A Hacked Website Is Now a Compliance Problem

27 October 2026/, ,

WordPress security series · Part 5 of 5

For years, a hacked website was treated as an IT embarrassment. Fix it, apologise, move on. For a growing number of Australian businesses, that is no longer how it works.

Does the Privacy Act apply to you?

$3 million
turnover threshold for Privacy Act coverage
30 days
to assess a suspected data breach
10 Dec 2026
new automated decision-making rules commence

The Privacy Act 1988 generally covers businesses with an annual turnover above $3 million. Smaller businesses are covered too if they fall into certain categories, including health service providers and businesses that trade in personal information. The OAIC keeps the full list.

If your website collects names, emails, phone numbers, bookings or payments, it holds personal information. If the site is compromised, that information may be exposed.

What the law expects after a breach

Under the Notifiable Data Breaches scheme, a covered business that suspects a breach must take all reasonable steps to assess it within 30 days. If the breach is likely to cause serious harm, you must notify the people affected and the OAIC as soon as practicable.

That means you need to know what happened, what data was involved and when. A website with no monitoring, no logs and no clean backup makes those questions very hard to answer.

Another change lands on 10 December 2026

From 10 December 2026, new transparency rules for automated decision-making apply. If a computer program uses personal information to make, or substantially help make, decisions that could significantly affect people, your privacy policy will need to say so. Online forms, chatbots and AI tools on your site are worth reviewing before then.

What to have ready

  • A list of the personal information your website collects and where it is stored.
  • Monitoring that would tell you if the site was compromised.
  • Logs and backups that let you work out what happened.
  • A short plan for who does what if a breach happens.

This is general information, not legal advice. Talk to your lawyer about your specific obligations.

The question to ask this week

“If our website was breached last night, how would we know, and what data would be at risk?”

Next step

A Security Audit (from $1,000 inc GST) answers the technical half of that question. Mid-market firms preparing for December should read What a Fractional CTO Actually Is.

Call 1300 856 393

Common questions

My business turns over less than $3 million. Am I covered?
Possibly not, but check. Health service providers, businesses that trade in personal information and several other categories are covered regardless of turnover. The OAIC website lists them.
What counts as serious harm?
It can include financial, emotional, physical or reputational harm to the people whose information was exposed. The OAIC has guidance on assessing it. When in doubt, get advice early.
What is automated decision-making?
Using a computer program to make, or substantially help make, decisions about people using their personal information. Rules requiring businesses to disclose this in their privacy policy start on 10 December 2026.