Short takes on Australian security and privacy news: what changed, and what I'd do about it.
EDIT: these three are drafts for you to check and put in your own voice before publishing. New notes go at the top. Delete this line when done.
The Essential Eight has a successor
On 15 October 2026, ASD published ASD Essentials, with chapters for enterprise IT, operational technology and cloud. The enterprise IT chapter is the direct successor to the Essential Eight. Both frameworks stay on cyber.gov.au during the transition, and any obligation that names an Essential Eight maturity level still applies.
My take: don't pause uplift work. Map what you've built to the Essentials principles, then look at the new ground: leadership accountability, supplier risk and staff awareness. APRA-regulated entities will find these overlap heavily with CPS 230 and CPS 234.
Privacy policies have until 10 December to explain automated decisions
The first tranche of Privacy Act reforms requires privacy policies to disclose when personal information is used in substantially automated decisions that significantly affect people. The obligation starts on 10 December 2026.
My take: the policy wording is the easy part. The hard part is the inventory: finding every place where a system, not a person, effectively makes the call. Start with credit, claims, fraud and eligibility decisions.
72 hours to tell the OAIC? Not yet, but plan for it
The Tranche 2 exposure draft, released on 31 August 2026, proposes that eligible data breaches be notified to the OAIC within 72 hours, with staged updates allowed. It's a draft, not law.
My take: APRA-regulated entities already work to a 72-hour clock for material incidents under CPS 234. Joining up the two playbooks now costs little and avoids a scramble if the draft passes.