Cybersecurity Compliance Finder for Asia-Pacific

    Pick your country and industry to see which cybersecurity and data protection rules may apply to you, what they ask for and how fast you must report an incident. Covers Malaysia, Singapore, Indonesia, Thailand, the Philippines and Australia. Every rule links to its official source.

    Find my rules

    Find the rules for your country and industry

    Choose a country and an industry. Leave both on “All” to read every rule. Each rule shows the month it was last checked.

    1. Country

    2. Industry

    Showing 28 rules.

    This is general guidance, not legal advice. Rules change, and whether a rule applies depends on your organisation. Each card links to the official source. Primary Guard services support the controls these rules expect. They do not make an organisation compliant on their own.

    Malaysia

    Malaysia combines the Cyber Security Act 2024, the amended PDPA and Bank Negara Malaysia's rules for financial institutions.

    Primary Guard holds NACSA licences for managed SOC monitoring and penetration testing, and is ISO 27001 certified. Healthcare services is one of the 11 critical sectors in the Cyber Security Act 2024. Hospitals and other healthcare providers designated as NCII entities must follow the Act. For retail, no separate cybersecurity rule is listed here. The PDPA is the baseline.

    Cybersecurity company in Malaysia

    In forceLaw · NACSA

    Cyber Security Act 2024 (Act 854)

    In force since 26 August 2024.

    Who it applies to
    Government bodies and businesses designated as national critical information infrastructure (NCII) entities, and cybersecurity service providers that need a licence under the Act.
    What it asks for
    • The Act covers incident management for critical national information infrastructure (NCII).
    • The Act covers the licensing of cybersecurity service providers.
    • NACSA (the National Cyber Security Agency) administers the Act.
    • NCII entities sit in 11 critical sectors, including government, banking and finance, healthcare services and energy. A sector lead designates the entity.
    Incident reporting
    Tell NACSA immediately. Send the initial details within 6 hours of becoming aware of the incident and further details within 14 days after the first notification.
    Penalties
    Failing to notify an incident: a fine of up to RM500,000, up to 10 years in prison, or both (section 23).
    How Primary Guard can help
    24/7 monitoring and incident response help you detect incidents early and meet the reporting deadlines. Autonomous SOC, Endpoint security (EDR/XDR), Threat Intelligence.

    Official source: NACSA: Act 854 · Notification of Cyber Security Incident Regulations 2024 (P.U.(A) 220) · Last checked November 2026

    In forceLaw · Personal Data Protection Commissioner

    Personal Data Protection Act 2010 (PDPA), as amended 2024 (Act A1727)

    Data processors have direct security duties from 1 April 2025. Data breach notification and Data Protection Officer rules apply from 1 June 2025.

    Who it applies to
    Organisations that process personal data in commercial transactions, and the data processors that work for them.
    What it asks for
    • Report data breaches that cause, or are likely to cause, significant harm. This includes breaches that affect more than 1,000 people.
    • Data Protection Officer rules apply from 1 June 2025. Check the Commissioner's guideline for who must appoint one.
    • Data processors now have a direct duty to secure the data.
    Incident reporting
    Tell the Commissioner as soon as practicable and within 72 hours of the breach. Tell affected people within 7 days after you notify the Commissioner.
    Penalties
    Breaching the data protection principles: a fine of up to RM1,000,000 and/or up to 3 years in prison.
    How Primary Guard can help
    Detection, endpoint protection and access control reduce the chance and impact of a breach. Endpoint security (EDR/XDR), Identity & Access Management, Autonomous SOC.

    Official source: PDP Commissioner: data breach notification guideline · Act A1727 (official text) · Last checked November 2026

    In forceRegulator rule · Bank Negara Malaysia

    BNM Risk Management in Technology (RMiT)

    Who it applies to
    Banks and other financial institutions regulated by Bank Negara Malaysia.
    What it asks for
    • A board-approved technology risk appetite, a CISO and an independent technology risk function.
    • A security operations centre, a cyber incident response plan and an annual cyber drill.
    • Regular red-team exercises, and a risk assessment before moving critical systems to the cloud.
    How Primary Guard can help
    A managed SOC, attack simulation and identity controls support these expectations. Autonomous SOC, Breach & Attack Simulation, Identity & Access Management.

