Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 13 AUGUST 2024

Disclosure Obligations For Cyber Ransom Payments: A New Cyber Security Act Is Coming

K&L Gates
K&L Gates
Contributor
K&L Gates

K&L Gates

The Firm K&L Gates is an integrated, international law firm. As a single global law firm, truly...

View firm profile
Explore more from K&L Gates

A new Cyber Security Act is set to be unveiled in Parliament's next sitting from 12 August, as reported by the ABC. The proposed Act would require Australian businesses and government bodies to disclose.

AustraliaTechnology
Cameron Abbott
Cameron Abbott
Rob Pulham
Rob Pulham
Stephanie Mayhew
Stephanie Mayhew
Dadar Ahmadi-Pirshahid
Dadar Ahmadi-Pirshahid
Lauren Hrysomallis
Lauren Hrysomallis

A new Cyber Security Act is set to be unveiled in Parliament's next sitting from 12 August, as reported by the ABC. The proposed Act would require Australian businesses and government bodies to disclose when they make a ransom payment to cybercriminals in the event of a hack, or face penalties of up to AU$15,000 for failing to notify.

The current proposal exempts small businesses at the same AU$3 million threshold as the Privacy Act's rules, though some believe the threshold is too low – the Australian Chamber of Commerce and Industry argues the rules should only apply to businesses with an annual turnover exceeding AU$10 million.

This bill would be in addition to the Cyber Resilience Service and Cyber Health Check services for small business expected to be operating by the end of 2024 as well as the Cyber Wardens Program currently operating that provides online cyber security training, designed to assist small businesses prevent and recover from cyber-attacks.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

APRA v Bedingo And Adelaide Bank: A Wake-up Call For Directors And Officers

The Australian Prudential and Regulatory Authority has launched unprecedented civil penalty proceedings against Bendigo and Adelaide Bank following a 2023 cybersecurity breach that exposed critical weaknesses in the bank's risk management systems. This landmark case signals a fundamental shift in regulatory enforcement, extending accountability beyond corporate entities to individual directors and officers who fail to ensure adequate cybersecurity controls are functioning as intended.
AustraliaTechnology
Kennedys
Kennedys
Article

ASIC Demands Urgent Cyber Upgrades To Combat Frontier AI Security Threats

In an open letter published on 8 May 2026, ASIC, who are responsible for regulating Australia's corporate, financial services and insurance sectors, urged Australian financial services licence (AFSL) holders to act promptly against the risks posed by advanced AI systems. ASIC warned that malicious actors are increasingly using cutting-edge AI models to identify and exploit vulnerabilities at an unprecedented scale.
AustraliaTechnology
Kennedys
Kennedys
Article

Text-Message Marketing In Texas, One Year After SB 140

Texas Senate Bill 140 (SB 140) took effect 1 September 2025, and applies to conduct occurring on or after that date. The bill amended Section 302 of the Texas Business and Commerce Code to extend registration and disclosure requirements to text messages by expanding the definition of “Telephone solicitation,” which previously applied only to a “telephone call,” to include certain transmissions of text or graphic messages and images. In addition, SB 140 added a definition of “Telephone call” that incorporates the definition found in Section 304, which includes certain text or graphic messages and images, but excludes certain agreed-to transmissions.
United StatesMedia, Telecoms, IT, Entertainment
K&L Gates
K&L Gates
Article

SEC And CFTC Open Door To Tokenized Markets After Clarity Fails To Advance

The SEC and CFTC have issued coordinated regulatory relief measures that significantly advance crypto-based trading infrastructure in US markets, bypassing Congressional gridlock on the CLARITY Act. These orders establish new frameworks for tokenized securities venues and passive software providers, potentially reshaping how digital assets are traded and accessed in regulated markets.
United StatesFinance and Banking
K&L Gates
K&L Gates
Article

Venezuela's Reopening: Investment, Infrastructure, And Technology Opportunities In A Rebuilding Latin America

Venezuela's post-Maduro reopening is creating unprecedented opportunities for foreign investors across energy, mining, telecommunications, and infrastructure sectors. With expanding OFAC sanctions relief, landmark legislative reforms, and major US companies nearing multibillion-dollar deals, the country presents investment prospects not seen in a generation—though success requires disciplined navigation of corruption, security, and regulatory risks.
United StatesInternational Law
K&L Gates
K&L Gates
Article

EU AI Act: Final Guidelines On Transparency Obligations Under Article 50

The European Commission has issued guidelines on transparency obligations under Article 50 of the EU AI Act, clarifying how providers and deployers must inform individuals when they interact with AI systems or are exposed to AI-generated content. These non-binding guidelines address a wide range of AI applications, from chatbots to deepfake technologies, and establish four main transparency scenarios with specific disclosure requirements that businesses must now prepare to implement.
European UnionGovernment, Public Sector
K&L Gates
K&L Gates
Article

New EU Withdrawal Button Requirement: Practical Implications And Recommendations For US And Global Online Sellers

The European Union's new Consumer Rights Directive amendment introduces a mandatory "withdrawal button" for online merchants, fundamentally changing how consumers exercise their 14-day right of withdrawal from distance contracts. This requirement, effective June 19, 2026, applies to any trader—including US-based companies—actively selling to EU consumers, creating new compliance obligations around button placement, design standards, data collection, and confirmation processes. Understanding whic
European UnionConsumer Protection
K&L Gates
K&L Gates
Article

United States Opens A New Chapter In Civil Nuclear Cooperation With The Kingdom Of Saudi Arabia

The United States and Saudi Arabia have signed a landmark nuclear cooperation agreement under Section 123 of the Atomic Energy Act, establishing the legal framework for decades of civilian nuclear partnership. This agreement resolves years of debate over nonproliferation conditions and positions US companies to participate in Saudi Arabia's ambitious civil nuclear program. The deal carries significant implications for US engagement in the Middle East, international nuclear commerce, and the global competiti
GlobalGovernment, Public Sector
K&L Gates
K&L Gates