Skip to main content
Bell & Senior Logo
(07) 5532 8777
Book Now

Technology & Cyber Risk Law FAQs

Technology & Cyber Risk Law FAQs. Guidance for startups, software companies, and e-commerce businesses on legal compliance, cyber risk management, and

Important Legal Disclaimer

The information provided on this page is general legal information only and is not specific legal advice tailored to your individual circumstances. Laws change regularly and every situation is unique.

We strongly advise you to contact us to discuss your specific situation before proceeding with any action based on the information provided here.

Artificial Intelligence

AI Hallucination and Fake Case Citations: What Every Australian Litigant Must Know
AI tools regularly fabricate case citations. Relying on fake cases in court can lead to professional misconduct for lawyers or contempt of court for litigants.
Read full article

Can Uploading Documents to ChatGPT Destroy Legal Professional Privilege?
Yes. Uploading a privileged document to a public AI tool may act as a waiver of privilege because it breaches the requirement of confidentiality.
Read full article

Does Talking to ChatGPT Attract Legal Professional Privilege in Australia?
No. AI tools are not lawyers, and communications with them lack the necessary confidentiality and professional relationship required for legal privilege in Australia.
Read full article

Who Owns AI Generated Content in Australia?
No one. Australian copyright law requires a human author. Content generated entirely by AI from a single prompt is not protected by copyright.
Read full article

Your Rights When an Algorithm Makes a Decision About You in Australia
New transparency laws from December 2026 will force organisations to explain automated decisions, but a general right to human review does not yet exist.
Read full article

What is the difference between an AI chatbot and an autonomous AI agent?
While AI chatbots respond to user prompts under human supervision, autonomous AI agents are designed to execute multi-step real-world actions independently to achieve a goal.
Read full article

Can I use AI to write legal documents or arguments in Australia?
AI tools like ChatGPT can assist with drafting legal documents, but they regularly fabricate case names, citation numbers, and legislative sections that do not exist — a phenomenon called ‘hallucination’. Every AI-generated legal reference must be independently verified by a qualified Australian lawyer before use.
Read full article

Aviation

Are FPV Goggles, Night Flying and Beyond-Visual-Line-of-Sight Flights Legal?
Are FPV goggles, night flying and beyond-visual-line-of-sight flights legal? These features and flight styles raise additional legal and safety questions; do not assume that a capable drone makes the operation permitted. Standard CASA rules include visual-line-of-sight and daylight/visibility requirements, while advanced operations may require a different authorised framework.1 What do these terms mean? FPV means first-person view: the pilot sees the drone camera feed through goggles or a display. Night flying means operating outside daylight conditions. Beyond visual line of sight (BVLOS) means flying where the operator cannot directly see the drone.
Read full article

Can I Fly a Drone for My Business or Social Media?
Can I fly a drone for my business or social media? Possibly, but a flight connected with work, marketing or commercial benefit must be assessed differently from a purely recreational flight. Business use may trigger CASA registration, accreditation, licensing, operator-certificate or approval requirements depending on the aircraft and operation.1 Why purpose matters A drone flight can be connected to business even where no separate drone fee is charged. Common examples include real-estate images, construction progress, business advertising, venue promotion, paid creator content, inspections and an employee filming for their employer.
Read full article

Can I Fly a Drone Near an Airport or Helicopter Landing Site?
Can I fly a drone near an airport or helicopter landing site? You should not assume that a flight near an airport, heliport or helicopter route is permitted. CASA’s restrictions depend on the aerodrome, the drone’s weight and the proposed location, including protected approach and departure paths. Check CASA’s current airport guidance and mapping immediately before flight.1 Airports create a serious collision risk A drone can be difficult for a pilot to see and may cause serious consequences if it interferes with a manned aircraft. That risk is not limited to large airports. Helicopters can operate at low altitude and may be responding to medical, police, rescue or fire emergencies.
Read full article

Can I Fly a Drone Over Beaches, Parks or Crowds?
Can I fly a drone over beaches, parks or crowds? Often, the safest answer is no unless the location and conditions clearly allow a compliant flight. Beaches, public parks, sporting grounds, events and tourist areas can raise CASA safety restrictions, populous-area concerns, local land-manager conditions and privacy issues.1 A public place is not automatically a drone location A park or beach may be public, but it can still be unsuitable for flight. People may be nearby, an event may be occurring, aircraft may operate in the area, or the land manager may have conditions about take-off, landing or commercial filming.
Read full article

Do I Need a Licence to Fly a Drone in Australia?
Do I need a licence to fly a drone in Australia? Not every drone flight requires a Remote Pilot Licence, but some operations require operator accreditation, registration, a RePL, a ReOC or another CASA authorisation. The correct answer depends on the aircraft, purpose, location and nature of the proposed flight.1 ‘Licence’ can mean several different things People commonly say they need ‘a drone licence’. CASA uses distinct concepts, each with a different function. The important question is not simply whether you own a drone, but what operation you intend to conduct.
Read full article

