← Global Privacy Laws Research Library
No. 29, 2018 (Compilation No. 9, 4 June 2026)
Security of Critical Infrastructure Act 2018
Prepared by Shubhank Suman · Last reviewed
CURRENT (amended)
- Legal character
- Statute
- Region
- Asia-Pacific
What it covers
The Act defines critical infrastructure assets across sectors including energy, communications, data storage and processing, financial services, water, health, transport and food. It creates the Register of Critical Infrastructure Assets, critical infrastructure risk management programs, mandatory cyber security incident reporting, enhanced cyber security obligations for systems of national significance, ministerial directions, and last-resort government assistance powers.
Why it matters
It is Australia's main critical-infrastructure security law, with strict deadlines for reporting significant cyber incidents.
Refer to it when
Use it when an entity may own or operate a critical infrastructure asset in Australia, or for cyber incident reporting duties.
AI, privacy and cybersecurity relevance
- AI: Low
- Privacy: Low
- Cyber: Very High
AI
LOW RELEVANCE
No AI-specific provisions.
Privacy
LOW RELEVANCE
Business-critical data and data storage assets are covered; no personal-data rules.
Cybersecurity
VERY HIGH RELEVANCE
Core critical-infrastructure cyber security law.
Applicability
Owners and operators of critical infrastructure assets in Australia.
Current validity
CURRENT. The supplied copy is Compilation No. 9 (4 June 2026). Read the official PDF on this page for the operative text.
Read first
Part 1 definitions → Part 2B → Part 2A → Part 2.
Provisions / sections covered
Part 2 – Register of Critical Infrastructure Assets
Reporting of ownership and operational information.
Part 2A – Risk management programs
Duty to adopt and maintain a program.
Part 2B – Notification of cyber security incidents
Mandatory incident reporting.
Part 2C – Enhanced cyber security obligations
For systems of national significance.
Part 3A – Responding to serious incidents
Government assistance and intervention.
Subject-matter tags
- Data breach
- Security
- Enforcement and penalties
- AI cybersecurity
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
- Privacy and Other Legislation Amendment Act 2024: AustraliaAmendment Act · Current (phased commencement)Same jurisdiction; assess applicability separately.
- Spam Act 2003Law · Current (amended)Same jurisdiction; assess applicability separately.
- Online Safety Act 2021Law · Current (amended)Same jurisdiction; assess applicability separately.
- Telecommunications Act 1997Law · Current (amended)Same jurisdiction; assess applicability separately.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.