Boards may need to make cyber reporting decisions within hours
SYDNEY, 22 Oct. 2026 - Aon plc (NYSE: AON), a leading global professional services firm, has highlighted growing cyber reporting obligations and compliance requirements for Australian organisations following a cyber incident. Findings from The Changing Cyber Risk Landscape in APAC show regulators are strengthening breach notification requirements, increasing penalties and expanding enforcement activity across the region.
Australia is one of the region’s more mature cyber regulatory markets, with established breach notification requirements and increasingly active enforcement. Serious interference with privacy can attract a maximum penalty of the greater of AU$50 million, three times the benefit obtained from the breach, or 30% of adjusted turnover.1
“Cyber incidents can create challenges long after systems are restored,” said Quinton Kotze, Head of Cyber Solutions, Australia, Aon. “Australian organisations can encounter regulatory investigations, reporting requirements, financial penalties and insurance challenges. Understanding these obligations before an incident can help organisations make faster, more informed decisions when it matters most.”
Of the 14 locations examined, 13 require mandatory data breach reporting and around half apply revenue-linked penalties. Reporting time frames range from one hour to 30 days. Cyber fines may be insurable in 13 locations, depending on local law and the circumstances of the incident.2
In Australia, no legislation specifically prohibits indemnification of fines resulting from non-compliance with the Privacy Act. Whether a fine is insurable may depend on the conduct behind the penalty.3
Ransomware payments are another area where Australian organisations have specific obligations. Since 30 May 2025, certain organisations that make a ransomware or cyber extortion payment have been required to report it to the Australian Signals Directorate within 72 hours.4
“Cyber preparedness is also a governance issue. Boards need confidence that incident response plans define who makes key decisions, which regulators must be notified and how reporting deadlines will be met,” added Kotze. “Regular testing can help identify gaps in accountability, escalation pathways and communication before an incident occurs.”
About the Report
The Changing Cyber Risk Landscape in APAC: Regulation, Fines and Insurability examines cyber security and data privacy regulation across 14 Asia Pacific locations. Produced in collaboration with Wotton Kearney and informed by local legal insights, the report reviews regulatory developments as of June 2026. It covers breach notification requirements, enforcement mechanisms, penalties, the insurability of cyber fines and the legality of ransom payments.
Read The Changing Cyber Risk Landscape in APAC here.
1 Privacy Act 1988 (Cth), Federal Register of Legislation.
2 The Changing Cyber Risk Landscape in APAC: Regulation, Fines and Insurability, Aon and Wotton Kearney, June 2026, p. 4.
3 The Changing Cyber Risk Landscape in APAC: Regulation, Fines and Insurability, Aon and Wotton Kearney, June 2026, p. 53.
4 Cyber Security Act 2024 (Cth); Cyber Security (Ransomware Payment Reporting) Rules 2025 (Cth), Federal Register of Legislation.
About Aon
Aon plc (NYSE: AON) exists to shape decisions for the better — to protect and enrich the lives of people around the world. Through actionable analytic insight, globally integrated Risk Capital and Human Capital expertise, and locally relevant solutions, our colleagues provide clients in over 120 countries with the clarity and confidence to make better risk and people decisions that help protect and grow their businesses.
Follow Aon on LinkedIn, X, Facebook and Instagram. Stay up-to-date by visiting the Aon's newsroom and sign up for news alerts here.