Which cyber security rules actually apply to your business in 2026?

Most Australian businesses assume compliance rules are for someone else, usually a bigger business or a bank. That assumption is wrong for a growing number of operators. Four separate obligations now apply depending on turnover, sector, or who you provide services to: mandatory ransomware payment reporting above $3 million turnover, the Privacy Act's shrinking small business exemption, AUSTRAC's AML/CTF Tranche 2 reforms from 1 July 2026, and APRA's CPS 230 for APRA-regulated entities and the businesses that service them. Here is exactly who each one catches, and who it does not.

Why this is confusing right now

Four different regulators, Home Affairs, the OAIC, AUSTRAC and APRA, each set their own thresholds and their own trigger events. A business can search “cyber security compliance small business Australia” and land on generic advice that blends all four together, or focuses on the wrong one for their sector. That gap is why a business under $3 million turnover might correctly assume the Privacy Act does not apply to them, while missing that AUSTRAC's rules now do, regardless of size, if they provide a designated service. The rest of this post separates the four regimes so you can check your own position against each one individually.

Ransomware payment reporting, the $3 million threshold and the 72 hour clock

Mandatory ransomware and cyber extortion payment reporting under the Cyber Security Act 2024 commenced on 30 May 2025. It applies to a “reporting business entity”, defined as a business carrying on operations in Australia with turnover exceeding $3 million in the previous financial year, plus critical infrastructure entities regardless of size. If your business makes a ransomware or cyber extortion payment, or becomes aware one has been made on its behalf (by an insurer or a negotiator, for example), you must report it to the government using the form on the Australian Signals Directorate's website within 72 hours of the payment being made. Paying a sanctioned entity is a separate criminal offence under Australia's sanctions regime. Failing to report carries a civil penalty of up to 60 penalty units, currently $99,000 for a body corporate. Source: Department of Home Affairs.

The Privacy Act, where the small business exemption still applies and who it misses

The general rule has not changed: a business with turnover of $3 million or less in a financial year is still exempt from most of the Privacy Act. The OAIC has publicly described this exemption as “no longer appropriate”, and the Attorney-General confirmed in February 2026 that a further reform tranche is being progressed, but no bill removing the exemption outright has been introduced yet. Where the exemption already stops working, regardless of turnover, is for businesses caught by AUSTRAC's AML/CTF Tranche 2 reforms. From 1 July 2026, the personal information a real estate agent, lawyer, accountant, conveyancer, or precious metals dealer collects for AML/CTF purposes falls under the Privacy Act even if that business turns over well under $3 million.

AML/CTF, what changed on 1 July 2026

Tranche 2 of the AML/CTF reforms extended AUSTRAC's regime, previously limited mostly to banks, remitters and gambling operators, to lawyers, accountants, real estate agents and property developers, conveyancers, and dealers in precious metals and stones from 1 July 2026. AUSTRAC opened enrolment for these newly captured professions on 31 March 2026, with a hard deadline to enrol by 29 July 2026 for anyone providing a designated service from 1 July. Once enrolled, these businesses must build an AML/CTF program, verify who they are dealing with, screen against watchlists, and report suspicious matters. Penalties for non-compliance reach $6.6 million for an individual and $33 million for a body corporate. Source: AUSTRAC.

APRA CPS 230, who it covers and who it does not

CPS 230, APRA's operational resilience standard, applies directly to APRA-regulated entities: authorised deposit-taking institutions, general, life and private health insurers, and superannuation trustees, effective from July 2025. A financial advice practice holding only an Australian Financial Services Licence is not directly regulated by CPS 230. APRA does not license financial advisers, so an AFSL alone does not bring a practice into scope. The exposure comes in sideways: if that practice is a material service provider to an APRA-regulated entity, such as a super fund or an insurer, the APRA-regulated client is required under CPS 230 to manage and monitor that relationship. In practice, this means the client will start asking its service providers to meet CPS 230-style expectations in their contracts, even though those providers are not directly regulated.

How to work out which list you're on

Run your business against each threshold in turn.

• Check last financial year's turnover against $3 million. Below that line, ransomware payment reporting and the Privacy Act's general exemption likely do not apply to you.
• Check whether you provide an AML/CTF designated service: real estate, legal, accounting, conveyancing, or dealing in precious metals or stones. If so, AUSTRAC enrolment and the related Privacy Act obligations apply from 1 July 2026 regardless of turnover.
• Check whether you hold an APRA licence as an ADI, insurer or RSE trustee. If so, CPS 230 applies to you directly.
• Check whether you supply services to a business that holds one of those licences. If so, expect CPS 230 obligations to reach you contractually even without direct regulation.

All IT works with Financial Services clients and the businesses that service them to map which of these regimes actually apply, then get the IT systems, data handling and reporting processes in place before an auditor, a regulator, or a client's compliance team comes asking.