Cyber risk is a board issue: directors’ duties and data breaches

By the ITLAW Team · General information, not legal advice

Under section 180 of the Corporations Act 2001 (Cth), directors must exercise their powers with the care and diligence a reasonable person would exercise in their position. With data breaches and ransomware now among the most significant risks many businesses face, regulators increasingly expect cyber risk to be governed at board level, not left entirely to the IT team.

What regulators have said

In ASIC v RI Advice Group Pty Ltd [2022] FCA 496, the Federal Court found that a financial services licensee breached its licence obligations by failing to have adequate cyber security risk management systems across its network of advisers. The case was brought under licensing obligations rather than directors’ duties, but it confirmed that inadequate cyber risk management can be a legal failure, not just an operational one. ASIC has also repeatedly said that directors should treat cyber resilience as a core governance issue.

Why the stakes are rising

• Higher Privacy Act penalties for serious interferences with privacy. See our privacy law guide.
• Mandatory ransomware payment reporting within 72 hours for businesses with turnover above $3 million.
• The statutory tort for serious invasions of privacy, which creates new litigation risk for reckless conduct.
• Class actions following large data breaches.

Questions every board should ask

• What are our most valuable and most sensitive data assets, and where are they?
• Who is accountable for cyber risk, and how often does the board receive reports?
• Do we have multi-factor authentication, patching and tested backups in place?
• Do we have a tested data breach response plan?
• What do our contracts with IT providers say about security and breach notification?
• What does our cyber insurance cover, and what are its notification conditions?
• Who decides whether to pay a ransom, and on what basis?

Record the board’s engagement

If something goes wrong, the question will be what the board knew and did beforehand. Minute cyber discussions, the information considered and the decisions made. Commission periodic independent reviews and follow up on recommendations.

Frequently asked questions

Are directors personally liable for data breaches?

Directors can face liability if they fail to exercise reasonable care and diligence, including in managing foreseeable risks such as cyber security. Liability depends on the circumstances.

What did the RI Advice case decide?

The Federal Court found that RI Advice breached its financial services licence obligations by failing to have adequate cyber security risk management systems.

How often should a board review cyber risk?

There is no fixed rule, but regular reporting, at least several times a year, and review after any significant incident is common practice.