TCSI March Newsletter 2026

Resources are available for providers who experience a cyber security incident.

Students entrust providers with their personal information, and providers have a responsibility to handle that information carefully, securely and in accordance with the 13 Australian Privacy Principles outlined under the Privacy Act 1988.

An important part of securing your systems is preparing in advance, understanding your obligations, and knowing where to get help when responding to a cyber security incident. 

Responding to an incident is stressful, with many urgent tasks to manage at once. Your planning should consider the core reporting steps outlined below to help protect sensitive data. Other reporting obligations may apply in your jurisdiction. It is the responsibility of providers to ensure they are aware of, and meeting, their reporting requirements with state and territory cyber security agencies. 

1. Notify the Australian Cyber Security Centre (ACSC) 

Tertiary education providers should notify the ACSC in the first instance if they have been impacted by a cyber security incident. 

Cyber security incidents can be reported to the ACSC on this webpage or via the ACSC Hotline on 1300 CYBER1 (1300 292 371).

Types of incidents you should report include, but are not limited to:

• Denial of service
• Scanning and reconnaissance
• Intentional or malicious unauthorised access to network or device
• Data exposure, theft or leak
• Malicious code/malware
• Ransomware
• Phishing/spear-phishing
• Other irregular cyber activity that causes concern

The ACSC sits within the Australian Signals Directorate and is the Australian Government’s technical authority on cyber security. The ACSC offers incident response advice and assistance 24 hours a day, 7 days a week.

Through the process of reporting to the ACSC, providers can also elect to notify the National Office of Cyber Security (NOCS) for assistance with coordination of consequence management and the Australian Federal Police (AFP) for investigation of criminal activity. 

Providers should report early, even if unsure of the nature or extent of the cyber security incident, noting government authorities are bound by legislation to ensure the confidentiality of any information shared.

2. If required, notify affected individuals and the Office of the Australian Information Commissioner

Your organisation must promptly notify all affected individuals and notify the Office of the Australian Information Commissioner of any notifiable data breaches.

A notifiable data breach occurs when the following criteria are met:

• There is unauthorised access to or disclosure of personal information held by an organisation or agency (or information is lost in circumstances where unauthorised access or disclosure is likely to occur).
• This is likely to result in serious harm to any of the individuals to whom the information relates.
• The organisation or agency has been unable to prevent the likely risk of serious harm with remedial action.

The Office of the Australian Information Commissioner can be notified via their report a data breach page. For more information, please see the notifiable data breaches page.

3. Notify relevant Commonwealth tertiary education program stewards

For higher education providers this is the Tertiary Education Quality and Standards Agency (TEQSA)

Registered higher education providers must notify TEQSA via materialchanges@teqsa.gov.au of events that happen or are likely to happen that will significantly impact the provider’s ability to meet the Threshold Standards. 

For further information regarding the role of TEQSA during a cyber security incident and guidance on reporting material changes, please visit the TEQSA cyber security webpage.

For VSL providers this is the Department of Employment and Workplace Relations 

Approved VSL providers must notify the Department of Employment and Workplace Relations if they reasonably believe a data breach (whether suspected or known) has occurred in connection with the VSL program.

The notification must be given by email to vetstudentloans@dewr.gov.au within one business day of you becoming aware of the suspected or known data breach and include the following information (if known at the time of the notification):

• legal name and contact person details,
• a description of the data breach and what you have done to contain or remedy the breach,
• what you are doing to reduce the risk of future similar breaches,
• the legal name and physical address of any contractors or third-party entities involved in the breach,
• the number of individuals affected by the data breach,
• the types of personal information involved in the data breach and 
• the date you informed, or intend to inform, individuals affected by their information being accessed, disclosed and/or lost. 

For general information, please refer to the VSL provider manual section 45.3 Notification of data breaches.