    Official source: Bank Negara Malaysia: RMiT policy document · Last checked November 2026

    In forceRegulator rule · Bank Negara Malaysia

    BNM Management of Customer Information and Permitted Disclosures (2025)

    Issued 31 October 2025.

    Who it applies to
    Financial institutions regulated by Bank Negara Malaysia.
    What it asks for
    • Customer information breaches must be notified to BNM.
    • Affected customers must also be notified.
    • Follow the rules on when customer information may be disclosed.
    How Primary Guard can help
    Endpoint protection and access control help keep customer information from leaking. Endpoint security (EDR/XDR), Identity & Access Management.

    Official source: Bank Negara Malaysia: MCIPD policy document · Last checked November 2026

    General regulatory guidance, current as at November 2026.

    Singapore

    Singapore's main rules are the MAS technology risk rules for finance, the Cybersecurity Act for critical infrastructure and the PDPA.

    Cybersecurity in Singapore

    In forceRegulator rule · Monetary Authority of Singapore (MAS)

    MAS Technology Risk Management Notices and Guidelines

    The Notices apply from 10 May 2024. MAS consulted on amendments in 2026 and they are not in force yet.

    Who it applies to
    Banks, insurers, capital markets entities, payment institutions and other MAS-regulated financial institutions. The Notices carry the binding requirements. The 2021 Guidelines set expected good practice.
    What it asks for
    • Identify critical systems. Keep unscheduled downtime within 4 hours in any 12 months and recover each critical system within 4 hours.
    • Test recovery at least every 12 months.
    • Protect customer information from unauthorised access or disclosure.
    Incident reporting
    Tell MAS as soon as possible and no later than 1 hour after discovering a relevant incident. Send a root cause and impact report within 14 days.
    How Primary Guard can help
    24/7 monitoring, DDoS and web protection, attack simulation and identity controls support these requirements. Autonomous SOC, Web Security & CDN, Breach & Attack Simulation, Identity & Access Management.

    Official source: MAS: consultation on amendments to the TRM Notices · MAS: Technology Risk Management Guidelines · Last checked October 2026

    In forceLaw · Cyber Security Agency of Singapore (CSA)

    Cybersecurity Act 2018 (amended 2024)

    The 2025 amendments started on 31 October 2025. Some provisions are still to be brought into force.

    Who it applies to
    Owners of designated Critical Information Infrastructure (CII) and of systems of temporary cybersecurity concern. Future provisions will cover foundational digital infrastructure providers, such as cloud and data centre companies.
    What it asks for
    • CII owners report more types of incidents, including incidents in their supply chain.
    • CSA can designate provider-owned or third-party systems as CII.
    • Foundational digital infrastructure providers will get new duties once those provisions start.
    Incident reporting
    CII owners must report prescribed incidents to CSA. Some serious incident types must be reported within 2 hours.
    How Primary Guard can help
    Monitoring, endpoint detection and threat intelligence help you detect and report incidents quickly. Autonomous SOC, Endpoint security (EDR/XDR), Threat Intelligence.

    Official source: CSA: amendments in force from 31 October 2025 · Last checked October 2026

    In forceLaw · Personal Data Protection Commission (PDPC)

    Personal Data Protection Act 2012 (PDPA)

    Mandatory breach notification applies.

