The information revolution that has fundamentally altered our society is fueled by data, particularly personal information, enabling significant efficiency gains and innovative solutions to problems. The benefits of handling data also pose risks of significant harms.(1)

Governments and industry regulators have responded to the risks of harms from cyber-attacks and privacy breaches through an array of strengthened regulations. In Australia, we have privacy legislation at the federal level and in most states/territories, as well as sectoral regulation, directors’ duties under the Corporations Act, the Security of Critical Infrastructure Act, ASX Listing Rules requiring disclosure of market sensitive information, and proposals for a Cyber Security Act (amongst others). Similar, or stronger, regulatory regimes exist or are under development in many comparable jurisdictions.