No single Australian law says "you must run security awareness training." The obligation arrives indirectly — through the Privacy Act's data-protection duties, industry regulators, framework certifications and cyber-insurance conditions — and it is easiest to meet before an incident, not after.
TL;DR
- The Privacy Act 1988 and the Notifiable Data Breaches scheme require organisations holding personal information to take reasonable steps to protect it; a workforce that cannot spot a phishing email is increasingly difficult to defend as "reasonable."
- Frameworks that effectively require training evidence: Essential Eight (for Commonwealth entities and their suppliers), SMB1001, ISO 27001 (A.6.3), PCI DSS (requirement 12.6) and APRA CPS 234.
- A regulator, insurer or client will ask for evidence: a documented cadence, per-person completion records and tested phishing response — not a promise that staff were "told to be careful."
- Privacy-sector obligations for specific industries (health, finance, telecoms) add their own expectations on staff awareness and record-keeping.
The indirect route: how training becomes a legal expectation
Australian law does not name "security awareness training" in any statute. What it does is place a duty on the organisation — to protect personal information, to maintain sound risk management, to keep client data safe — and then ask, after an incident, whether the organisation took reasonable steps to meet that duty.
A staff body that has never been trained is very hard to describe as a reasonable control. The Australian Information Commissioner's guidance under the Privacy Act expects organisations holding personal information to implement reasonable security safeguards, and after a breach the absence of basic staff training is one of the first questions asked.
That is the pattern across Australian obligations: training is not named, but its absence is noticed.
Where the requirement actually bites
Privacy Act 1988 and the Notifiable Data Breaches scheme. Organisations with turnover over $3 million (plus some others regardless of size) must take reasonable steps to protect personal information and must notify affected individuals and the regulator of eligible data breaches. The OAIC's Notifiable Data Breaches guidance sets out those duties in detail, and its breach statistics year after year show human error and compromised credentials among the leading causes — the failure modes training addresses.
Essential Eight. Mandatory at Maturity Level 2 for Commonwealth entities under the Protective Security Policy Framework, and increasingly required contractually by agencies of their suppliers. The eight strategies are technical controls, but the threat model they defend against — social engineering, as the ML1 definition makes explicit — is met in practice by security awareness training and phishing simulations.
SMB1001. The small-business certification standard widely adopted in Australia includes staff security awareness as a control requirement — certification is not achievable without it.
ISO 27001 (A.6.3). Requires organisations to ensure personnel receive appropriate security awareness education and training, with evidence of completion and regular refreshes.
PCI DSS (requirement 12.6). Requires a formal security awareness programme for any organisation handling cardholder data, with training at hire and at least every twelve months.
APRA CPS 234. Regulated financial entities must maintain an information security capability, which in practice includes staff awareness and training proportional to the information they hold.
Sector-specific privacy codes. Health, telecommunications and credit-reporting sectors carry additional privacy obligations that include how staff handle personal information.
What "reasonable steps" looks like in practice
If a regulator, insurer or client asks how you meet the duty, the answer they are looking for is not "we told staff to be careful." It is:
- a documented training programme with a defined cadence — monthly short modules, not a one-off;
- per-person completion records showing who completed what, when;
- phishing simulation results showing the programme is tested, not just delivered;
- evidence that repeat clickers receive follow-up coaching.
A platform that produces this evidence automatically — per-learner human risk reporting — is the shortest route to having it on hand when the question arrives.
A workable compliance baseline
For a small Australian business with no specific regulatory overlay, a defensible baseline looks like this:
- Assign core awareness training to all staff in month one, covering phishing, password hygiene and reporting.
- Run monthly phishing simulations so the training is tested, not assumed.
- Keep per-person records of completion and simulation results.
- Review the programme annually — or after any incident — and update content for new threats.
- Brief new starters within their first two weeks, before habits form.
That five-point baseline satisfies the practical expectations behind most Australian frameworks and gives you an evidence pack that stands up to a client questionnaire, an insurer renewal or a regulatory query. If you are unsure where your gaps sit, a cyber security gap assessment maps them against the framework that matters to you.
FAQ
Is security awareness training legally required in Australia? Not by name in any single statute. It becomes effectively required through the Privacy Act's reasonable-steps duty, framework certifications (Essential Eight, SMB1001, ISO 27001, PCI DSS) and insurer or client contractual requirements.
Which businesses must comply with the Notifiable Data Breaches scheme? Organisations with annual turnover over $3 million, plus specific categories — health providers, credit-reporting bodies, TFN recipients and others — regardless of size.
Does the Essential Eight require staff training? The eight strategies are technical controls and do not name training. The threat model they defend against — social engineering — is addressed in practice by awareness training and phishing simulations.
What records do we need to keep? Per-person completion dates, simulation results (clicks and reports), and any follow-up coaching delivered. Two to three years of history is a reasonable retention period for audit and insurance purposes.
Are phishing simulations legal in Australia? Yes, when run transparently as a training activity with a no-blame follow-up. Some states have workplace-surveillance notice requirements — brief staff that simulations exist and check the rules in your state before the first campaign.
What happens if we skip training and have a breach? Beyond the direct incident cost, an organisation that cannot show basic staff training faces harder regulatory questions, weaker insurance positioning and a more difficult client-retention conversation than one that can.
One last thing
No Australian business is fined for skipping training — they are fined, sued, or dropped by an insurer after a breach that better-trained staff would have caught. The legal duty arrives at the moment of the incident; the evidence you need to meet it has to be built before that.