general information only, not legal, privacy or compliance advice. Regulatory references are current as of October 2026. Check your own obligations with a qualified adviser.