Board Duties and Liability After a Cyber Breach: What Australian Directors Must Do Now

Director duties and liability after a cyber breach are now among the most pressing governance issues facing Australian directors.  The Federal Court has now penalised both a financial services licensee and a Privacy Act entity for cyber security failures, and regulators are scrutinising how boards respond. A cyber incident is no longer purely a technical problem for the IT function: it is a board-level event that engages directors’ statutory duties, continuous disclosure obligations, privacy law and the expectations of ASIC, the ASX and the OAIC. Directors who respond poorly, delay disclosure or fail to document their decisions risk personal exposure as well as reputational and financial damage to the company.

This article sets out a step-by-step playbook, from the first 48 hours through to long-term governance reform, so boards and company secretaries can act decisively and defensibly.

Why this matters and how to use this guide

When a breach is detected, the pressure on directors is immediate and multidirectional: customers want answers, regulators expect prompt engagement, markets react to uncertainty and insurers impose their own timelines. Understanding directors’ duties and liability before an incident occurs is one of the most effective ways to reduce exposure, because the decisions that most affect liability are often made in the first hours, frequently before complete information is available.

This guide is structured as a practical sequence. It moves from the immediate legal duties directors owe, through the web of notification obligations, to forensic investigation, insurance, remediation and communications, and finally to the governance reforms that help prevent recurrence. Each section maps to a real decision a board will face.

Use it as a reference during an incident and as a planning tool before one. The following quick-action list captures the priorities for the first 48 hours:

• Convene the board or an authorised sub-committee. Record the time of detection and the decision to activate the incident response plan.
• Preserve evidence. Isolate affected systems without destroying logs; do not “clean up” before forensic advice.
• Engage external legal counsel early. This helps structure investigations to support claims of legal professional privilege.
• Assess notification triggers. Consider OAIC, ASX continuous disclosure, ASIC and any sector regulator obligations in parallel. Some clocks are measured in hours, not days: 12 or 72 hours for critical infrastructure assets, 72 hours for APRA-regulated entities and 72 hours after any ransomware payment.
• Notify the insurer and check policy conditions. Late notice can reduce cover or, under a claims-made policy, leave a gap in cover.
• Take advice before engaging with any ransom demand. A payment may breach Australian sanctions laws, and any payment must be reported to the Australian Signals Directorate within 72 hours.
• Document every decision. Board minutes are a primary defence against later allegations of breach of duty.

Immediate legal duties for directors after a cyber breach

The starting point for any analysis of directors’ liability after a cyber breach is the Corporations Act 2001 (Cth). The statutory duties in sections 180 to 184 do not switch off during a crisis. The legal standard does not change, but the circumstances demand more of directors and the quality of the board’s conduct will later be judged against the information available and the steps a reasonable director would have taken.

Statutory duties under sections 180–184 of the Corporations Act

Section 180 imposes a duty of care and diligence, assessed by reference to what a reasonable person would do in the director’s position. Section 181 requires directors to act in good faith in the best interests of the company and for a proper purpose. Sections 182 and 183 prohibit the improper use of position and of information, and section 184 makes reckless or intentionally dishonest breaches of sections 181 to 183 criminal offences. These duties apply to officers as well as directors, which can include a CFO, CIO or CISO who participates in key decisions.  In the context of a cyber incident, the duty of care and diligence is the most frequently engaged: it underpins the expectation that directors oversee cyber risk, interrogate management’s response, and make informed decisions about disclosure and remediation.

Director duties after a data breach are not satisfied by passivity. A director who defers entirely to management without asking probing questions, or who fails to ensure the company has an adequate incident response capability, may be exposed to allegations of a breach of section 180. Courts have also accepted that a director may breach section 180 by failing to guard the company against foreseeable harm from its own contraventions of law (ASIC v Cassimatis (No 8) [2016] FCA 1023). For financial services licensees, inadequate cyber risk management has itself been held to breach the general licensee obligations in section 912A: ASIC v RI Advice Group Pty Ltd [2022] FCA 496 and ASIC v FIIG Securities Ltd [2026] FCA 92, in which the Court imposed a $2.5 million penalty for cyber security failures including untested incident response plans, missing multi-factor authentication and unpatched vulnerabilities. 