    Who it applies to
    Private-sector organisations that collect, use or disclose personal data in Singapore.
    What it asks for
    • Assess a suspected breach within 30 calendar days.
    • Notify the PDPC if the breach is likely to cause significant harm or affects 500 or more people.
    • Notify affected people as soon as practicable.
    Incident reporting
    Tell the PDPC no later than 3 calendar days after you decide the breach is notifiable.
    Penalties
    Up to S$1 million, or up to 10% of annual Singapore turnover for organisations with turnover above S$10 million, whichever is higher.
    How Primary Guard can help
    Detection and access control help you find a breach and assess it inside the 30-day window. Autonomous SOC, Endpoint security (EDR/XDR), Identity & Access Management.

    Official source: PDPC: guide on managing and notifying data breaches · Last checked October 2026

    UpcomingLaw · Ministry of Health (MOH)

    Health Information Act and MOH Cybersecurity and Data Security Essentials

    MOH published the Essentials in March 2026. Check MOH for when the Act's duties start.

    Who it applies to
    Licensed healthcare providers and other entities that contribute to or use the National Electronic Health Record.
    What it asks for
    • 13 essential measures, such as software updates, anti-malware, firewalls, access control and backups.
    • Staff training (ideally once a year), vendor management and an incident response plan.
    • Know where health information is held and limit access to people who need it.
    How Primary Guard can help
    Endpoint protection, access control and monitoring cover several of the essential measures. Endpoint security (EDR/XDR), Identity & Access Management, Autonomous SOC.

    Official source: MOH: Cybersecurity and Data Security Essentials (PDF) · Last checked October 2026

    Indonesia

    Indonesia's rules centre on the PDP Law and its implementing regulation, OJK rules for banks and Perpres 82/2022 for vital infrastructure.

    A Cybersecurity and Resilience Bill and a PDP Law amendment are being discussed but are not law yet. HBT Law quarterly update, August 2026.

    Cybersecurity company in IndonesiaRead: OJK cyber compliance guide for Indonesia

    In forceLaw · Komdigi (the PDP Authority is not yet set up)

    Personal Data Protection Law (UU PDP), Law 27/2022

    The transition period ended in October 2024.

    Who it applies to
    Any organisation that controls or processes the personal data of people in Indonesia.
    What it asks for
    • Have a lawful basis, including consent you can prove.
    • Run an impact assessment for high-risk processing.
    • Appoint a Data Protection Officer in some cases, such as public service or large-scale processing of specific data.
    Incident reporting
    Tell affected people and the authority in writing within 3 x 24 hours.
    Penalties
    Administrative fines of up to 2% of annual revenue. Criminal penalties depend on the offence, for example up to 5 years in prison and Rp5 billion for unlawful collection or use of personal data.
    How Primary Guard can help
    Detection, endpoint protection and access control help you meet the 3 x 24 hour notice. Autonomous SOC, Endpoint security (EDR/XDR), Identity & Access Management.

    Official source: Komdigi JDIH: Law 27/2022 · Last checked October 2026

    UpcomingRegulator rule · Government of Indonesia

    Government Regulation 33/2026 (implements the PDP Law)

    Takes effect on 16 January 2027.

    Who it applies to
    Controllers and processors of personal data under the PDP Law.
    What it asks for
    • A data protection impact assessment before high-risk processing, such as large-scale processing of specific data or systematic monitoring.
    • Breach response and Data Protection Officer rules.
    • Records of processing, audits and contracts with processors.
    Incident reporting
    3 x 24 hours to affected people and the authority, counted from when you establish the breach with reasonable certainty.
    Penalties
    Administrative fines of up to 2% of annual gross revenue.
    How Primary Guard can help
    Start now: monitoring and access control take time to put in place before January 2027. Autonomous SOC, Identity & Access Management, Endpoint security (EDR/XDR).