Do I Need to Register My Drone in Australia?
Do I need to register my drone in Australia? It depends on why and how you fly it. Drone registration requirements can apply to certain operations undertaken for business or as part of employment, including flights in CASA’s excluded categories. Recreational flyers must still comply with safety and airspace rules even where registration is not required.1 Registration is not the same as a licence ‘Registration’ is often used as shorthand for several different aviation requirements. They are not interchangeable. An operator may need an Aviation Reference Number (ARN), operator accreditation, drone registration, a Remote Pilot Licence (RePL), a remotely piloted aircraft operator’s certificate (ReOC), an approval, or a combination of these depending on the operation.1
Read full article

What Are the CASA Rules for Recreational Drone Flying?
What are the CASA rules for recreational drone flying? Recreational drone flying is subject to CASA safety rules even if the drone is small and the flight is only for fun. The standard rules focus on avoiding hazards to aircraft, people and property, and on operating within conditions that allow the pilot to remain in control.1 The standard rules are a starting point CASA’s recreational guidance includes keeping the drone within visual line of sight, flying no higher than 120 metres above ground level, keeping clear of people not involved in the flight, flying only in appropriate daylight and visibility conditions, and not creating a hazard.1
Read full article

What Happens If I Break Drone Rules in Australia?
What happens if I break drone rules in Australia? CASA can investigate suspected non-compliance, and the outcome depends on the nature and seriousness of the conduct. A complaint or inquiry is not proof that a breach occurred, but drone operators should take any incident, aviation-safety concern or regulator contact seriously.1 CASA’s role CASA regulates drone operations under the civil aviation framework. Its safety rules are designed to protect other aircraft, people and property. A suspected breach may come to attention through a report from the public, an airport or venue, emergency personnel, a land manager, footage posted online or other evidence.1
Read full article

What Privacy Rules Apply When Filming With a Drone?
What privacy rules apply when filming with a drone? A flight that meets aviation rules can still create privacy, surveillance, property-access or publication risks. The legal position depends on what is recorded, where the drone is operated, whether people or private spaces are the subject, whether sound is captured, and whether the footage is used personally or by an organisation.1 Aviation permission is not recording permission CASA regulates aviation safety. It does not provide a general permission to record people, homes, workplaces, events or private activity. A drone operator must separately consider privacy, surveillance, land access, contractual terms and the consequences of publishing footage.
Read full article

Can I Fly a Drone on the Gold Coast?
Can I fly a drone on the Gold Coast? Yes, but only if the proposed flight complies with CASA’s current drone rules and any applicable airspace restrictions. A drone may be small, but it is an aircraft for regulatory purposes. Before flying, check CASA’s current guidance and the relevant airspace map or app. For recreational operations, CASA’s standard rules generally require you to fly safely, keep the drone in visual line of sight, remain below 120 metres above ground level, stay at least 30 metres from people not involved in the flight, avoid flying over populous areas, and avoid emergency operations.1
Read full article

Compliance

How do I manage the legal risks of using Artificial Intelligence (AI)?
Using AI (like ChatGPT) in business creates risks regarding confidentiality, copyright ownership, and automated decision-making bias. Businesses should imple…
Read full article

Who is legally liable if an autonomous AI agent causes harm or commits a cyber offence in Australia?
Under Australian law, an AI agent is not a legal person. Liability for its actions rests with the human operator or the software developer, depending on intention, control, and duty of care.
Read full article

Does my business need a Cybersecurity Policy?
While not every business is legally required to have a written policy, the Notifiable Data Breaches (NDB) scheme makes it practically essential. If you handl…
Read full article

Does my business need a Privacy Policy?
Under the Privacy Act 1988 (Cth), you legally must have a compliant Privacy Policy if your annual turnover is over $3 million, OR if you are a health servi…
Read full article

Contracts

What are the key terms in a SaaS Service Agreement?
Software-as-a-Service (SaaS) agreements differ from traditional software licences. Key terms include Uptime Service Level Agreements (SLAs), detailed data se…
Read full article

Who owns the software code my developer writes?
It depends. If the developer is an employee, the company usually owns the code. If the developer is a freelancer/contractor, they retain ownership of the…
Read full article

What terms are required for an E-commerce website?
An e-commerce store needs more than just a list of products. Legally robust Terms and Conditions must cover Australian Consumer Law (ACL) refund rights, clea…
Read full article

Crypto & Digital Assets

Is Cryptocurrency legal in Australia?
Yes, cryptocurrency is legal in Australia. However, it is not considered ’legal tender’. It is treated as an asset for tax purposes and is subject to strict …
Read full article

