Bell & Senior Logo

Technology & Cyber Risk Law FAQs

Answers about cyber incidents, data breaches, privacy compliance, intellectual property, and software contracts

Important Legal Disclaimer

The information provided on this page is general legal information only and is not specific legal advice tailored to your individual circumstances. Laws change regularly and every situation is unique.

We strongly advise you to contact us to discuss your specific situation before proceeding with any action based on the information provided here.

Compliance

How do I manage the legal risks of using Artificial Intelligence (AI)?
Using AI (like ChatGPT) in business creates risks regarding confidentiality, copyright ownership, and automated decision-making bias. Businesses should implement an ‘AUP’ (Acceptable Use Policy) that prohibits staff from inputting sensitive client data into public models and clarifies that the business, not the AI, is responsible for the final work product.
Read full article

Does my business need a Cybersecurity Policy?
While not every business is legally required to have a written policy, the Notifiable Data Breaches (NDB) scheme makes it practically essential. If you handle personal information, you must have a plan to prevent, detect, and respond to data breaches to avoid massive penalties and reputational damage.
Read full article

Does my business need a Privacy Policy?
Under the Privacy Act 1988 (Cth), you legally must have a compliant Privacy Policy if your annual turnover is over $3 million, OR if you are a health service provider, OR if you buy/sell personal information. However, Google and Apple require all apps/websites to have one regardless of size.
Read full article

Contracts

What are the key terms in a SaaS Service Agreement?
Software-as-a-Service (SaaS) agreements differ from traditional software licences. Key terms include Uptime Service Level Agreements (SLAs), detailed data security obligations, subscription renewal/cancellation mechanics, and clear definitions of ‘Customer Data’ versus ‘Derivative Data’.
Read full article

Who owns the software code my developer writes?
It depends. If the developer is an employee, the company usually owns the code. If the developer is a freelancer/contractor, they retain ownership of the copyright unless your contract contains a specific ‘IP Assignment’ clause. Paying for the work does NOT automatically transfer ownership.
Read full article

What terms are required for an E-commerce website?
An e-commerce store needs more than just a list of products. Legally robust Terms and Conditions must cover Australian Consumer Law (ACL) refund rights, clear shipping and delivery timeframes, payment security disclosures, and precise ‘Passing of Risk’ clauses to determine who is liable if goods are damaged in transit.
Read full article

Crypto & Digital Assets

Is Cryptocurrency legal in Australia?
Yes, cryptocurrency is legal in Australia. However, it is not considered ’legal tender’. It is treated as an asset for tax purposes and is subject to strict Anti-Money Laundering (AML/CTF) regulations. Businesses must also comply with Australian Consumer Law when offering digital assets or NFT services.
Read full article

What are the legal options if I am scammed in a Crypto transaction?
Crypto scams are highly complex because transactions are irreversible. Legal recourse includes reporting to ASIC and the AFP, seeking ‘Freezing Orders’ against exchanges, or civil litigation if the identity of the scammer is known. Early intervention is critical to ‘following the money’ before it is laundered through a mixer or non-KYC exchange.
Read full article

How are NFTs (Non-Fungible Tokens) treated under Australian law?
NFTs are generally treated as ‘intellectual property’ or ‘collectibles’ for tax purposes in Australia. However, the law focuses on the ‘underlying rights’ (like copyright) rather than the token itself. If an NFT provides a share in profits or voting rights, it may be regulated as a ‘Financial Product’ by ASIC.
Read full article

Cyber Insurance

Why are cyber insurance claims being denied in Australia?
Insurers are increasingly denying claims due to ‘misrepresentation of controls’. This happens when a business claims to have security measures like multi-factor authentication (MFA) or the Essential Eight implemented, but an investigation reveals they were either missing, partially implemented, or not enforced across all systems. Non-compliance with the Cyber Security Act 2024 reporting obligations can also complicate claims.
Read full article

MFA 'Available' vs 'Enforced': What does my insurer require?
Insurers now distinguish between having Multi-Factor Authentication (MFA) available and having it strictly enforced. To be ’enforced’, MFA must be mandatory for all users across all platforms (Microsoft 365, VPNs, cloud services) and, crucially, legacy authentication protocols must be disabled to prevent attackers from bypassing the MFA prompt.
Read full article