    Official source: DFDL: GR 33/2026 explained · PwC Indonesia: GR 33/2026 · Last checked October 2026

    In forceRegulator rule · OJK (Financial Services Authority)

    OJK POJK 11/2022 and SEOJK 29/2022

    Who it applies to
    Conventional and Sharia commercial banks.
    What it asks for
    • Yearly cyber risk and cyber maturity assessments, reported to OJK.
    • Periodic vulnerability and penetration testing, plus scenario-based cyber testing at least once a year.
    • Keep electronic systems and disaster recovery centres in Indonesia unless OJK approves otherwise.
    Incident reporting
    Early written notice to OJK within 24 hours of a significant IT incident. Full report within 5 working days.
    How Primary Guard can help
    A 24/7 SOC, regular attack simulation and web protection support the testing and reporting duties. Autonomous SOC, Breach & Attack Simulation, Web Security & CDN, Threat Intelligence.

    Official source: OJK: POJK 11/2022 (English) · Last checked October 2026

    In forceRegulator rule · BSSN and sector regulators

    Perpres 82/2022 on Vital Information Infrastructure

    In force since 24 May 2022.

    Who it applies to
    Operators of electronic systems in strategic sectors such as government, energy, transport, finance, health and ICT, where a disruption would seriously affect the public. Your sector regulator decides which systems are designated.
    What it asks for
    • Identify your vital information infrastructure at least once a year and report it to your sector regulator.
    • Apply security standards and cyber risk management, and set up an incident response team.
    • Self-assess cyber maturity every year and run incident response and continuity simulations.
    Incident reporting
    Report incidents within 1 x 24 hours to the sector incident response team, with a copy to BSSN.
    How Primary Guard can help
    24/7 monitoring, threat intelligence and attack simulation support these duties. Autonomous SOC, Threat Intelligence, Breach & Attack Simulation.

    Official source: Perpres 82/2022 (PDF) · Last checked October 2026

    In forceRegulator rule · Komdigi

    Komdigi Regulation 5/2020 on private electronic system operators

    Who it applies to
    Private-sector electronic system operators, including online platforms and digital services. Foreign operators that serve Indonesian users must register too.
    What it asks for
    • Register before the system is used.
    • Operate the system reliably and securely.
    • Remove prohibited content within 24 hours of a valid order, with a shorter deadline for urgent content.
    Penalties
    Access to an unregistered system can be blocked.
    How Primary Guard can help
    Web application protection and monitoring help keep a platform available and secure. Web Security & CDN, Autonomous SOC.

    Official source: Komdigi JDIH: Regulation 5/2020 · Last checked October 2026

    Thailand

    Thailand's core rules are the PDPA, the Cybersecurity Act for critical infrastructure and Bank of Thailand rules for payment providers.

    Other Bank of Thailand and SEC rules may apply to banks and securities firms. Check with the regulator.

    In forceLaw · Personal Data Protection Committee (PDPC) Office

    Personal Data Protection Act B.E. 2562 (2019)

    In force for most businesses since 1 June 2022.

    Who it applies to
    Any controller or processor that handles personal data in Thailand, and some overseas organisations that serve people in Thailand.
    What it asks for
    • Health and other sensitive data need explicit consent unless an exception applies.
    • Appoint a Data Protection Officer if you are a public authority, or your core activity involves large-scale monitoring or sensitive data.
    • Use appropriate security measures and report breaches.
    Incident reporting
    Tell the PDPC Office without delay and, where feasible, within 72 hours. Also tell affected people when the risk to them is high.
    Penalties
    Administrative fines of up to THB 5 million for unlawful handling of sensitive data (lower tiers of THB 1 million and THB 3 million apply to other violations), plus criminal penalties for some offences.
    How Primary Guard can help
    Detection, endpoint protection and access control help you meet the 72-hour notice. Autonomous SOC, Endpoint security (EDR/XDR), Identity & Access Management.