What are the legal options if I am scammed in a Crypto transaction?
Crypto scams are highly complex because transactions are irreversible. Legal recourse includes reporting to ASIC and the AFP, seeking ‘Freezing Orders’ again…
Read full article

How are NFTs (Non-Fungible Tokens) treated under Australian law?
NFTs are generally treated as ‘intellectual property’ or ‘collectibles’ for tax purposes in Australia. However, the law focuses on the ‘underlying rights’ (l…
Read full article

Cyber Insurance

Why are cyber insurance claims being denied in Australia?
Insurers are increasingly denying claims due to ‘misrepresentation of controls’. This happens when a business claims to have security measures like multi-fac…
Read full article

MFA 'Available' vs 'Enforced': What does my insurer require?
Insurers now distinguish between having Multi-Factor Authentication (MFA) available and having it strictly enforced. To be ’enforced’, MFA must be mandatory …
Read full article

Cyber Risk

When must my business report a ransomware payment under Australian law?
Under the Cyber Security Act 2024, businesses with an annual turnover exceeding $3 million must report any ransomware payment made to the Australian Signals …
Read full article

What should I do if my business suffers a data breach?
Act immediately. Under the Notifiable Data Breaches (NDB) scheme, if a breach is likely to result in serious harm, you must notify the OAIC and affected indi…
Read full article

What is ransomware and what are my legal options if attacked?
Ransomware is malicious software that encrypts your data and demands payment for decryption. Paying a ransom is not illegal in Australia (yet), but it may fu…
Read full article

What is business email compromise (BEC) and how can I protect my business?
Business Email Compromise (BEC) is a sophisticated scam where attackers impersonate executives, suppliers, or lawyers to trick employees into transferring fu…
Read full article

What are my legal obligations under Australia's cyber security laws?
Australian cyber security obligations vary by sector but generally include the Privacy Act 1988, the Security of Critical Infrastructure Act 2018, and indust…
Read full article

How should my business conduct a cyber risk assessment?
A cyber risk assessment identifies your critical assets, potential threats, existing vulnerabilities, and the likely impact of a breach. It should include da…
Read full article

Cyber Security

What is Essential Eight Maturity Level 2?
Essential Eight Maturity Level 2 is a compliance tier defined by the Australian Signals Directorate (ASD). It requires businesses to have managed, semi-autom…
Read full article

How do I spot a scam email or text message?
Trust your instincts. If an email or text feels wrong, even slightly, pause before clicking any links. Scammers now use AI to craft highly personalised message…
Read full article

General Questions

Are Software Developers Independent Contractors or Employees in Australia?
Whether a developer is an employee or an independent contractor turns on the real working arrangement, not just the label on the invoice. An ABN alone does not make someone a contractor, and calling the relationship a contract does not prevent a later finding that it was employment. The consequences extend beyond wages to sham contracting penalties, payroll tax, superannuation and who owns the intellectual property the developer creates. The legal test In CFMMEU v Personnel Contracting Pty Ltd [2022] HCA 1, the High Court held that where the relationship is wholly in a written contract, the contract’s terms are central to whether a worker is an employee. That decision focused attention on the written terms where a comprehensive contract existed.
Read full article

Do I need a written employment contract for every employee in Queensland?
While the Fair Work Act 2009 (Cth) does not explicitly mandate a single written document, failing to execute a written contract creates immense legal exposure. Without a written agreement, the terms of employment default to the applicable modern award and the National Employment Standards. A written contract allows a startup to set lawful terms beyond the minimum, including confidentiality obligations, post-employment restraints of trade, and crucially, express intellectual property assignment clauses to ensure the startup owns the code its developers write.
Read full article

Does the Privacy Act apply to my startup's web scraping?
Web scraping personal information must comply with the Privacy Act 1988 (Cth) unless an exemption applies. While a small business exemption currently exists for entities with a turnover under $3 million, startups that ’trade in personal information’ lose this exemption entirely. Furthermore, scraping copyrighted data to train AI models without a licence may constitute infringement under the Copyright Act 1968 (Cth), as Australia lacks a broad fair use exception for text and data mining.
Read full article

Who Owns the Copyright in AI-Generated Code in Australia?
Australian copyright requires a human author who exercised independent intellectual effort, and that requirement decides whether code produced with AI help is protected and who owns it. Where the code is the product of a computer system without an identifiable human author, it may not attract copyright at all. This page expands the existing guidance to explain the human authorship test, what it means for AI-assisted code and how ownership differs between employees and contractors.
Read full article

