Australia's revised Privacy Act hands consumers new powers and puts businesses on the hook for data breaches. With AI lowering the bar for cybercriminals, here's what organisations must do now.
Marco Cavani
Cybersecurity Analyst
In today’s digital age, data is more than just a commodity; it’s the backbone of modern economies. As artificial intelligence (AI) evolves and cyber threats grow more sophisticated, data security is becoming increasingly critical.
Australia’s recent review and approval of its Privacy Act highlights this critical need for change, particularly for businesses handling consumer information. The new regulations significantly enhance consumer powers and, as a result, will place increased pressure on businesses to step up their data security efforts.
With the rise of AI, the landscape of cybercrime has shifted. No longer are cybercriminals only highly skilled hackers; thanks to advanced AI-powered tools, even unskilled individuals can launch attacks that would have previously been impossible (CrowdStrike, 2024, p. 9).
A recent report by CrowdStrike highlights how these tools are making it easier for cybercriminals to penetrate networks, steal data, and exploit vulnerabilities. This poses a direct threat to businesses handling sensitive consumer information.
The new Privacy Act gives consumers more power to hold companies accountable. Businesses that fail to protect data may face legal actions, fines, and lasting reputational damage.
Cloud-based attacks have become increasingly frequent. Cybercriminals are becoming more adept at exploiting vulnerabilities in cloud environments, learning to leverage legitimate cloud processes to obfuscate their actions, making it harder to detect and respond to breaches (CrowdStrike, 2024).
Document and implement a solid data retention policy that defines:
Keeping only the data needed for business operations minimises exposure to cyberattacks and legal liabilities.
Employees are often the first line of defence. Train them to:
The new Act isn’t optional. Organisations must assess their current data security posture against the requirements of the updated Privacy Act and act swiftly to close gaps.
As Australia’s Privacy Act undergoes significant changes, businesses of all sizes must act immediately. The risks of not doing so are substantial, not just in terms of legal consequences, but also in the erosion of consumer trust.
The new Privacy Act is not just a challenge; it’s an opportunity for businesses to demonstrate their commitment to protecting consumer privacy and building long-term trust.
Written by
Marco Cavani
Cybersecurity analyst and IT governance professional. Author of digital reports on threat intelligence, critical infrastructure security, and IT audit frameworks.
The EU's Digital Operational Resilience Act makes surviving an IT disruption a matter of law for financial firms, and fintechs are squarely in scope. Here are the five pillars, the third-party trap, and where the accountability actually sits.
In April 2023, Samsung discovered that employees had pasted confidential source code, test sequences, and internal meeting notes into ChatGPT in three separate incidents. The data cannot be retrieved. AI Controls exist to prevent exactly this scenario.
How Generative Adversarial Networks are being weaponised by cybercriminals, why regulators are scrambling to catch up, and what individuals and organisations can do to protect themselves.
Get the latest cybersecurity reports, threat intelligence, and IT governance insights delivered straight to your inbox. No spam. Unsubscribe any time.
No spam. Unsubscribe at any time.
The RACM ITGC SaaS platform helps audit professionals manage IT General Controls assessments, from risk and control mapping to workpaper generation and evidence tracking.