    Official source: PDPA B.E. 2562, English translation (Thailand Law Forum) · Last checked October 2026

    In forceLaw · National Cyber Security Agency (NCSA)

    Cybersecurity Act B.E. 2562 (2019)

    Who it applies to
    Organisations designated as Critical Information Infrastructure (CII), in sectors such as national security, public services, banking and finance, IT and telecoms, transport, energy and public health.
    What it asks for
    • Follow a code of practice and a standard framework.
    • Run a risk assessment and audit every year and report them to NCSA.
    • Keep continuity plans and run exercises.
    Incident reporting
    Report significant incidents to NCSA and your sector regulator without delay.
    How Primary Guard can help
    Monitoring, threat intelligence and attack simulation support risk management and incident reporting. Autonomous SOC, Threat Intelligence, Breach & Attack Simulation, Endpoint security (EDR/XDR).

    Official source: ThaiCERT: Critical Information Infrastructure · Last checked October 2026

    In forceRegulator rule · Bank of Thailand

    Bank of Thailand IT security notification for payment providers (SorNorChor 11/2561)

    Effective 16 April 2018.

    Who it applies to
    Providers of highly important payment systems, designated payment systems and designated payment services.
    What it asks for
    • Board-approved written IT security policies.
    • External penetration tests on significant internet-facing systems before they go live, and a business continuity test every year.
    • A yearly security audit, reported to the Bank of Thailand within 45 days.
    Incident reporting
    Report security breaches to the Bank of Thailand as soon as possible.
    How Primary Guard can help
    Attack simulation, web protection and monitoring support the testing and security duties. Breach & Attack Simulation, Web Security & CDN, Autonomous SOC.

    Official source: Bank of Thailand: notification 11/2561 (PDF) · Last checked October 2026

    Philippines

    The Philippines is built on the Data Privacy Act and Bangko Sentral ng Pilipinas (BSP) rules for finance. A national cybersecurity bill is moving through Congress but is not law.

    In forceLaw · National Privacy Commission (NPC)

    Data Privacy Act of 2012 (RA 10173) and NPC breach rules

    Who it applies to
    Any organisation that processes personal information in the Philippines, and some processing of Filipino residents' data that has a Philippine link.
    What it asks for
    • Use organisational, physical and technical security measures, and require processors to do the same.
    • Health, genetic and government-issued ID data are sensitive personal information and get extra protection.
    • Concealing a breach is a criminal offence.
    Incident reporting
    Tell the NPC within 72 hours of knowing about, or reasonably believing there was, a notifiable breach. Send the full report within 5 days. Notification is required when sensitive or identity-fraud data is involved, an unauthorised person likely obtained it and there is a real risk of serious harm.
    Penalties
    Criminal penalties are imprisonment plus fines from PHP 100,000 up to PHP 5 million, depending on the offence.
    How Primary Guard can help
    Detection, endpoint protection and access control help you meet the 72-hour notice. Autonomous SOC, Endpoint security (EDR/XDR), Identity & Access Management.

    Official source: LawPhil: Republic Act 10173 · NPC: breach reporting · Last checked October 2026

    In forceRegulator rule · Bangko Sentral ng Pilipinas (BSP)

    BSP IT risk and information security rules (Circular 982 and later circulars)

    Circular 982 (2017) is the core guideline. The BSP has amended its IT risk rules since, including in 2025, so check its latest circulars.

    Who it applies to
    BSP-supervised banks and non-bank financial institutions. Duties scale with your IT risk profile.
    What it asks for
    • Board and senior management own information security. Keep a security programme and a CISO.
    • Run the cycle of identify, protect, detect, respond, recover and test, including third-party and cloud oversight.
    • Run external vulnerability assessment and penetration testing at least once a year if you offer digital financial services.
    Incident reporting
    Promptly tell the BSP about confirmed IT-related fraud or major security breaches.
    How Primary Guard can help
    A 24/7 SOC, attack simulation, threat intelligence and identity controls support this cycle. Autonomous SOC, Breach & Attack Simulation, Threat Intelligence, Identity & Access Management.

