| Privacy Act 1988 + Privacy and Other Legislation Amendment Act 2024Regulator: OAIC · "tranche 1" reforms | In force · phasedRoyal Assent 10 Dec 2024, most changes from 11 Dec 2024. Statutory tort from 10 Jun 2025. Automated-decision transparency from 10 Dec 202620. | A new right to sue for serious invasions of privacy, without proof of financial loss. OAIC infringement and compliance notices. A mid-tier civil penalty of about A$3.3M for a body corporate21. Eligible data breaches still go to the OAIC and individuals, with 30 days to assess a suspected breach. The small-business exemption (turnover under A$3M) remains, but is under review21. | Implication: breaches can now bring private lawsuits as well as regulator action.
Response: privacy operations adapted to the APPs, DLP, and an incident runbook with OAIC notification steps. |
| Privacy reform "tranche 2"Privacy Amendment (Personal Data Protection) Bill 2026 · exposure draft | DraftExposure draft released 31 Aug 2026. Consultation closed 18 Sep 2026. No commencement date announced22. | A "fair and reasonable" test for handling personal information. Controller and processor roles. OAIC breach notification within 72 hours. A statutory consent standard, an opt-out for direct marketing and a limited erasure right for large platforms. Biometrics and precise location become sensitive information22. | Implication: XcellHost would be a processor, with duties set by the controller's instructions.
Response: processor terms ready before the bill passes, and a 72-hour breach drill in every managed SOC contract. |
| Children's Online Privacy CodeOAIC code under the 2024 amendments | Due Dec 2026Exposure draft published 31 Mar 2026, consultation to 5 Jun 2026. Must be registered by 10 Dec 202623. | Covers social media, relevant electronic and designated internet services likely to be accessed by children, and services mainly about children's activities. Health services are excluded23. | Implication: edtech, gaming and consumer apps need age-aware data design.
Response: privacy impact assessments, data mapping and data-loss controls. |
| Cyber Security Act 2024Ransomware reporting · Cyber Incident Review Board · smart devices | In forceRoyal Assent 29 Nov 202424. Ransomware reporting and Review Board rules from 30 May 2025. Compliance phase from 1 Jan 202625. | Businesses with annual turnover of A$3M or more, and critical-infrastructure entities of any size, report a ransomware payment to ASD within 72 hours. Penalty up to 60 penalty units (about A$19,800)25. The Review Board can examine significant incidents24. | Implication: the mid-market now has a federal cyber duty, with the same A$3M line as privacy.
Response: managed SOC, DFIR retainers and immutable backup so the payment question never comes up. |
| Security standards for smart devicesCyber Security (Security Standards for Smart Devices) Rules 2025 | In forceCommenced 4 Mar 2026, after a 12-month transition, for consumer devices made on or after that date26. | No universal default passwords. A published way to report security issues. A published security-update support period with an end date26. | Implication: device makers and importers need vulnerability handling and update signing.
Response: IoT PKI, code signing and security testing. |
| Security of Critical Infrastructure Act 2018 (SOCI)Amended Nov 2024 · regulator: CISC, Home Affairs | In forceIncident reporting since 8 Jul 2022. Asset register since 8 Oct 2022. Risk programs since 18 Aug 2023, with cyber-framework compliance from 18 Aug 202427. | Covers 11 sectors, including data storage or processing, financial services, energy, health care, higher education, food and grocery and transport28. The 2024 amendments make data storage systems that hold business-critical data part of the asset, and let the government direct changes to a seriously deficient risk program2829. | Implication: hosting and SOC providers to these sectors inherit evidence duties by contract.
Response: supplier assurance packs, GRC and OT assessments. |
| ASD Essential EightMitigation strategies from the Australian Cyber Security Centre | FrameworkNot mandated for business by the Cyber Security Act 202432. | Application control, patching applications and operating systems, Office macro settings, user application hardening, restricting admin privileges, multi-factor authentication and regular backups. Maturity Level 2 is often recommended as a minimum for business32. | Implication: buyers and insurers ask for an Essential Eight maturity score.
Response: a fixed-fee Essential Eight assessment, then patching, MFA and PAM. |
| APRA CPS 230 Operational Risk ManagementPrudential standard · replaces CPS 231 and CPS 232 · CPS 234 retained | In forceApplies from 1 Jul 2025. Pre-existing material service provider contracts had to comply by renewal or 1 Jul 20263031. | A register of material service providers, sent to APRA every year. Contracts with audit, access and APRA visit rights, subcontractor notice and termination rights. APRA notice within 72 hours of a material incident and 24 hours of a disruption beyond tolerance30. CPS 234 on information security stays in force31. | Implication: banks, insurers and super funds review every material ICT provider, XcellHost included.
Response: a CPS 230 contract schedule, audit rights and the BFSI Cloud evidence pack. |
| National AI PlanPlus the Guidance for AI Adoption ("AI6") and the APS AI Plan | PolicyPlan released 2 Dec 2025. AI6 guidance from 21 Oct 2025. APS AI Plan from 12 Nov 20251011. | No mandatory guardrails and no standalone AI Act: existing privacy, consumer, workplace and sector laws apply. An AI Safety Institute with A$29.9M of funding10. The AI6 guidance replaces the voluntary AI safety standard. Each Commonwealth agency gets a Chief AI Officer and mandatory AI literacy training11. | Implication: AI demand is governance-led, not compliance-forced.
Response: vCAIO advisory, ISO/IEC 42001 and AI literacy cohorts mapped to AI6. |
| Hosting Certification FrameworkDigital Transformation Agency | OperatingIn use since 2021. Certified Strategic is the highest level1617. | Protected-level data and whole-of-government systems must be hosted in Certified Assured or Certified Strategic providers. Strategic certification lets the government set ownership and control conditions17. | Implication: XcellHost is not certified, so it cannot host protected-level federal data itself.
Response: sell to government only through certified Australian primes, as a services layer. |
| India–Australia ECTA tax changeRemote technical services by Indian residents | In forceApplies to income years starting on or after 29 Dec 2022, so from 1 Apr 2023 for March year-end Indian firms3334. | Australia no longer taxes eligible technical services provided remotely by Indian residents, without an Australian permanent establishment, where the payment is not a royalty33. It reverses the effect of a 2018 court ruling that let Australia tax such offshore income35. | Implication: Mumbai-delivered managed services avoid the old Australian tax on offshore income.
Response: keep delivery remote until the Pty Ltd opens, and avoid creating a permanent establishment by accident. |
| Entity & taxPty Ltd · GST · company tax | CheckCommonly cited settings. We could not re-verify them online for this edition. | A proprietary company (Pty Ltd) registered with ASIC, with at least one director ordinarily resident in Australia. GST at 10%. Company tax at 30%, or 25% for base-rate entities. Treatment of imported B2B services needs advice. | Response: confirm with an Australian tax adviser before setting prices and opening the entity. See pricing & tax. |