In an era of ever-evolving cyber threats, Australian businesses are more regulated than ever when it comes to data protection. The Notifiable Data Breaches (NDB) scheme, enforced by the Office of the Australian Information Commissioner (OAIC), requires organisations covered by the Privacy Act to notify affected individuals and the OAIC when a data breach involving personal information is likely to result in serious harm. However, despite strict compliance requirements, the StickmanCyber Report, which is based on the analysis of 6,000+ data breaches reported to the OAIC between February 2018 and October 2024, reveals a troubling reality: compliance does not equal security. Australian companies continue to suffer from major data breaches, exposing millions of individuals to cyber risks. According to the report,
Large scale data breaches involving 1,000 people or more have increased by 40% in the last 5 years. Breaches involving one million people or more have doubled
The Illusion of Compliance
Many organisations fall into the trap of believing that meeting compliance standards guarantees cybersecurity. Compliance frameworks, such as the Australian Privacy Act and industry-specific regulations, provide essential guidelines but are often focused on legal obligations rather than practical security measures.
The report highlights a stark reality: some of Australia’s most heavily regulated industries, such as finance and healthcare, also report the highest number of data breaches. These industries operate under some of the strictest compliance obligations, yet they remain prime targets for cybercriminals. The OAIC’s latest figures show the pattern continuing: in 2025, health service providers (225) and the financial services sector (157) again notified the most breaches, out of a record 1,205 notifications.
Key Reasons Compliance Fails to Prevent Cyber Attacks
Compliance is a Checklist, Not a Strategy
Organisations often view compliance as a one-time requirement rather than an ongoing security process. Checking boxes on an audit does not equate to robust cybersecurity defences.
Lagging Response Times to Breaches
The StickmanCyber Report found that 28% of mega breaches (affecting one million or more individuals) went undetected for 30 days or longer, or the organisation gave no identification date in its report to the OAIC. Compliance regulations mandate reporting breaches, but they do little to improve an organisation’s ability to detect and mitigate them in real time.
Underreporting in the Private Sector
While the public sector is at least reporting breaches to the OAIC, the report suggests that underreporting in the private sector remains a critical issue. Companies may fear reputational damage and financial penalties, leading to a lack of transparency that weakens overall cybersecurity efforts.
Focus on Minimum Standards Rather Than Threat Mitigation
Compliance frameworks establish baseline security measures, but cybercriminals operate beyond these minimum standards. Hackers exploit gaps in outdated compliance requirements that fail to address emerging threats.
Weak Credential Management
According to the report, compromised credentials are the leading cause of mega breaches in Australia. Many businesses comply with password management guidelines but fail to enforce strong authentication measures such as multi-factor authentication (MFA) and regular credential audits.
Bridging the Gap: From Compliance to True Security
To reduce cyber risks, Australian businesses must go beyond compliance and adopt proactive security measures. Here’s how:
- Adopt a Risk-Based Approach: Rather than meeting the bare minimum compliance requirements, businesses should conduct regular risk assessments to identify vulnerabilities and implement tailored security controls.
- Enhance Threat Detection and Response: Implementing real-time monitoring systems and a Security Operations Centre (SOC) can significantly reduce breach detection times.
- Improve Employee Cybersecurity Training: Many breaches result from human error. Ongoing education on phishing, credential security, and threat awareness can help mitigate insider risks.
- Enforce Strong Authentication Measures: Multi-factor authentication (MFA) and zero-trust frameworks provide additional layers of security beyond traditional password policies.
- Encourage Transparency and Reporting: Businesses should prioritise transparency and timely reporting of breaches, fostering a culture of accountability and collective defence.
Conclusion
Australian businesses can no longer afford to rely solely on compliance to protect against cyber threats. While regulatory frameworks are essential for maintaining standards, they do not guarantee security. Cybercriminals exploit weaknesses in compliance-driven security postures, targeting organisations that fail to implement proactive threat mitigation strategies.
By shifting from a compliance-first mindset to a security-first approach, businesses can better defend against attacks, reduce breach detection times, and ultimately protect sensitive data. True security is an ongoing process, requiring continuous investment, education, and adaptation to the evolving cyber threat landscape.
Want to know whether your compliance program is keeping attackers out? StickmanCyber’s compliance and GRC team can review your controls against real-world threats. Book a free consultation.
Frequently asked questions
What is the difference between cyber security compliance and cyber security?
Compliance means meeting the requirements of a law, regulation, standard or contract, such as the Privacy Act 1988, APRA CPS 234 or ISO 27001, and being able to show it to an auditor or regulator. Security is the ongoing work of protecting systems and data from real threats. Compliance sets a minimum baseline at a point in time; security has to keep pace with how attackers actually operate.
Which Australian organisations must report data breaches under the NDB scheme?
Organisations and Australian Government agencies covered by the Privacy Act 1988 must notify affected individuals and the OAIC about data breaches likely to result in serious harm. Most businesses with an annual turnover of more than $3 million are covered. Smaller businesses are covered too if, for example, they provide health services, trade in personal information or hold Commonwealth contracts.
How quickly must a suspected data breach be assessed?
An organisation that suspects an eligible data breach must take reasonable steps to complete its assessment within 30 days. If it has reasonable grounds to believe the breach is likely to cause serious harm, it must promptly notify the affected individuals and the OAIC. Separately, under the Cyber Security Act 2024, businesses with an annual turnover of more than $3 million must report ransomware payments within 72 hours.
What are the penalties for serious privacy breaches in Australia?
Since 13 December 2022, the maximum civil penalty for a company’s serious interference with privacy is the greatest of $50 million, three times the value of the benefit obtained, or 30% of its adjusted turnover for the relevant period. Being compliant on paper won’t help a business that hasn’t taken reasonable steps to secure the personal information it holds, as Australian Privacy Principle 11 requires.
Is the Essential Eight mandatory for Australian businesses?
Not for most private businesses. ASD’s Essential Eight is guidance, and there is no requirement for independent certification unless a government directive or policy, a regulator or a contract requires it. Non-corporate Commonwealth entities must implement all eight strategies to at least Maturity Level Two under the Protective Security Policy Framework. Many businesses use it as a practical security benchmark beyond paper compliance.
