9 Protect our most valuable datasets The problem we face Data is an important source of growth for the Australian economy, helping organisations conduct transactions, make better decisions and improve their products and services. Businesses and global markets rely on the secure and free flow of data. Effective use of data helps Australian citizens get access to goods and services that are tailored to their needs. In the wrong hands, data can allow malicious actors to do us harm. It can be held for ransom and used as a tool for coercion. Mishandling of sensitive and critical datasets can cause grave damage to Australia’s national interests. Technological advancements have enabled malicious actors to develop vast data profiles on businesses, individuals and officials for intelligencegathering and commercial purposes. The Privacy Act 1988 (the Privacy Act) covers the security of personal information held by entities with an annual turnover of more than $3 million. Recent reforms to the SOCI Act and the introduction of the Hosting Certification Framework for the Australian Government were vital steps in securing Australia’s sensitive government and business data holdings. However, there is limited guidance for commercial, sensitive or critical datasets that fall outside the scope of these existing regulations. There is also no common methodology by which the private sector can assess and communicate the value of data in a standardised way. Many businesses have voiced concerns that they are required to store substantial data records for excessive periods of time, which can often be high-value targets for malicious cyber actors. Some organisations take proactive steps to protect their data holdings, but this is often done in isolation, leading to inconsistent application of security controls and creating practical barriers to data sharing. How the Government will take action While the Australian Government has frameworks in place to protect personal information, we must continue to ensure that our data settings are fit for purpose as data increasingly becomes a resource to be collected, transferred and traded. Under this initiative, the Government will: 1. Protect our datasets of national significance The Government will identify Australia’s most sensitive and critical datasets across the economy – particularly those that are not appropriately protected under existing regulations, yet are crucial to our national interests. This will allow us to assess whether existing data protections, including storage and governance settings, are proportionate and effective. Where gaps are identified that render these datasets vulnerable, the Government will explore options to better safeguard sensitive data across the economy. 2023–2030 Australian Cyber Security Strategy 31