Security of critical infrastructure Schedule 1 General amendments Part 1 (a) specified entities that are critical to the transmission of a broadcasting service; or (b) requirements for an entity to be critical to the transmission of a broadcasting service. 12F Meaning of critical data storage or processing asset (1) An asset is a critical data storage or processing asset if: (a) it is owned or operated by an entity that is a data storage or processing provider; and (b) it is used wholly or primarily to provide a data storage or processing service that is provided by the entity on a commercial basis to an end-user that is: (i) the Commonwealth; or (ii) a body corporate established by a law of the Commonwealth; or (iii) a State; or (iv) a body corporate established by a law of a State; or (v) a Territory; or (vi) a body corporate established by a law of a Territory; and (c) the entity knows that the asset is used as described in paragraph (b). Note: The rules may prescribe that a specified critical data storage or processing asset is not a critical infrastructure asset (see section 9). (2) An asset is a critical data storage or processing asset if: (a) it is owned or operated by an entity that is a data storage or processing provider; and (b) it is used wholly or primarily to provide a data storage or processing service that: (i) is provided by the entity on a commercial basis to an end-user that is the responsible entity for a critical infrastructure asset; and (ii) relates to business critical data; and (c) the entity knows that the asset is used as described in paragraph (b). Note: No. 124, 2021 The rules may prescribe that a specified critical data storage or processing asset is not a critical infrastructure asset (see section 9). Security Legislation Amendment (Critical Infrastructure) Act 2021 Authorised Version C2021A00124 37

Select target paragraph3