The OAIC’s New Teeth: ‘Reasonable Steps’ Security and the Enforcement Uplift

For most of its life, the OAIC needed a catastrophe to act on bad security. Now it needs a shortfall. That is the whole story of the enforcement uplift, and it changes what your security posture has to be able to prove.

Australian Privacy Principle 11 has always required an entity to take reasonable steps to protect the personal information it holds. What it lacked was a proportionate way for the regulator to enforce that standard. The Office of the Australian Information Commissioner had, in practice, one serious lever and a determination process that leaned on large, demonstrable harm. That is no longer the position. The Privacy and Other Legislation Amendment Act 2024 rebuilt the enforcement machinery, and the consequence for the technology function is direct: APP 11 security is now enforceable at scale, on the regulator’s initiative, without waiting for a headline breach.

What actually changed, and when

The Act received Royal Assent on 10 December 2024, and the enforcement provisions that matter here commenced the following day, 11 December 2024. Three things happened at once.

First, the civil penalty regime was restructured into tiers. The existing flagship penalty for serious interferences with privacy — the greater of A$50 million, three times the benefit obtained, or 30 per cent of adjusted turnover for the relevant period — remains. Below it sits a new mid-tier civil penalty for interferences that are not serious, up to A$3.3 million for a body corporate, and a low-tier penalty of up to A$330,000 for specified administrative contraventions. The single blunt instrument became a graded one.

Second, the Commissioner gained infringement notice powers for certain lower-level breaches — the ability to issue a penalty directly, without applying to a court first. That is the mechanism that turns enforcement from an occasional, resource-heavy event into something that can operate routinely.

Third, and easiest to overlook, the security obligation itself was clarified. A new APP 11.3 states expressly that the reasonable steps an entity must take include technical and organisational measures. That phrasing will be familiar to anyone who has worked under the GDPR. It closes off the argument that reasonable steps might be satisfied by policy alone, or by technology alone. It is both, and it is now written into the principle.

This sits alongside the rest of the reform package — the automated decision-making transparency requirements arriving later, and the statutory tort for serious invasions of privacy that opens a separate, litigant-driven route to exposure. The security piece is the one that bites first and bites broadest, because almost every regulated entity holds personal information and almost every one of them has an APP 11 obligation.

The standard did not move. The consequence did.

It is tempting to read this as a tougher security standard. It is not, really. Reasonable steps was already the test, and reasonableness was always meant to scale with the sensitivity of the data, the harm that would follow from its loss, and the practicability of the control. What changed is that a gap between the standard and your actual controls now has a price attached that the regulator can levy on its own initiative.

Under the old arrangement, the practical question a board asked was: how likely is it that a breach large enough to trigger the regulator will happen to us? Under the new one, the question is different: if the OAIC looked at our controls tomorrow, absent any breach at all, could it conclude our steps were not reasonable and act on that conclusion directly? Those are not the same risk calculation, and the second one is far less forgiving of a security posture that has been described but never demonstrated.

This is the same shift that regulated firms in Europe felt when NIS2 enforcement acquired teeth: the supervisor stops asking whether something went wrong and starts asking whether your controls were adequate in the first place. A best-efforts narrative survives the first question. It does not survive the second.

Narrative versus evidence

Most organisations have a security story. It is usually true in outline and vague in the particulars. We encrypt sensitive data. We restrict access. We patch. We train our people. Each of those is a claim about a class of control, not evidence that the control exists, operates, and covers the data it is supposed to cover.

The uplift makes the particulars the point. Reasonable steps for a given data holding is not an abstraction; it is a specific, defensible set of measures matched to what that holding actually is. Which system holds it. How sensitive it is. Who can reach it and why. What happens when someone who should no longer have access leaves. Whether the encryption claim covers the backups and the analytics copy, or only the primary store. Whether the access restriction is enforced by configuration or merely by policy that no one checks.

The organisational half of APP 11.3 is where firms are weakest, because it is the least visible. Technical controls at least leave logs. Organisational measures — the access review that actually happens on schedule, the joiners-movers-leavers process that revokes as reliably as it grants, the vendor oversight that verifies rather than trusts the third parties holding your data — tend to exist as intentions rather than as evidence. Intentions are exactly what an infringement notice does not care about.

What to build before you are asked

The work is not exotic. It is the discipline of being able to point, for each material category of personal information you hold, at the concrete steps that protect it and the evidence that those steps operate.

• A data holdings inventory that is honest about where personal information actually lives — including the copies, the exports, the analytics stores and the SaaS platforms, not just the system of record.
• A mapping from each holding to the specific technical and organisational measures that protect it, so “reasonable steps” is a documented position rather than a slogan.
• Evidence of operation — access review records, revocation logs, patch and configuration baselines, encryption coverage confirmed rather than assumed.
• Proportionality that is deliberate. The steps reasonable for a small holding of low-sensitivity data are not those reasonable for bulk health or financial records, and the difference should be a decision you can explain, not an accident of where effort happened to land.

None of this is new security work in the sense of new tooling. It is the work of making an existing posture demonstrable, holding by holding, before someone with statutory power asks you to demonstrate it. That reframing — from doing the controls to being able to evidence them — is the actual cost the uplift imposes, and it is a cost most firms have not yet paid.

The regulator no longer has to wait for your security to fail catastrophically to act on the fact that it was never adequate. A plausible story about your posture was, for a long time, enough to get by. It is not a control, and from 11 December 2024 it stopped being a defence.