COMPLIANCE365

Free resource · updated as things change

The Australian compliance calendar.

The dates that change what Australian organisations have to do on cyber security and privacy: what has started, what is coming, and what repeats every year.

Coming up

Timeline

  1. 2019

    1. · CPS 234

      CPS 234 applies to APRA-regulated entities

  2. 2025

    1. · Cyber Security Act

      Ransomware payment reporting starts

      Report a ransomware or cyber extortion payment within 72 hours. Education-first enforcement to the end of 2025.

    2. · CPS 230

      CPS 230 Operational Risk Management in force

      Sits alongside CPS 234 for APRA-regulated entities.

  3. 2026

    1. · Cyber Security Act

      Ransomware payment reporting fully enforced

    2. · ISM

      ISM June 2026 release

      Added controls for AI systems and AI-assisted development.

    3. · Essential Eight

      ASD announces the Essentials series to replace the Essential Eight

    4. · Essential Eight

      Consultation on the first Essentials chapter closes

    5. · Privacy Act

      Tranche 2 Privacy Act exposure draft released

      A draft bill, not law. Consultation closed 18 September 2026.

    6. · ISM

      ISM September 2026 release

      AI agents treated as identities, staff can no longer approve third-party apps, threat hunting every three months.

    7. · Privacy Act

      OAIC publishes automated decision-making guidance

    8. · IS18

      IS18 annual return due

      Signed by the accountable officer. Due every year on 30 September.

    9. · Essential Eight

      ASD publishes the Essentials

      Chapters for enterprise IT, cloud and OT. Existing Essential Eight work counts.

    10. · Privacy Act

      Privacy policies must describe automated decisions

      APP 1.7 to 1.9 apply. Already law, from the 2024 amendments.

  4. 2027

    1. · IS18

      IS18 annual return due

      Signed by the accountable officer.

Every time, every year

CPS 234Within 72 hoursNotify APRA of a material information security incident (¶35).CPS 234Within 10 business daysNotify APRA of a material control weakness you cannot remediate in time (¶36).CPS 234Every yearReview and test incident response plans (¶26) and review the testing program (¶31).Cyber Security ActWithin 72 hoursReport a ransomware or cyber extortion payment, if you are a reporting business entity.IS18Every 30 SeptemberAnnual return signed by the accountable officer.ISO 27001Every yearSurveillance audits in years 2 and 3, then recertification. Internal audit and management review before each.

Free monthly digest

Get these dates before they arrive

One email a month with what changed and what is coming up in Australian cyber security and privacy compliance. No spam, unsubscribe any time.

No spam. Unsubscribe any time. We never share your email.

General information, not legal advice. Each entry links to the page or post it comes from, which lists its sources.

Microsoft Teams