Your regulatory exposure,
diagnosed in 12 minutes.

The Privacy Act 1988 applies to: (1) private sector organisations with annual turnover exceeding AUD 3 million; (2) all health service providers regardless of turnover; (3) all Australian Government agencies; (4) organisations that opt in voluntarily; and (5) organisations that trade in personal information. Following the 2024 reforms, the small business exemption is under active review and is expected to be removed — meaning all businesses handling personal data should begin compliance now.

An eligible data breach under Part IIIC of the Privacy Act requires three elements: (1) unauthorised access, disclosure, or loss of personal information; (2) that a reasonable person would conclude is likely to result in serious harm to any affected individual; and (3) the entity has not been able to prevent the likelihood of serious harm through remedial action. The organisation has 30 days from becoming aware of a potential breach to complete its assessment. If confirmed, notification must go simultaneously to the OAIC and to affected individuals. Failure to notify carries penalties of up to AUD 50M for corporations.

The Essential Eight defines three maturity levels. ML1: baseline protection against commodity threats — opportunistic attackers, bulk phishing, ransomware targeting easy victims. ML2: intermediate protection against targeted attacks where the adversary has invested moderate effort. ML3: advanced protection against sophisticated, persistent threats. For most Australian SMBs, ML1 is the minimum acceptable baseline. Businesses handling sensitive personal data (health, finance, legal) should target ML2. ACSC recommends all organisations achieve at least ML2 by default as of the 2023 framework revision.

The Cyber Security Act 2024 introduced mandatory ransomware payment reporting for businesses with annual turnover above AUD 3M. If your organisation pays a ransom following a cyber attack, you must report to the Department of Home Affairs within 72 hours — regardless of whether the payment was successful in recovering data. The Act also establishes minimum cybersecurity standards for smart devices sold in Australia and creates a Cyber Incident Review Board (CIRB) empowered to compel cooperation in post-incident investigations.

CPS 234 applies specifically to APRA-regulated entities (banks, insurers, superannuation funds, and their service providers handling material data). It requires a defined information security capability, documented policy framework, classification of data and systems, and testing of controls commensurate with risk. CPS 234 does not prescribe the Essential Eight directly, but APRA's guidance letters explicitly reference it as an appropriate baseline. In practice, an entity meeting Essential Eight ML2 will satisfy the majority of CPS 234 technical requirements.

Yes — this is one of the most overlooked compliance issues for Australian businesses. APP 8 (Cross-Border Disclosure) requires that before transferring personal information overseas, the disclosing organisation must take reasonable steps to ensure the recipient entity does not breach the APPs. In practice, this means reviewing the vendor's Data Processing Agreement (DPA), confirming subprocessor lists, verifying data residency options, and obtaining contractual commitments equivalent to Australian privacy standards. Relying solely on a vendor's Privacy Shield certification (now invalid) or generic ToS is insufficient. The OAIC can hold the Australian entity accountable for APP breaches by overseas recipients.

IRAP (Information Security Registered Assessors Program) is an ACSC program that qualifies individuals to assess the security posture of systems against the ISM and Essential Eight. An IRAP assessment is typically required for government contracts and cloud services handling government data (e.g., PROTECTED classification). PostureCheck is a self-assessment tool — it does not replace a formal IRAP assessment, but it can serve as effective preparation: organisations that use PostureCheck to close gaps before engaging an IRAP assessor typically reduce assessment time and cost significantly.

Your audit responses are processed entirely within your browser session. PostureCheck does not transmit your individual answers to any server. Only your overall score and email address (for report delivery) are stored — encrypted, in compliance with APP 11. Your answers are never shared with third parties, regulators, or used for any purpose other than generating your report. You can verify this by inspecting the page source.

ACSC recommends reviewing your security posture after any significant change: new systems deployed, staff changes affecting access, cloud migration, a security incident, or changes in legislation. At minimum, an annual reassessment is considered best practice. PostureCheck includes free reassessment access after 6 months so you can measure the impact of your improvements against a fixed baseline.