Tools / Regulatory tracker / Security of Critical Infrastructure Act 2018: data storage and processing
Regulatory tracker · Australia · Cyber and resilience
Security of Critical Infrastructure Act 2018: data storage and processing
Data centres serving government or critical infrastructure can be critical assets with registration and reporting duties.
In force Data storage and processing assets added by the 2021 and 2022 amendments.
What it does
The rule in brief
Section 12F defines a critical data storage or processing asset: one owned or operated by an entity whose business is wholly or primarily providing data storage or processing services, used for services to government or to owners of other critical infrastructure assets. Responsible entities can be subject to the register of critical infrastructure assets, mandatory cyber incident reporting and a critical infrastructure risk management programme.
Timeline
Key dates
| Date | What happens |
|---|---|
| 2 December 2021 | First amending Act in force |
| 2 April 2022 | Second amending Act in force |
Primary sources
Read it at source
Cite as: InfraCompute regulatory tracker, “Security of Critical Infrastructure Act 2018: data storage and processing”, checked 27 October 2026, https://www.infracompute.co.uk/tools/regulatory-tracker/au-soci-act.
Related
Also on the tracker
Cyber Security and Resilience Bill
Brings data centres of 1 MW or more (10 MW for enterprise sites) under the NIS rules, with Ofcom as regulator.
United Kingdom · Cyber and resilienceData centres designated critical national infrastructure
UK data centres were designated CNI in September 2024, alongside energy and water.
European Union · Cyber and resilienceNIS2 Directive
Data centre service providers are digital infrastructure entities with cyber risk and incident reporting duties.
European Union · Cyber and resilienceCritical Entities Resilience Directive
Member States identify critical entities, including digital infrastructure, which then carry physical resilience duties.
Method
Each entry is written from the official text and the government, regulator or legislature pages listed above, never from secondary commentary. This entry is checked by hand at each content review. Status and dates can change after the review date, so check the source before relying on it. General information drawn from public filings. It is not legal advice on any transaction, and using this page does not create a lawyer-client relationship. Views are personal.
