--- title: Get ahead of privacy reforms description: Stay ahead of upcoming privacy reforms for small businesses and understand the increased legal responsibilities directors will face. Learn about the new Cyber Security Handbook and essential measures to protect customer data. image: https://afgonline-com-au-2946851.hs-sites.com/hubfs/01%20Product%20and%20Customer/01%20Customer/PM%20Update%20Images/PM_Update_privacy_reforms.png --- # Get ahead of privacy reforms [ AFG ](http://afgonline-com-au-2946851.hs-sites.com/pm-update/author/afg) 31 July 2024 12:07:06 PM ![](https://afgonline-com-au-2946851.hs-sites.com/hubfs/01%20Product%20and%20Customer/01%20Customer/PM%20Update%20Images/PM_Update_privacy_reforms.png) Big changes are coming for small business, with directors to shoulder greater legal responsibilities. The [planned removal of Privacy Act exemptions](https://www.accountantsdaily.com.au/regulation/19107-privacy-act-to-take-in-small-businesses) for small businesses means cyber attacks that access customer data could leave company directors exposed if regulators believe they have failed to take adequate steps to prevent and handle threats. Under the Corporations Act 2001, directors have a duty to act with care and diligence to guard against key business risks. While financial and legal risks have traditionally been prioritised, cyber security has now emerged as the pre-eminent threat. For small businesses, it is a particularly thorny issue as many lack the expertise and budgets of larger companies, but they may soon be held to a similar standard. To help directors of small business better understand and address their risks and responsibilities, the Australian Institute of Company Directors (AICD), in collaboration with the Australian Information Security Association, has prepared a simple guide that includes advice on low-cost risk control measures. The 20-page [Cyber Security Handbook for Small Businesses and Not-for-Profit Directors](https://www.aicd.com.au/content/dam/aicd/pdf/tools-resources/director-tools/board/cyber-security-handbook-web.pdf) explains: - the role of a director in an elevated cyber threat environment. - basic cyber security measures that should be in place. - how to develop policies to protect against but also manage potential threats, including a cyber incident response plan. Launching the handbook, AICD director and CEO Mark Rigotti said it was not uncommon for those leading small businesses to feel overwhelmed by constantly evolving risk in a high-tech space. However, not having specialised knowledge did not reduce the legal onus on directors to address risk with reasonable care and diligence. “Cyber security is one of the biggest challenges facing organisations of every size, but small organisations face an even greater challenge having to routinely juggle priorities with constrained human and financial resources,” Mr Rigotti said. The AICD handbook is a good starting point for directors of smaller entities and can be used in conjunction with the institute’s SME Directors’ cyber security checklist found [here](https://www.aicd.com.au/content/dam/aicd/pdf/tools-resources/director-tools/board/CCT-106-4-sme-and-nfp-checklist-snapshot-v1B.pdf). It is important for business leaders to bear in mind they are not expected to eliminate risk, but responsibly manage it. In 2022 the Australian Securities and Investments Commission launched its first successful prosecution of a company for failing to adequately manage cyber risk and in handing down judgement in the case [Justice Helen Rofe said](https://asic.gov.au/about-asic/news-centre/find-a-media-release/2022-releases/22-104mr-court-finds-ri-advice-failed-to-adequately-manage-cybersecurity-risks/): “It is not possible to reduce cyber security risk to zero, but it is possible to materially reduce cyber security risk through adequate cyber security documentation and controls to an acceptable level.” The new AICD-led handbook for SME directors forms part of a suite of programs aimed at bringing small businesses up to speed on cyber security ahead of [flagged changes to the Privacy Act](https://iapp.org/news/a/amending-australias-privacy-act-small-businesses-bigger-responsibilities). These education initiatives include the Federal Government’s free [cyber wardens training program](https://cyberwardens.com.au/become-a-cyber-warden/?utm_term=&utm_campaign=cwp_21239831976&utm_source=adwords&utm_medium=ppc&hsa_acc=3094450462&hsa_cam=21239831976&hsa_grp=&hsa_ad=&hsa_src=x&hsa_tgt=&hsa_kw=&hsa_mt=&hsa_net=adwords&hsa_ver=3&gad_so) for small business and the Australian Signals Directorate’s [Essential Eight](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight). At present, [most small businesses](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business#:~:text=Most%20small%20businesses%20are%20not,all%20income%20from%20all%20sources.) with turnover of less than $3 million are exempt from the Privacy Act. However, a two-year [Privacy Act Review](https://www.ag.gov.au/rights-and-protections/publications/privacy-act-review-report) completed in 2023 recommended this general exemption – granted in 2000 when SMEs posed a low privacy risk – be scrapped in light of the vast amounts of consumer information many small businesses now store digitally, along with a community expectation it be protected to a reasonable standard. The Government has [agreed in principle to this change](https://www.ag.gov.au/rights-and-protections/publications/government-response-privacy-act-review-report), however, it has stipulated it will not occur before: - consultation with the SME sector to understand compliance costs and impacts. - consideration being given to modifying obligations and providing financial support to ease the regulatory burden. - putting in place training and education programs. - mandating a transition period. Further information and resources: AICD’s [General Duties of a Director](https://www.aicd.com.au/content/dam/aicd/pdf/tools-resources/director-tools/individual/director-tool-general-duties-of-directors.pdf) and [Cyber Security Governance Principles](https://www.aicd.com.au/content/dam/aicd/pdf/tools-resources/director-tools/board/cyber-security-governance-principles-web3.pdf) [Tools & Resources](http://afgonline-com-au-2946851.hs-sites.com/pm-update/tag/tools-resources) [6 May 2024 11:45:57 AM Every brokerage should have a Cyber Security Incident Response Plan (CSIRP) ](http://afgonline-com-au-2946851.hs-sites.com/pm-update/every-brokerage-should-have-a-cyber-security-incident-response-plan-csirp) [13 August 2024 1:57:13 PM Our journey to direct lodgement is reaching the final stages ](http://afgonline-com-au-2946851.hs-sites.com/pm-update/our-journey-to-direct-lodgement-is-reaching-the-final-stages) [4 December 2023 3:08:46 PM Unwrapping cybersecurity: safeguard your business during the festive season ](http://afgonline-com-au-2946851.hs-sites.com/pm-update/unwrapping-cybersecurity-safeguard-your-business-during-the-festive-season) ## Recommended Articles [![Introducing Msquared Capital](https://afgonline-com-au-2946851.hs-sites.com/hubfs/01%20Product%20and%20Customer/01%20Customer/PM%20Update%20Images/PM_Update_introducing_Msquared.png) Introducing Msquared Capital ](http://afgonline-com-au-2946851.hs-sites.com/pm-update/introducing-msquared-capital) [![Helping your self-employed clients with NAB](https://afgonline-com-au-2946851.hs-sites.com/hubfs/01%20Product%20and%20Customer/01%20Customer/PM%20Update%20Images/PM_Update_NAB.png) Helping your self-employed clients with NAB ](http://afgonline-com-au-2946851.hs-sites.com/pm-update/helping-your-self-employed-clients-with-nab) ## Stay up to date with the latest updates View all of the latest articles to help enable you to grow and succeed as a mortgage broker with AFG. [ View all ](https://afgonline-com-au-2946851.hs-sites.com/pm-update)