ASIC has intensified its focus on cybersecurity, making it clear that directors can be held personally liable if they fail to implement adequate security measures. A failure to protect customer data or respond to cyber threats could be seen as a breach of directors’ duties under the Corporations Act. Directors must ensure their company has robust cybersecurity governance to mitigate risks and avoid severe penalties. 

Key Laws Governing Cybersecurity for Directors

Corporations Act 2001 – Directors must act with care and diligence. Negligence in cybersecurity preparedness can be considered a breach of duty, leading to legal consequences. 

Privacy Act 1988 – Businesses must protect customer data under the Australian Privacy Principles (APPs). Cyber breaches due to poor security can result in substantial fines. 

Security of Critical Infrastructure Act 2018 – Critical sectors must report cyber incidents and implement mandatory security controls. 

The Cost of Non-Compliance

ASIC has warned that directors who ignore cybersecurity obligations could face:

Fines:
Small business penalties start at $19,000.
Large corporations can be fined over $50 million for non-compliance.

Legal Action:
Directors can be personally sued for failing to prevent cybersecurity breaches.
Shareholders and customers can take legal action if inadequate security measures result in data breaches.

Regulatory Investigations:
ASIC has increased scrutiny on businesses that fail to implement proper cybersecurity governance.

Reputational Damage:
Customers lose trust in businesses that suffer cyber breaches.
Recovery from reputational damage can take years.

Case Study: OAIC v Medibank Private Ltd 

In June 2024, the Office of the Australian Information Commissioner (OAIC) took legal action against Medibank Private Ltd over a 2022 data breach affecting 9.7 million customers. The OAIC alleges that Medibank failed to implement proper cybersecurity measures, violating Australian Privacy Principle 11 under the Privacy Act. Key failures included lack of multi-factor authentication, weak password policies, and poor privileged access controls. 

This case highlights increasing regulatory scrutiny and serves as a warning to directors: failing to adopt strong cybersecurity measures can lead to legal and financial consequences. Read more about the case here. 

Cascading cyber security responsibilities at large organisation and SMEs (AICD Cyber Security
Governance Principles)

How Directors Can Protect Themselves

According to the Australian Institute of Company Directors Cybersecurity Governance Handbook, directors should adopt the following best practices:

1. Establish Cybersecurity Governance – Directors must actively oversee cybersecurity risks, ensuring they are integrated into broader risk management frameworks.
2. Implement Risk Assessments – Regular audits and penetration testing help identify vulnerabilities before they are exploited.
3. Invest in Cybersecurity Training – Many breaches occur due to human error. Training employees on cyber risks is critical.
4. Ensure Compliance with Privacy Laws – Directors must verify that security policies align with legal requirements under the Privacy Act and Corporations Act.
5. Adopt a Cybersecurity Incident Response Plan – Companies should have a structured approach for handling breaches, including escalation procedures, legal considerations, and communication strategies.
6. Define Board Level Cybersecurity Accountability – The board should have a clear role in cybersecurity oversight, including appointing responsible officers and requiring regular security briefings.
7. Implement the Essential 8 Cybersecurity Strategies – Developed by the Australian Cyber Security Centre (ACSC), the Essential 8 provides a baseline framework to mitigate cyber threats. These strategies include application control, patching, multi-factor authentication, and regular backups.
8. Engage Cybersecurity Experts – Seeking professional advice on cybersecurity strategies can prevent costly mistakes and ensure compliance with ASIC’s expectations.

Take Action Now

Cybersecurity is not just an IT issue—it’s a legal responsibility for directors. ASIC has made it clear that directors who fail to address cybersecurity risk their company’s future and their own liability.

Book a cybersecurity assessment today to ensure compliance and protect your business from legal and financial repercussions.