    Official source: BSP: Circular 982 (PDF) · Last checked October 2026

    In forceLaw · Bangko Sentral ng Pilipinas (BSP)

    Anti-Financial Account Scamming Act (RA 12010, 2024)

    Who it applies to
    BSP-supervised banks, non-bank financial institutions and payment providers.
    What it asks for
    • Protect client account access with adequate controls, such as multi-factor authentication and fraud management systems.
    • Institutions that fail to use adequate controls may owe restitution to account owners.
    Penalties
    Restitution to affected account owners.
    How Primary Guard can help
    Identity and access management and monitoring support strong account protection. Identity & Access Management, Autonomous SOC.

    Official source: LawPhil: Republic Act 12010 · Last checked October 2026

    In forceLaw · Department of Trade and Industry (DTI)

    Internet Transactions Act of 2023 (RA 11967)

    Who it applies to
    E-marketplaces, digital platforms, e-retailers and online merchants that sell to customers in the Philippines.
    What it asks for
    • Protect consumer data under the Data Privacy Act and meet the minimum information security standards set by DTI and NPC.
    • Platforms must verify merchants and offer ways to resolve complaints.
    Penalties
    DTI administrative fines of PHP 5,000 up to PHP 1,000,000, depending on the violation.
    How Primary Guard can help
    Web application protection and monitoring help protect customer data on a store or platform. Web Security & CDN, Autonomous SOC.

    Official source: LawPhil: Republic Act 11967 · Last checked October 2026

    Pending, not law yetProposed law · Proposed National Cybersecurity Agency

    National Cybersecurity and Critical Information Infrastructure Protection Act (House Bill 9605)

    Passed the House in August 2026. It still needs Senate approval and the President's signature.

    Who it applies to
    If enacted, it would apply to operators of critical information infrastructure and create a National Cybersecurity Agency.
    What it asks for
    • Proposed: risk assessments and audits for CII operators.
    • Proposed: incident reporting and disclosure of ransom payments.
    • Proposed: a chief information security officer for CII operators.
    How Primary Guard can help
    Building monitoring and response now means you are ready if the bill becomes law. Autonomous SOC, Threat Intelligence.

    Official source: NewsBytes PH: House approves the bill · Last checked October 2026

    Australia

    Australia combines ransomware payment reporting, the Privacy Act breach scheme, APRA standards for finance and the SOCI Act for critical infrastructure.

    Cybersecurity in AustraliaRead: ransomware payment reporting in Australia

    In forceLaw · Department of Home Affairs and ASD

    Cyber Security Act 2024: ransomware payment reporting

    In force since 30 May 2025. Stronger compliance focus from 1 January 2026.

    Who it applies to
    Businesses operating in Australia with annual turnover over the AUD 3 million threshold, and operators of certain critical infrastructure assets.
    What it asks for
    • Report a ransomware or cyber extortion payment to ASD.
    • The report covers the incident, the demand, the payment and any contact with the attacker.
    • No report is needed if no payment was made.
    Incident reporting
    Within 72 hours of paying, or of becoming aware that a payment was made for you.
    Penalties
    Civil penalties apply for failing to report.
    How Primary Guard can help
    Endpoint detection, monitoring and threat intelligence help you detect, contain and report within the window. Endpoint security (EDR/XDR), Autonomous SOC, Threat Intelligence.

    Official source: ASD: ransomware payment and cyber extortion payment reporting · Last checked October 2026

    In forceLaw · Office of the Australian Information Commissioner (OAIC)

    Privacy Act 1988: Notifiable Data Breaches scheme

    In force since 22 February 2018.

    Who it applies to
    Australian Government agencies, organisations with annual turnover above AUD 3 million, all private health service providers, credit providers and some others.
    What it asks for
    • Assess a suspected eligible data breach within 30 days.
    • If serious harm is likely, notify the OAIC and the affected people.
    Incident reporting
    As soon as practicable after you confirm an eligible breach.
    Penalties
    Serious or repeated privacy interferences by a company: the greater of AUD 50 million or three times the benefit gained. If the benefit cannot be worked out, 30% of adjusted turnover in the breach period.
    How Primary Guard can help
    Detection and access control help you find and scope a breach quickly. Autonomous SOC, Endpoint security (EDR/XDR), Identity & Access Management.

