Draft security and incident clauses against the SOCI Act, Privacy Act and CPS 230
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Produce a security schedule (standards, audit, notice timelines, incident cooperation) with gaps against the SOCI Act, Privacy Act, APRA CPS 230 and ASX Listing Rule 3.1.
- What the lawyer must review
- Apply the Privacy Act notice duties
- Confirm SOCI duties for the sector and asset class (CIRMP Rules exposure draft, March 2026)
- Apply APRA CPS 230 from 1 July 2025 and CPS 234
- Check contract windows against statutory ones
- Cite ISO/IEC 27001:2022 and the current Essential Eight
- Written for / version
- Commonwealth versionCth
Rules that apply
The document starts from the task name. Change it if this piece of work is different.
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes assembling provisional schedules. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Review operative clauses in the complete document, including definitions, cross-references, schedules and inconsistencies with the instructions.
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.