Will a restraint of trade clause prevent my lead developer joining a competitor?
Post-employment restraints are only enforceable in Queensland if they go no further than is reasonably necessary to protect a legitimate business interest, such as trade secrets or highly confidential algorithms, following the High Court in Stenhouse v Coleman. Because courts will strike out an unreasonable restraint entirely, startups must use cascading restraint clauses providing multiple alternative periods and geographic scopes. Utilizing a garden leave clause during the notice period is often a more effective immediate protection.
Read full article

Do I Need to Register Copyright in Australia?
You do not need to register copyright in Australia to own it, and paying a private service does not create rights. Copyright arises automatically, but you still need a way to prove ownership if a dispute arises. This page expands the existing guidance to explain how rights arise, what evidence helps, when US registration is worth considering and which other rights do require registration. No registration in Australia Australia has no copyright registration system. Copyright arises automatically when an original work is created in material form by a qualified person (s 32). That means the moment you write the song, save the code or export the video, you have rights without filing anything with IP Australia or any other register.
Read full article

Intellectual Property

How do I protect my business intellectual property (IP)?
IP protection depends on what you are protecting. ‘Copyright’ (creative works/code) is automatic. ‘Trademarks’ (brand names/logos) must be registered with IP…
Read full article

Can I use AI-generated content commercially?
Under current Australian law, AI-generated content (like text from ChatGPT or images from Midjourney) generally does not receive copyright protection because…
Read full article

How does Australia's safe harbour law protect online platforms?
Australia’s safe harbour provisions protect service providers from copyright infringement liability for user-uploaded content. However, unlike the United States’ broad protections, Australia’s safe harbour is narrower, leaving many online platforms and commercial websites in a legal grey area.
Read full article

Privacy

Data breaches: when Australian businesses must notify
Ransomware locks your files, or a laptop goes missing from a car, or an email with client spreadsheets lands in the wrong inbox. What happens next is governed by law, not discretion. Under the Notifiable Data Breaches scheme, businesses caught by the Privacy Act 19881 (Cth) must assess suspected breaches on a 30-day clock and notify when serious harm is likely. Silence is now one of the most expensive options available23.
Read full article

Is recording a phone call legal in Queensland?
Few technology questions generate more confusion than this one. The short answer for Queensland: recording a phone call that you are taking part in is lawful, whether you tell the other person or not - but the moment you involve conversations you are not part of, or publish what you captured, different and harsher rules apply12. The rule that matters: section 43 The starting point is the Invasion of Privacy Act 1971 (Qld). Section 43 deals with the use of listening devices in relation to private conversations. Its effect, simplified:
Read full article

Are smart glasses and recording sunglasses legal to use in Queensland?
Queensland has no general optical surveillance law. The Invasion of Privacy Act 1971 (Qld) covers audio only. Section 227A of the Criminal Code 1899 (Qld) is narrow: it applies only to private places and private acts. In most public and semi-public settings, smart glasses and camera sunglasses are not prohibited by any Queensland statute.
Read full article

Can a business ban Meta Ray-Bans or smart glasses on their premises?
A business can impose premises rules on recording devices, but a blanket ban on smart glasses risks indirect discrimination under the Disability Discrimination Act 1992 (Cth) where those glasses are used as assistive technology. Businesses need a carefully drafted, case-by-case policy rather than a blanket prohibition.
Read full article

Do smart glasses that use facial recognition breach the Privacy Act in Australia?
Facial geometry data captured by AI smart glasses is likely to constitute sensitive biometric information under the Privacy Act 1988 (Cth), requiring explicit consent for collection. Businesses deploying smart glasses for identification, staff monitoring, or customer analytics must comply with all Australian Privacy Principles and meet a higher consent threshold than for ordinary personal information.
Read full article

What is the federal statutory tort for serious invasions of privacy and how does it apply to smart glasses?
Since 10 June 2025, Australia has had a statutory tort for serious invasions of privacy under the Privacy Act 1988 (Cth). Any person, not just businesses, can be sued for intentional or reckless invasions of privacy that are serious and for which there is a reasonable expectation of privacy. Using smart glasses to identify a stranger or track their movements is a strong candidate.
Read full article

What privacy rights apply when my doctor uses AI note-taking in a consultation?
Your health information is ‘sensitive information’ under the Privacy Act 1988 (Cth), attracting the highest level of protection under the Australian Privacy Principles. You are entitled to ask your doctor whether AI consultation notes are stored in Australia, whether the data is used to train the AI, and who else can access it.
Read full article

Risk Management

Does my business need Cyber Insurance?
Cyber Insurance is no longer ‘optional’ for businesses handling customer data. A standard business policy rarely covers data breach notification costs, ranso…
Read full article

Security

What are the legal risks of Cloud Computing and Data Hosting?
The primary legal risks include ‘Data Sovereignty’ (where your data is physically stored), provider lock-in, and the limitation of liability in standard clou…
Read full article

Can't find what you're looking for?

Contact Us
Call Us Book Time