Cyber, data and privacy

Enforcement action: cybersecurity and data breaches

• ASIC commenced two cybersecurity enforcement actions in 2025 against FIIG Securities¹ and Fortnum Private Wealth,² following cyberattacks on these organisations.  ASIC finalised its enforcement action against FIIG Securities in February 2026, with the Federal Court granting consent orders reflecting FIIG's admissions and imposing civil penalties ($2.5 million) for cyber security failures that breached its general financial services licence obligations. These actions reflect ASIC's emphasis on cybersecurity as a core component of financial services licensee obligations under section 912A of the Corporations Act. The FIIG action focused on deficiencies in technical cybersecurity measures and risk management systems, while the Fortnum action concentrates on inadequate policies, ineffective frameworks, weak internal controls and failure to provide adequate cybersecurity training.
• ASIC has not yet publicly announced any formal case against individual directors, despite stating that it was actively pursuing this in September 2024.
• APRA took robust steps following credential stuffing attacks on the superannuation industry to clarify its concerns regarding registrable superannuation entity (RSE) licensees' information security controls, and to outline minimum expectations regarding authentication/multi-factor authentication controls for high-risk activities. It issued formal letters to super fund boards reminding them of CPS 234 obligations, mandated self-assessment audits, and hosted a Superannuation Industry Roundtable focused on cyber resilience and uplift.
• The Federal Court approved Australian Clinical Lab's settlement with the Office of the Australian Information Commissioner (the OAIC) to pay $5.8 million for failing to take reasonable steps to protect personal information and assess a suspected eligible data breach³—the first civil penalty under the Privacy Act 1988 (Cth).⁴ The decision emphasises baseline cyber risk management expectations, and the importance of cyber risk diligence and transition planning in an acquisition context.
• A June 2027 hearing date has been set for the first stage of the Optus class action arising from its 2022 data breach. The trial will be heard jointly with the OAIC and ACMA civil penalty proceedings. The representative class action and OAIC proceedings against Medibank⁵ continue, while the OAIC's investigations into Latitude⁶ and HWL Ebsworth Lawyers⁷ remain ongoing.
• In a determination against online wine seller Vinomofo,⁸ the OAIC provided further guidance on Australian Privacy Principle (APP) 11.1 requirements, with a particular focus on cloud and data migration projects.

Facial recognition technology

• The OAIC found Kmart breached privacy by collecting personal and sensitive information through a facial recognition technology (FRT) system designed to tackle refund fraud⁹—the second major ruling on the use of FRT in retail stores following the Bunnings determination in October 2024. Both of these decisions have been appealed. Bunnings' appeal, which was handed down in February 2026,¹⁰ was largely successful. While the Administrative Review Tribunal upheld part of OAIC's decision, finding that Bunnings failed to provide notice to customers and should have conducted a privacy assessment before implementing the facial recognition technology, it found that Bunnings was entitled to rely on exemptions to the requirement to obtain consent, for the limited purpose of combatting retail crime, and protecting its staff and customers from violence, abuse and intimidation within its stores.

Record retention and destruction

• APRA took steps to investigate vulnerabilities with data retention and destruction practices of RSE licence holders, after observing systemic issues in relation to licensees' failure to destroy tax file number records as soon as reasonably practicable. In a formal letter to all RSE licensees, it noted these practices typically indicated broader data retention and destruction deficiencies; and that, in turn, retaining sensitive member information for significant periods of time heightens the consequence and impact of potential information security incidents. APRA requested that licensees review relevant practices for compliance and determine if a significant breach notification was required to be submitted to the regulator.
• Similarly, the OAIC highlighted excessive collection and retention of personal information as an area of key regulatory focus for 2025–26.¹¹

Consumer Data Right

• The OAIC issued its first Consumer Data Right (CDR) determination against Regional Australia Bank for breaches of Privacy Safeguards 1 and 11 relating to comingling of CDR data.¹² The determination clarified that data holders remain liable for third-party service provider failings.
• National Australia Bank and Commonwealth Bank of Australia each paid penalties ($751,200 and $792,000 respectively) to the ACCC for alleged breaches of the CDR Rules.

Law reform

The following legislative reforms commenced in 2025:

OAIC, APRA, ASIC, Critical Infrastructure Security Centre, ACCC.

Key government agencies include the Australian Cyber Security Centre, the Australian Signals Directorate (ASD), the Department of Home Affairs, the National Cyber Security Committee, and the National Office of Cyber Security.