Under the Privacy Act 1988, an entity that becomes aware of an actual or suspected eligible data breach must assess it and notify as soon as practicable, and in any case within 30 days of becoming aware.

The threshold is a different one. The Privacy Act asks whether personal information was compromised in a way likely to result in serious harm to individuals. The SOCI Act asks whether a cyber security incident had a relevant impact on a critical infrastructure asset. The same intrusion can trigger one, both, or neither — and answering one question does not answer the other.

They do not substitute for each other and the guidance says so explicitly. The 30-day Privacy Act assessment period does not replace SOCI incident reporting; the regimes run in parallel and do not satisfy each other.

This is the clearest instance in the database of the same event being reported separately to separate bodies because the questions differ — which is a real reason, and is also the reason this site normally proposes one lodgement and internal distribution rather than one question. See One incident, five reports, four regulators, and the law says none of them counts for the others.