Cyber Risk

When must my business report a ransomware payment under Australian law?
Under the Cyber Security Act 2024, businesses with an annual turnover exceeding $3 million must report any ransomware payment made to the Australian Signals Directorate (ASD) within 72 hours. This reporting is mandatory regardless of whether you recover your data. Failure to report can result in significant penalties.
Read full article

What should I do if my business suffers a data breach?
Act immediately. Under the Notifiable Data Breaches (NDB) scheme, if a breach is likely to result in serious harm, you must notify the OAIC and affected individuals within 30 days. Engage legal counsel and forensic IT specialists immediately to contain the breach, assess what data was accessed, and manage your regulatory obligations.
Read full article

What is ransomware and what are my legal options if attacked?
Ransomware is malicious software that encrypts your data and demands payment for decryption. Paying a ransom is not illegal in Australia (yet), but it may fund criminal organisations and does not guarantee data recovery. Legal options include engaging incident response counsel, notifying the Australian Cyber Security Centre (ACSC), and potentially claiming on cyber insurance.
Read full article

What is business email compromise (BEC) and how can I protect my business?
Business Email Compromise (BEC) is a sophisticated scam where attackers impersonate executives, suppliers, or lawyers to trick employees into transferring funds or sensitive data. BEC is the leading cause of financial loss from cyber incidents in Australia. Protection requires employee training, payment verification procedures, and technical controls like multi-factor authentication.
Read full article

What are my legal obligations under Australia's cyber security laws?
Australian cyber security obligations vary by sector but generally include the Privacy Act 1988, the Security of Critical Infrastructure Act 2018, and industry-specific codes (such as APRA CPS 234 for financial services). Businesses must implement reasonable security measures, report certain incidents, and maintain security governance frameworks.
Read full article

How should my business conduct a cyber risk assessment?
A cyber risk assessment identifies your critical assets, potential threats, existing vulnerabilities, and the likely impact of a breach. It should include data mapping (what personal information you hold and where), technical security review, policy assessment, and third-party vendor evaluation. The assessment forms the foundation for your security improvements and regulatory compliance.
Read full article

Cyber Security

What is Essential Eight Maturity Level 2?
Essential Eight Maturity Level 2 is a compliance tier defined by the Australian Signals Directorate (ASD). It requires businesses to have managed, semi-automated security controls across eight key areas, providing protection against more persistent and slightly more sophisticated threats than ‘Maturity Level 1’. Many insurers now require Level 2 as a baseline for coverage.
Read full article

How do I spot a scam email or text message?
Trust your instincts. If an email or text feels wrong—even slightly—pause before clicking any links. Scammers now use AI to craft highly personalised messages that imitate banks, government agencies, and even your CEO. Verify requests independently by calling the organisation directly using a number you find yourself.
Read full article

Intellectual Property

How do I protect my business intellectual property (IP)?
IP protection depends on what you are protecting. ‘Copyright’ (creative works/code) is automatic. ‘Trademarks’ (brand names/logos) must be registered with IP Australia. ‘Patents’ (inventions) require registration. Confidential information is protected by Non-Disclosure Agreements (NDAs).
Read full article

Can I use AI-generated content commercially?
Under current Australian law, AI-generated content (like text from ChatGPT or images from Midjourney) generally does not receive copyright protection because it lacks a ‘human author’. While you can use it commercially, you may not be able to stop others from copying it, and you must review the AI provider’s Terms of Service.
Read full article

Do I need to register my copyright in Australia?
No. Unlike trademarks or patents, there is no official ‘Copyright Registry’ in Australia. Copyright protection is automatic the moment you create a work in a ’tangible form’ (writing it down, filming it, or saving it to disk). You do not need to apply for it or pay a fee.
Read full article

Risk Management

Does my business need Cyber Insurance?
Cyber Insurance is no longer ‘optional’ for businesses handling customer data. A standard business policy rarely covers data breach notification costs, ransomware payments, or the legal defence of privacy claims. Cyber insurance helps cover the specialist legal and forensic IT costs required to manage a breach legally.
Read full article

Security

What are the legal risks of Cloud Computing and Data Hosting?
The primary legal risks include ‘Data Sovereignty’ (where your data is physically stored), provider lock-in, and the limitation of liability in standard cloud contracts. If your provider is breached in an overseas jurisdiction, Australian privacy laws may still hold you responsible for the loss of customer data.
Read full article

Can't find what you're looking for?

Contact Us