The “business judgment rule” in section 180(2) offers a defence to the duty of care and diligence where directors make the judgment in good faith for a proper purpose, do not have a material personal interest in the subject matter, inform themselves about the subject matter to the extent they reasonably believe appropriate, and rationally believe the judgment is in the company’s best interests, but this protection depends heavily on a documented, reasoned process.  Two limits matter in a cyber incident. First, the rule protects only an actual decision, so it does not help a director whose failure was a lack of oversight rather than a considered judgment. Second, it applies only to the duty of care and diligence and its equivalent general law duties: it is no defence to contraventions of continuous disclosure, privacy or other statutory obligations

Duty to act in the company’s best interests and risk oversight

Cyber risk oversight is now treated as a core component of the board’s broader risk management responsibility. Directors must ensure the company maintains systems to identify, assess and respond to cyber threats proportionate to its size and risk profile. After a breach, the duty to act in the company’s best interests requires the board to balance competing pressures (rapid disclosure, legal risk, customer welfare and shareholder value) and to reach decisions that are defensible on the information reasonably available at the time.

What board minutes and resolutions should record

Documentation is where liability is most often won or lost. Minutes and resolutions should record, at minimum: the time the incident was reported to the board; the information provided to directors; the advice sought and received; the decisions taken on investigation, notification and disclosure; the reasons for those decisions; and the responsibilities allocated. Contemporaneous, accurate minutes demonstrate a reasoned process and support the business judgment rule defence.  Minutes should record that legal advice was received and considered, but generally not its substance, to reduce the risk of waiving privilege. Directors should also assume that emails, text and messaging-app exchanges about the incident will be discoverable in later proceedings

The role of the company secretary

The company secretary’s role in a cyber incident is pivotal. The company secretary typically coordinates board meetings, ensures that papers and advice are circulated, maintains the integrity of the minute record, and helps track notification deadlines across multiple regulators. In many organisations the company secretary also supports continuous disclosure assessment, helping ensure that the board’s decisions are properly documented and that announcements are released through the correct channels.  As an officer, the company secretary is personally subject to the section 180 duty.

For the first 24 to 72 hours, a simple “do and don’t” discipline helps directors avoid common errors:

• Do activate the incident response plan and record decisions in real time.
• Do seek legal advice before communicating externally.
• Do consider all notification triggers in parallel, not sequentially.
• Don’t destroy or alter affected systems before forensic preservation.
• Don’t make public statements that may later prove inaccurate.
• Don’t delay insurer notification to “wait and see”.

Notifications: ASIC, ASX, OAIC and other regulators

The notification landscape is one of the most complex aspects of board duties liability after cyber breach, because several regimes can be triggered simultaneously, each with its own threshold and timeframe. The board must assess them together and avoid the common mistake of treating one notification as satisfying all obligations.

ASIC’s expectations

ASIC expects boards to take cyber resilience seriously as part of their governance obligations and to engage constructively with the regulator after a significant incident. Meeting ASIC’s expectations means being able to demonstrate that the board had appropriate oversight arrangements in place before the incident, responded promptly and reasonably once it occurred, and cooperated with regulatory inquiries. ASIC’s interest focuses on whether directors and officers discharged their duties and whether any disclosure obligations were met. Boards should assume that their decisions and documentation may be scrutinised, and should engage with ASIC in a transparent and timely way.  For AFS and credit licensees, a significant cyber incident may also be a reportable situation that must be reported to ASIC within 30 days under the breach reporting regime (section 912DAA of the Corporations Act and the equivalent provisions of the National Consumer Credit Protection Act 2009 (Cth))

ASX continuous disclosure and cyber incidents

For listed entities, the continuous disclosure obligations in ASX Listing Rule 3.1 (reinforced by section 674 of the Corporations Act) are often the most time-sensitive. A cyber incident may constitute information that a reasonable person would expect to have a material effect on the price or value of the entity’s securities, in which case it must be disclosed to the market immediately, subject to the limited exceptions in Listing Rule 3.1A.  Assessing whether an incident must be disclosed requires the board to consider the scale of the breach, the sensitivity of compromised data, the operational impact and likely remediation costs. Where the materiality assessment is finely balanced, directors should document their reasoning carefully and seek legal advice.  The confidentiality limb of Listing Rule 3.1A is often lost early in a cyber incident, for example when the attacker publicises the breach or data appears online. If the board needs time to assess materiality, it should consider requesting a trading halt, as several listed entities did after the major 2022 and 2023 breaches. Directors involved in a contravention of section 674 may be personally liable under section 674A, although private civil claims now require proof of knowledge, recklessness or negligence.

