To report cyber incidents, please contact the responsible body below. Other reporting obligations may apply in your jurisdiction. It is the responsibility of providers to ensure they are aware of, and meeting, their reporting requirements with state and territory cyber security agencies. 

Office of the Australian Information Commissioner (OAIC)

Notifiable Data Breach scheme

An institution that is covered by the Privacy Act 1988 needs to notify the OAIC if a data breach has occurred, along with any individuals who may be at risk of serious harm.

Australian Signals Directorate (ASD)

Single Reporting Portal

Under the Security of Critical Infrastructure Act 2018 and the Cyber Security Act 2024 it is mandatory for a university to report certain cyber incidents to the ASD.

Other cybercrimes, cyber security incidents or vulnerabilities can be reported to the Australian Cyber Security Centre within the ASD.

Tertiary Education Quality and Standards Agency (TEQSA)

Material change notification

Providers need to notify TEQSA of incidents where there is a significant data breach and the provider may be at risk of not meeting its obligations under the Threshold Standards.

As Australia’s higher education regulator, TEQSA protects the quality and integrity of the Australian higher education sector and expects providers to manage sensitive information, such as intellectual property, research data and personal details, responsibly. This includes establishing and enacting measures to identify and manage cyber security risks.

Higher Education Standards Framework provisions

Under the Higher Education Standards Framework (Threshold Standards) 2021, providers are required to maintain their information security systems by: 

• ensuring that information systems and records are securely and confidentially maintained to prevent unauthorised or fraudulent access to private or sensitive information (standard 7.3.3(b))
• promoting and fostering a safe environment, including by advising students and staff on actions they can take to enhance safety and security online (standard 2.3.4)
• having a critical incident policy and readily accessible procedures (standard 2.3.5)
• taking preventative action to mitigate foreseeable risks to academic and research integrity (standard 5.2.2)
• exercising due diligence to identify, prevent and manage risks within a provider’s remit of operations (domain 6).

To ensure compliance with these obligations providers should:

• have measures in place to understand the nature of cyber threats faced by their institution. Senior management and the governing council need to stay abreast of existing and emerging threats to inform and support the whole-of-institution risk mitigation strategy
• ensure students and staff (including sessional staff) receive appropriate training on how to safeguard sensitive information and report concerns
• have appropriate policies to identify and address cyber security incidents and embed such policies effectively into daily operations
• be aware of cyber security threats associated with learning management systems (LMS), particularly if courses are delivered by a third-party provider
• take prompt action in accordance with their security and incident response plans, paying close attention to the wellbeing and safety of all affected parties.
   

Our resource, Australian higher education cyber security agencies and organisations, provides an overview of Australia’s cyber security bodies.

• Download the Australian higher education cyber security agencies and organisations placemat (PDF, 95 KB)

This page provides:

• key contacts for reporting cyber security incidents
• an overview of Australian higher education cyber security agencies and organisations
• information on TEQSA’s role and providers’ responsibilities, as they relate to information management and cyber security.

Reporting obligations may change over time. It is each provider’s responsibility to stay up to date on their cyber security and compliance obligations.

Institutes of Higher Education and University Colleges can also access TEQSA’s cyber security e-learning modules. These modules are designed to build knowledge and awareness of cyber security in higher education, the related risks and how to mitigate them. The modules are an adaptation of resources which were developed for Australian universities by the Department of Education.