In an era of ever-evolving cyber threats, Australian businesses are more regulated than ever when it comes to data protection. The Notifiable Data Breaches (NDB) scheme, enforced by the Office of the Australian Information Commissioner (OAIC), requires organisations covered by the Privacy Act to notify affected individuals and the OAIC when a data breach involving personal information is likely to result in serious harm. However, despite strict compliance requirements, the StickmanCyber Report, which is based on the analysis of 6,000+ data breaches reported to the OAIC between February 2018 and October 2024, reveals a troubling reality: compliance does not equal security. Australian companies continue to suffer from major data breaches, exposing millions of individuals to cyber risks. According to the report,
Large scale data breaches involving 1,000 people or more have increased by 40% in the last 5 years. Breaches involving one million people or more have doubled
Many organisations fall into the trap of believing that meeting compliance standards guarantees cybersecurity. Compliance frameworks, such as the Australian Privacy Act and industry-specific regulations, provide essential guidelines but are often focused on legal obligations rather than practical security measures.
The report highlights a stark reality: some of Australia’s most heavily regulated industries, such as finance and healthcare, also report the highest number of data breaches. These industries operate under some of the strictest compliance obligations, yet they remain prime targets for cybercriminals. The OAIC’s latest figures show the pattern continuing: in 2025, health service providers (225) and the financial services sector (157) again notified the most breaches, out of a record 1,205 notifications.
Organisations often view compliance as a one-time requirement rather than an ongoing security process. Checking boxes on an audit does not equate to robust cybersecurity defences.
The StickmanCyber Report found that 28% of mega breaches (affecting one million or more individuals) went undetected for 30 days or longer, or the organisation gave no identification date in its report to the OAIC. Compliance regulations mandate reporting breaches, but they do little to improve an organisation’s ability to detect and mitigate them in real time.
While the public sector is at least reporting breaches to the OAIC, the report suggests that underreporting in the private sector remains a critical issue. Companies may fear reputational damage and financial penalties, leading to a lack of transparency that weakens overall cybersecurity efforts.
Compliance frameworks establish baseline security measures, but cybercriminals operate beyond these minimum standards. Hackers exploit gaps in outdated compliance requirements that fail to address emerging threats.
According to the report, compromised credentials are the leading cause of mega breaches in Australia. Many businesses comply with password management guidelines but fail to enforce strong authentication measures such as multi-factor authentication (MFA) and regular credential audits.
To reduce cyber risks, Australian businesses must go beyond compliance and adopt proactive security measures. Here’s how:
Australian businesses can no longer afford to rely solely on compliance to protect against cyber threats. While regulatory frameworks are essential for maintaining standards, they do not guarantee security. Cybercriminals exploit weaknesses in compliance-driven security postures, targeting organisations that fail to implement proactive threat mitigation strategies.
By shifting from a compliance-first mindset to a security-first approach, businesses can better defend against attacks, reduce breach detection times, and ultimately protect sensitive data. True security is an ongoing process, requiring continuous investment, education, and adaptation to the evolving cyber threat landscape.
Want to know whether your compliance program is keeping attackers out? StickmanCyber’s compliance and GRC team can review your controls against real-world threats. Book a free consultation.
Compliance means meeting the requirements of a law, regulation, standard or contract, such as the Privacy Act 1988, APRA CPS 234 or ISO 27001, and being able to show it to an auditor or regulator. Security is the ongoing work of protecting systems and data from real threats. Compliance sets a minimum baseline at a point in time; security has to keep pace with how attackers actually operate.
Organisations and Australian Government agencies covered by the Privacy Act 1988 must notify affected individuals and the OAIC about data breaches likely to result in serious harm. Most businesses with an annual turnover of more than $3 million are covered. Smaller businesses are covered too if, for example, they provide health services, trade in personal information or hold Commonwealth contracts.
An organisation that suspects an eligible data breach must take reasonable steps to complete its assessment within 30 days. If it has reasonable grounds to believe the breach is likely to cause serious harm, it must promptly notify the affected individuals and the OAIC. Separately, under the Cyber Security Act 2024, businesses with an annual turnover of more than $3 million must report ransomware payments within 72 hours.
Since 13 December 2022, the maximum civil penalty for a company’s serious interference with privacy is the greatest of $50 million, three times the value of the benefit obtained, or 30% of its adjusted turnover for the relevant period. Being compliant on paper won’t help a business that hasn’t taken reasonable steps to secure the personal information it holds, as Australian Privacy Principle 11 requires.
Not for most private businesses. ASD’s Essential Eight is guidance, and there is no requirement for independent certification unless a government directive or policy, a regulator or a contract requires it. Non-corporate Commonwealth entities must implement all eight strategies to at least Maturity Level Two under the Protective Security Policy Framework. Many businesses use it as a practical security benchmark beyond paper compliance.