Announcements should be factual, avoid speculation, and be updated as the situation develops.

OAIC and the Notifiable Data Breaches scheme

Under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth), administered by the OAIC, an entity must notify affected individuals and the Commissioner where there is unauthorised access to, unauthorised disclosure of, or loss of personal information that is likely to result in serious harm, and the entity has been unable to prevent that likely harm through remedial action. Where an entity has reasonable grounds to suspect an eligible data breach may have occurred, it must carry out a reasonable and expeditious assessment and must take all reasonable steps to complete it within 30 days (section 26WH).

The OAIC notifiable data breach obligation drives early privacy analysis: the board should ensure the privacy officer assesses the breach promptly and that notification statements contain the information required by the scheme.  30 days is a ceiling, not a target: once there are reasonable grounds to believe an eligible data breach has occurred, notification must be made as soon as practicable. In Australian Information Commissioner v Australian Clinical Labs Ltd (No 2) [2025] FCA 1224, the first civil penalty under the Privacy Act, the Federal Court imposed a $5.8 million penalty and found that notification could have been made within two to three days rather than the almost one month the company took, and that relying on an inadequate external assessment did not make the assessment reasonable. Maximum penalties for serious interferences with privacy are now the greatest of $50 million, three times the benefit obtained, or 30% of adjusted turnover in the relevant period.

Further change is coming. The exposure draft Privacy Amendment (Personal Data Protection) Bill 2026, released by the Government in late August 2026, would replace the 30-day assessment window with a requirement to notify the Commissioner within 72 hours of having reasonable grounds to believe an eligible data breach has occurred. Since June 2025, individuals have also been able to sue for intentional or reckless serious invasions of privacy under the new statutory tort.

Other sector regulators

Depending on the industry, additional regulators may be engaged. APRA-regulated financial institutions have prudential obligations relating to information security and incident notification under CPS 234 (notification to APRA within 72 hours of becoming aware of a material information security incident) and CPS 230 (within 24 hours of a disruption to a critical operation outside tolerance); telecommunications providers have obligations relevant to the ACMA; and operators of critical infrastructure assets must report cyber security incidents to the Australian Signals Directorate’s Australian Cyber Security Centre within 12 hours for a critical incident having a significant impact on the asset, or within 72 hours for other incidents having a relevant impact, under Part 2B of the Security of Critical Infrastructure Act 2018 (Cth). The board should confirm, at the outset, which sector-specific regimes apply and what their notification timelines are. Defence industry suppliers that are members of the Defence Industry Security Program (DISP) also have security incident reporting obligations to Defence.

Ransomware payments and sanctions

Since 30 May 2025, entities carrying on business in Australia with annual turnover above $3 million, and responsible entities for critical infrastructure assets, must report any ransomware or cyber extortion payment made by them or on their behalf to the Australian Signals Directorate within 72 hours of making the payment or becoming aware it was made (Part 3 of the Cyber Security Act 2024 (Cth)). Reporting does not make a payment lawful. Paying a person designated under Australian sanctions laws is an offence, and Australia has imposed cyber sanctions on individuals linked to major ransomware attacks, including the Medibank breach. Boards should obtain legal advice on sanctions exposure and insurer consent before any payment is authorised. Information provided to ASD and the National Cyber Security Coordinator is subject to statutory limited-use protections, which can make early voluntary engagement with government less risky than boards often assume.

Forensic investigations and preserving evidence

How a board handles the investigation shapes both the technical outcome and the legal position. Done well, a forensic investigation establishes the facts, supports notification decisions and preserves the company’s ability to defend itself. Done poorly, it can destroy evidence, waive privilege and undermine the board’s defence to allegations of breach of duty.

Appointing forensic investigators

Forensic investigators should be appointed quickly, with a clearly defined scope and agreed protocols for chain of custody. Where possible, the engagement should be structured through legal counsel so that investigative reports are created for the dominant purpose of obtaining legal advice. The board should confirm the investigator’s independence, capacity and reporting lines, and ensure that findings are reported in a controlled way rather than circulated widely.

