Boards can't outsource cyber risk

In advice commissioned by BoardPro, Tay said boards often treat their IT expert as the answer to everything from artificial intelligence (AI) questions to cybersecurity concerns, while other directors switch off when the topic comes up.  

She said every director has a responsibility to understand enough to question managers and the experts the board brings in. 

Her views are backed by the latest data breach figures, which continue to rise. The Office of the Australian Information Commissioner (OAIC) received 1,205 data breach notifications in 2025, up 8 per cent on 2024 and the most since mandatory reporting began in 2018. Most (716) were caused by malicious or criminal activity, and health service providers – many in the NFP sector – were the most affected, with 225 notifications. 

Privacy Commissioner Carly Kind said the data breach threat to organisations was substantial and rising every year, and she noted that her office’s research identified data breaches as the top perceived privacy risk for Australians, with 82% of Australians concerned about the issue. 

Tay spent 30 years as a commercial lawyer before taking up board roles across government and the not-for-profit sector. She is a director of Community Housing Canberra and a council member at the University of Canberra, and she was awarded the Medal of the Order of Australia (OAM) in 2025. 

Organisations cannot escape risk 

Tay said the information not-for-profits collect to serve their communities, such as donor records, client files, and bank and credit card details, is valuable to criminals, who can resell it or hold it to ransom. 

"Short of working within a closed system, no organisation is immune irrespective of how secure the IT systems are." 

Larger organisations that pay a ransom must now report it. Since May 30, 2025, the Cyber Security Act 2024 has required organisations with annual turnover above $3 million to report ransomware or cyber extortion payments to the Australian Signals Directorate (ASD) within 72 hours. 

Not-for-profits with annual turnover above $3 million, along with private health service providers, must secure personal information under the Privacy Act 1988 and comply with the Notifiable Data Breaches (NDB) scheme. Tay said it is good practice for every organisation to do so, even when the Act does not apply. 

Her simplest advice is to hold less data. Boards of organisations should consider what data is kept, why it is needed, and for how long, and whether there are alternatives to holding the data. She suggests using a third-party payment gateway, for example, so to avoid the need to store credit card details. 

Boards must also keep up with changes in laws and regulations. From 10 December 2026, organisations covered by the Privacy Act must explain in their privacy policy their use of computer programs to make or inform decisions that significantly affect people's rights or interests. The OAIC has published guidance and fact sheets to help organisations comply. 

Questions boards should be asking 

There is no shortage of alarming case studies that act as warnings to the unwary, such as the 2022 Medibank breach that exposed the details of 9.7 million people. In proceedings that remain before the Federal Court, the OAIC alleges Medibank failed to protect clients by employing multi-factor authentication (MFA) on its virtual private network (VPN). 

Tay said directors of smaller organisations should ask: 

• Would we know quickly if someone broke into our systems? 

• Are software updates and security patches applied promptly? 

• Who can access what, and who can change system settings? 

• Does our cyber insurance match our risk? 

Tay said people are often the weak point, so boards should also check what cyber training staff receive and how many take part. 

Plan the response before it's needed 

Tay said boards should have a crisis plan ready that sets out roles and responsibilities, how the organisation will communicate with affected people, staff, funders and other stakeholders, how systems will be restored, and how to reach the insurer. Some insurance policies include help with ransom demands and negotiations, she said.  

Organisations covered by the NDB scheme must alert affected people and the OAIC as soon as they are able if a breach is likely to cause serious harm. The OAIC has published a quick reference guide to help. 

Tay said the consequences for directors depend less on the attack than on the board's handling of it. 

"Reputational damage and actions for regulatory breaches (whether against a director personally or the organisation) do not occur simply because you have had a cybersecurity incident. They are more likely because of how you have dealt with prevention, responded and remediated." 

Since 2018, the regulator has changed its focus from simply reminding organisations of their obligations to enforcing the law. In 2025, the Federal Court ordered Australian Clinical Labs to pay a penalty of $5.8 million over a data breach, the first civil penalty ever ordered under the Privacy Act, in a sign of tougher action by the regulator. 

Board papers are a target too 

David Renwick, BoardPro's head of marketing, said the board's own records need the same protection. 

"Your board holds some of your organisation's most sensitive information: donor records, funding agreements, and confidential decisions," he said. 

"A breach can shake the trust of the participants and funders your mission depends on." 

Renwick said those concerns were behind BoardPro’s approach of keeping data onshore, at secure Microsoft Azure data centres in New South Wales, with backups in Victoria, covered by internationally recognised Microsoft certifications. 

He said data is copied between the two sites in real time, preventing a single outage from destroying records. He said data remains encrypted when being stored or moved. 

And he said each login required a one-time code and password, with repeated failed attempts blocking access. He said BoardPro enabled boards to keep sensitive papers in “board-only” folders, to provide staff and administrators different levels of access, and to remove a director's access as soon as they left the position. 

This article is largely based on advice commissioned by BoardPro, a Community Directors partner. 

← Back to the newsletter

More information 

Office of the Australian Information Commissioner (OAIC) 

Australian Signals Directorate (ASD) Essential Eight framework 

Further advice on improving digital access and security

Community Directors hosts thousands of pages of free guidance, such as this help with your tech: Damned Good Advice on Cybersafety and Fraud Prevention | 10 questions every board member needs to ask about cybersecurity | Preparing a technology plan for your organisation | Cybersecurity policy | Data retention and destruction policy | More help with tech | More help with artificial intelligence

Find more resources under tools and resources on the Community Directors website.