The decision to hire a cyber lawyer rarely arrives as a considered question. It lands in a specific moment: a staff member reports odd activity in the email system, a ransom note appears on the server, your biggest customer sends a contract demanding notification of any security incident within 24 hours, or you close a financial year with turnover past $3 million for the first time. Each of those moments carries the same underlying question: is this now a legal problem, and do I need a lawyer to deal with it?
For most Australian SMEs the honest answer is that cyber risk became a legal problem some time ago. It is rarely just an IT issue. The moment customer data, employee records, vendor contracts or regulatory reporting is involved, the technical problem has legal consequences. Working out where your business sits, and what your obligations are, is the decision this article helps you make.
What the decision really involves
The question "should I hire a cyber lawyer?" hides a narrower one: at what point does cyber risk stop being something your IT provider handles and start being something that needs legal advice, and how early should you engage? Most businesses choose between three positions:
- Position one — treat cyber as a technical problem: Your IT provider patches, backs up and monitors, and no lawyer is involved. This works until an incident touches data, people or contracts, at which point the technical response is only part of the picture.
- Position two — react when something happens: You engage a lawyer after a breach, a ransom demand or a dispute. This is the most common approach, and it is legitimate, but it assumes you will have time to find, brief and instruct a lawyer while an incident is live and facts are still unclear.
- Position three — build cyber legal foundations early: You put the policies, contracts and response plans in place before you need them, so that when something happens the decisions are already made, or can be made quickly.
Positions two and three are not mutually exclusive. Most SMEs will end up doing both: building foundations early and calling in specialist help when an incident occurs. The real decision is about timing, and the factors below are the ones that should drive it.
Weigh up these five factors
Is your business covered by the Privacy Act?
The single biggest determinant of your cyber legal obligations is whether the Privacy Act 1988 (Cth) (the Privacy Act) applies to your business. If it does, you are bound by the Australian Privacy Principles, and you sit inside the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Act.
The starting point is the small business exemption. Under s 6D of the Privacy Act, a business with annual turnover of $3 million or less in the previous financial year is a small business operator and is generally outside the Act. The exemption is narrower than many business owners assume. Even a business under $3 million is covered if it:
- Provides health services: holds health information (other than in employee records) in the course of providing a health service.
- Trades in personal information: discloses personal information about another person for a benefit, service or advantage, or collects it on that basis.
- Works for government: is a contracted service provider for a Commonwealth contract.
- Sits in the credit system: is a credit reporting body or otherwise engaged in credit reporting.
A business is also outside the exemption if it is related to a larger entity that is not a small business. If any of these apply, the Act treats you as an organisation and the NDB scheme applies to you.
If you are covered, the NDB scheme imposes real obligations when things go wrong. An eligible data breach occurs when there is unauthorised access to, unauthorised disclosure of, or loss of, personal information held by your entity, and that access, disclosure or loss is likely to result in serious harm to any affected individual. If you have reasonable grounds to suspect an eligible data breach, s 26WH of the Privacy Act requires you to carry out a reasonable and expeditious assessment, and to take all reasonable steps to complete it within 30 days. If you then have reasonable grounds to believe an eligible data breach has happened, s 26WK requires you to prepare a statement and give it to the Office of the Australian Information Commissioner, and to notify affected individuals, as soon as practicable.
The practical point for the hiring decision is that the "we are too small for the Privacy Act" assumption fails for a surprising number of businesses. A physiotherapy clinic, a marketing agency that sells contact lists, or a subcontractor delivering services under a Commonwealth contract can all be in scope on modest revenue. If you are not sure whether you are covered, that uncertainty is itself a reason to get advice.
Would a ransomware payment trigger a 72-hour reporting clock?
Ransomware is the situation where the legal clock moves fastest. Since 30 May 2025, the Cyber Security Act 2024 (Cth) has required certain businesses to report ransomware and cyber extortion payments to the Australian Signals Directorate. Under s 27 of the Act, a reporting business entity must give the report within 72 hours of making the payment, or of becoming aware that a payment was made on its behalf.
The obligation catches more businesses than many expect. Under s 26 of the Act, a reporting business entity includes an entity carrying on business in Australia with an annual turnover for the previous financial year above the threshold prescribed by the rules, which the Cyber Security (Ransomware Payment Reporting) Rules 2025 set at $3 million. It also includes responsible entities for critical infrastructure assets. There is no minimum payment amount: the obligation is triggered by the payment itself.
The design of the scheme is worth understanding before you need it:
- Report content is limited: you only need to report information you know, or can find out by reasonable search or enquiry.
- Reports are protected: information given in a ransomware payment report cannot generally be used in evidence against your business, subject to limited exceptions for false or misleading information.
- The decision to pay is yours: the Act does not tell you whether to pay. It requires you to report if you do.
A cyber lawyer's role here is to work through the payment decision and its consequences with you: what the report must contain, how the payment interacts with your cyber insurance and your customer contracts, and what you should and should not say publicly while the incident is live. If your business has turnover over $3 million and holds any customer or employee data, the ransomware scenario is one where the cost of having advice in place is very low compared with the cost of working it out mid-incident.
What security clauses are in the contracts on your desk?