Evidence preservation protocols

The Australian Cyber Security Centre provides technical guidance on incident response, including the preservation of evidence. The core discipline is to avoid altering affected systems: isolate compromised assets, preserve logs and system images, and resist the temptation to “fix” the problem before the forensic picture is captured. Premature remediation can destroy the evidence needed to understand the breach, meet notification obligations and pursue or defend litigation.

Legal privilege considerations

Preserving legal professional privilege over investigation reports is a recurring recurring challenge. In both the Optus and Medibank class actions, the Federal Court rejected privilege claims over Deloitte reports into the breaches because the companies could not show that obtaining legal advice was the dominant purpose: Robertson v Singtel Optus Pty Ltd [2023] FCA 1392 (leave to appeal refused, [2024] FCAFC 58) and McClure v Medibank Private Ltd [2025] FCA 167 (leave to appeal refused, [2026] FCAFC 38). In Medibank, a post-incident review, a root cause analysis and a CPS 234 compliance report were all held not to be privileged. Privilege is more likely to be maintained where the investigation is commissioned by lawyers for the dominant purpose of providing legal advice or for anticipated litigation, where reports are marked and handled accordingly (although labels alone are not determinative), and where distribution is strictly limited. Boards should take advice on privilege before commissioning reports, because the way an engagement is structured at the outset is difficult to repair later. A common approach is to run two workstreams: a privileged investigation commissioned by lawyers to advise on legal exposure, and a separate technical workstream for containment, remediation and regulator reporting, on the assumption that the second will be disclosed. Public statements describing the purpose of a review should be checked against the privilege position before release.

Interplay between investigation and disclosure timing

A frequent dilemma is whether to notify customers and the market before the investigation is complete. The law does not permit the board to wait indefinitely for perfect information: notification obligations under the NDB scheme and continuous disclosure rules are triggered by thresholds that may be met well before the investigation concludes. The board must therefore run investigation and notification assessment in parallel, disclosing what is known and reasonable to disclose, and updating as facts emerge.

Insurance, indemnities and limiting director exposure

Insurance is a central pillar of managing directors’ exposure after a after cyber breach, but it only protects the company and its directors if the policy conditions are met. Mishandling the insurer relationship in the early hours is one of the most avoidable ways to compound a cyber incident.

Cyber insurance: when to notify the insurer

Most cyber insurance policies require prompt notification of an incident or circumstance that may give rise to a claim. Delay can allow the insurer to reduce a claim to the extent it has been prejudiced (section 54 of the Insurance Contracts Act 1984 (Cth) generally prevents refusal for late notice alone), and failing to notify circumstances before a claims-made policy expires can leave the company without cover. The practical rule is to notify early, even where the full scope is unclear, and to comply with the policy’s notification mechanics precisely. Boards should identify the relevant policies (cyber, D&O and others) before an incident so that notification can occur without delay.

D&O insurance interactions and coverage gaps

Directors and officers liability cover is distinct from cyber cover and responds to claims against individual directors, for example, allegations of breach of duty in connection with the handling of a cyber incident. The board’s coverage analysis should map which policy responds to which exposure, identify gaps between them, and confirm that the sums insured are adequate. Boards should not assume that a cyber policy will cover director liability, or that a D&O policy will cover remediation costs. Sections 199A and 199B of the Corporations Act also limit what the company can do: it cannot, for example, indemnify a director against a pecuniary penalty order, or pay a premium for cover against liability for a wilful breach of duty to the company or a contravention of sections 182 or 183.

Insurer consent and forensic appointments

Many cyber policies require the insurer’s consent before incurring certain costs or appointing particular vendors, and some maintain panels of approved forensic and legal providers. Appointing investigators without checking these conditions can jeopardise recovery of those costs. The board should confirm consent requirements immediately and coordinate vendor appointments with the insurer where required.

Avoiding voided cover

To avoid inadvertently prejudicing cover, directors should give prompt and accurate notice, comply with policy conditions, obtain consent where required, and avoid admissions of liability, settlements or ransom payments without insurer agreement. A simple decision discipline helps: before taking any material step, ask whether it needs to be notified to, or consented by, the insurer.

Remediation, communications and continuous disclosure drafting

Once the immediate response is underway, the board must manage remediation and communications in a way that rebuilds trust without creating new legal risk, a balance that sits at the heart of directors’ liability exposure.