Many SMEs first encounter cyber law when a larger customer sends a contract full of security obligations. Common clauses include incident notification windows of 24 to 72 hours, requirements to maintain specified security standards, audit rights for the customer, indemnities for data loss, and liability provisions that are unlimited where privacy breaches are concerned. Signing these without understanding them transfers risk that is out of proportion to the value of the contract.
Here is the choice those contracts present:
- Option A — sign as-is: Fast, and it keeps the deal moving. But you may be committing to obligations you cannot meet, such as notifying the customer within 24 hours of an incident, when your actual detection and investigation capability takes longer. You may also be signing away liability caps that would otherwise protect the business.
- Option B — negotiate the security clauses: A lawyer can test whether each clause is achievable, align notification timeframes with what your incident response can actually deliver, cap liability at a level proportional to the contract, and make sure you are not promising more than your current systems and processes support.
The same logic applies to the contracts you sign with your own vendors. If your customer data sits with a cloud hosting provider, a payment processor or a managed IT provider, your risk is shaped by what those contracts say about minimum security standards, breach notification timeframes, subcontractor controls, data return or deletion on termination, and liability when the vendor is the cause of an incident. These are negotiation points, and they are cheaper to fix at signing time than after an incident.
What data do you hold, and who can now sue over it?
The legal environment around personal information changed materially in June 2025. Schedule 2 of the Privacy Act now gives individuals a statutory cause of action for serious invasions of privacy, commencing 10 June 2025. The tort covers two kinds of conduct: intruding upon an individual's seclusion, and misusing information relating to the individual, in each case where the individual had a reasonable expectation of privacy and the public interest in protecting privacy outweighs any countervailing public interest. The courts can award damages, grant injunctions, and order apologies.
This matters for the hiring decision because it changes who can come after you after a cyber incident. Previously, a business that mishandled personal information faced regulator attention and possibly contract claims. Now, affected individuals can bring direct court claims for misuse of their information. The tort is broader than the Privacy Act's APP regime in its application to different kinds of entities, and it is not administered by the Information Commissioner, so claims proceed through the courts. Proceedings must generally be started within one year of the individual becoming aware of the invasion, or three years of the invasion, whichever is earlier.
Assessing your exposure here starts with what you actually hold:
- Customer and marketing data: names, email addresses, phone numbers and behavioural data, even if modest.
- Identity and financial information: ID verification documents, payment details and account information.
- Health information: held by providers, but also by wellness programs, gyms and employers.
- Employee records: staff data is a frequent target and a frequent source of incidents.
If your business holds any of this, your published privacy policy and your actual practices will both be scrutinised in an incident. A lawyer can assess whether the two match, because a gap between what you say you do and what you do is a liability in its own right.
Where are you in your growth cycle?
For many startups, the cyber lawyer moment is not an incident at all. It is growth. Enterprise customers, government buyers and investors increasingly expect a baseline of cyber and privacy governance before they deal with you. Procurement security questionnaires ask about data hosting locations, access controls and authentication, employee security training, incident response and notification timelines, and audit arrangements. Investors ask whether you have a privacy policy, internal security policies, an incident response plan, and a handle on vendor risk.
The risk in this phase is answering those questionnaires in a way that overcommits. Saying yes to security commitments that your current stage cannot support turns a procurement exercise into a future breach of contract. A lawyer can help you answer accurately, align your contracts with what you have actually implemented, and build the documentation that makes due diligence and procurement smoother.
How an Artificer Legal cyber lawyer helps you decide
The value of a cyber lawyer is not limited to the moment an incident happens. An Artificer Legal practitioner would help you make this decision and act on it in three ways.
First, stress-testing the assumptions the decision rests on. The most common one is "we are under $3 million turnover, so the Privacy Act does not apply to us", which is wrong for health service providers, businesses that trade in personal information, and Commonwealth contractors. Testing that assumption is a short conversation, and it determines whether the NDB scheme applies to you at all.
Second, modelling the downside of an incident for your specific business. That means working out what a breach would actually cost you: NDB notification obligations, contract claims from customers, tort claims from affected individuals, regulator inquiries, and the question of whether your cyber insurance responds to each of those. Knowing the downside in advance is what makes the decision to invest in foundations rational rather than reactive.
Third, drafting the documents the decision leads to. That includes a privacy policy that matches what you actually do, internal security and acceptable use policies, an incident response plan, customer and vendor contract clauses that allocate risk sensibly, and a ransomware response checklist that builds in the 72-hour reporting clock. When an incident happens, these are the documents that let you respond calmly instead of improvising.
Decide before the 72-hour clock starts
The factor that separates well-handled cyber incidents from costly ones is not technical skill. It is whether the legal decisions were made before the clock started running. Once a ransom demand is on the table, a customer contract breach is alleged, or the NDB assessment clock is running, you are making decisions under pressure, with incomplete facts, and with the regulator, your insurer and your customers watching. The business that has already decided what it will do, what it will report, and what it will say is the business that comes out of the incident intact.
The thresholds worth watching are concrete. They are the year your turnover passes $3 million, the first time you hold health information or trade in personal information, the first contract with security clauses, and the first ransom demand. Each of those is a point where cyber risk stops being an IT matter and becomes a legal one, and each is cheaper to prepare for than to respond to. If you are close to any of them, the question is not whether you can afford a cyber lawyer, but whether you can afford to be without one when the incident arrives.