Prioritising remediation actions

Remediation should be sequenced by risk: contain the breach, restore critical systems securely, and address the vulnerabilities that allowed the incident. Significant remediation decisions, including any compensation or customer support measures, should be approved at the appropriate level and documented. The board should ensure management’s remediation plan has realistic timelines and clear accountability.

Drafting customer communications

Customer communications must balance transparency with legal accuracy. Notifications should explain what happened, what information was affected, what the company is doing, and what steps individuals can take to protect themselves. Where the NDB scheme applies, statements must contain the content required under the Privacy Act. Communications should be factually accurate, avoid speculation, and be reviewed by legal counsel before release.  Customer communications are routinely relied on in later class actions and regulator proceedings, as the Optus, Medibank and Latitude litigation shows.

Preparing shareholder and market announcements

For listed entities, market announcements must satisfy continuous disclosure obligations and be consistent with customer and regulator communications. Inconsistent messaging across channels is a significant risk. Announcements should be factual, measured and updated as the position develops, and the board should document the materiality assessment underpinning each disclosure decision.

Using external communications counsel

Complex incidents often warrant external public relations and legal communications support. External counsel can help manage reputational risk while ensuring statements do not create legal exposure. The company secretary should help coordinate between legal, communications and management so that all external statements are consistent and approved.

Board governance and preventing future liability

The final dimension is forward-looking: embedding the lessons of the incident into governance so that the board is better prepared and better protected in future. Regulators increasingly expect boards to demonstrate continuous improvement in cyber resilience.

Updating risk registers and cyber policies

After an incident, the board should ensure the risk register is updated to reflect the vulnerabilities exposed, and that cyber policies, including the incident response plan, are revised in light of what went well and what did not. A post-incident review should be documented and its recommendations tracked to completion.

Board-level cyber literacy and reporting cadence

Cyber security governance for boards depends on directors having sufficient literacy to challenge management effectively. Boards should establish a regular reporting cadence on cyber risk, ensure metrics are meaningful, and invest in director education so that oversight is informed rather than nominal.

Embedding remediation into board oversight

Remediation commitments made during an incident must not lapse once the immediate crisis passes. The board should maintain oversight of remediation delivery, require progress reporting, and hold management accountable for completion.

When to consider independent reviews

For significant incidents, an independent review of the response and of the company’s broader cyber resilience can strengthen governance and demonstrate good faith to regulators. A follow-up board agenda over the next 6 to 12 months should include post-incident review outcomes, remediation status, updated risk assessments, policy revisions and director training.  Boards should also be aware that the Cyber Incident Review Board established under the Cyber Security Act 2024 (Cth) may conduct no-fault reviews of significant incidents and can require information to be provided.

Comparison table: notification triggers and obligations

Conclusion: next steps for the board

Managing director duties and liability after a cyber breach comes down to a disciplined, documented and parallel response: discharge your statutory duties under sections 180 to 184, assess every notification trigger together, preserve evidence and privilege, engage your insurer promptly, communicate accurately, and reform governance so the next incident is handled better. The directors who fare best are not those who avoid incidents entirely (that is rarely possible), but those who can demonstrate a reasoned, well-documented process at every stage. Prepare now, before a breach occurs, by stress-testing your incident response plan, confirming your insurance coverage and ensuring your board papers and minute-keeping are fit for scrutiny. Where the facts are complex or the stakes are high, obtain tailored legal advice early.

Sources

1. Office of the Australian Information Commissioner, Notifiable Data Breaches
2. Australian Cyber Security Centre (ACSC)
3. Australian Securities and Investments Commission (ASIC)
4. ASX, Continuous Disclosure and Listing Rules
5. Corporations Act 2001 (Cth) and Privacy Act 1988 (Cth), Federal Register of Legislation
6. Cyber Security Act 2024 (Cth) and Security of Critical Infrastructure Act 2018 (Cth), Federal Register of Legislation
7. ASIC v FIIG Securities Ltd [2026] FCA 92; ASIC v RI Advice Group Pty Ltd [2022] FCA 496
8. Australian Information Commissioner v Australian Clinical Labs Ltd (No 2) [2025] FCA 1224
9. Robertson v Singtel Optus Pty Ltd [2023] FCA 1392; Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58
10. McClure v Medibank Private Ltd [2025] FCA 167; Medibank Private Ltd v McClure [2026] FCAFC 38
11. APRA Prudential Standards CPS 234 Information Security and CPS 230 Operational Risk Managemen