    Official source: OAIC: notifiable data breaches · Last checked October 2026

    In forceRegulator rule · APRA

    APRA CPS 234 Information Security

    In force since 1 July 2019.

    Who it applies to
    APRA-regulated entities: banks, insurers, private health insurers and superannuation trustees.
    What it asks for
    • The Board is ultimately responsible for information security.
    • Classify information assets and apply controls that match how critical they are, including third-party assets.
    • Test controls and incident response plans at least once a year.
    Incident reporting
    Tell APRA within 72 hours of a material information security incident. Tell APRA within 10 business days of a material control weakness that cannot be fixed in time.
    How Primary Guard can help
    A 24/7 SOC, attack simulation and identity controls support testing and incident reporting. Autonomous SOC, Breach & Attack Simulation, Identity & Access Management.

    Official source: APRA: CPS 234 (PDF) · Last checked October 2026

    In forceRegulator rule · APRA

    APRA CPS 230 Operational Risk Management

    Started on 1 July 2025.

    Who it applies to
    APRA-regulated banks, insurers, private health insurers and superannuation trustees.
    What it asks for
    • An operational risk framework with Board accountability.
    • Tolerance levels for critical operations, and tested business continuity plans.
    • A register of material service providers, with a binding agreement for each.
    Incident reporting
    Tell APRA within 72 hours of an operational risk incident likely to have a material financial impact or a material impact on critical operations. Tell APRA within 24 hours of a disruption to a critical operation that goes beyond its tolerance.
    How Primary Guard can help
    Monitoring and web protection help keep critical services available and spot disruption early. Autonomous SOC, Web Security & CDN.

    Official source: APRA: CPS 230 (PDF) · Last checked October 2026

    In forceLaw · Cyber and Infrastructure Security Centre and ASD

    Security of Critical Infrastructure Act 2018 (SOCI Act)

    Who it applies to
    Responsible entities for critical infrastructure assets in sectors such as energy, communications, data storage, banking, insurance, water, designated hospitals, transport and food.
    What it asks for
    • Keep and follow a Critical Infrastructure Risk Management Program (CIRMP) and send an annual report.
    • Report cyber incidents to ASD.
    • Assets declared Systems of National Significance face enhanced duties.
    Incident reporting
    Within 12 hours for an incident with a significant impact on availability. Within 72 hours for other relevant incidents.
    How Primary Guard can help
    24/7 monitoring, threat intelligence, endpoint detection and attack simulation support risk management and fast reporting. Autonomous SOC, Threat Intelligence, Endpoint security (EDR/XDR), Breach & Attack Simulation.

    Official source: CISC: SOCI obligations factsheet (PDF) · Last checked October 2026

    GuidanceGuideline · Australian Signals Directorate (ASD)

    ASD Essential Eight

    Recommended for all organisations. Mandatory only for non-corporate Commonwealth entities.

    Who it applies to
    Recommended by ASD for all organisations. Non-corporate Commonwealth entities must reach Maturity Level Two.
    What it asks for
    • Eight strategies: patch applications, patch operating systems, multi-factor authentication, restrict admin privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups.
    • Choose a target maturity level. ASD says Level 1 generally suits small and medium businesses and Level 2 suits large enterprises. Level 3 suits critical infrastructure and high-threat organisations.
    How Primary Guard can help
    Endpoint protection, identity controls and attack simulation help you reach and prove a maturity level. Endpoint security (EDR/XDR), Identity & Access Management, Breach & Attack Simulation.

    Official source: ASD: Essential Eight maturity model FAQ · Last checked October 2026

    In forceLaw · OAIC and the Australian Digital Health Agency

    My Health Records Act 2012: breach notification

    Who it applies to
    Healthcare provider organisations and other bodies connected to the My Health Record system.
    What it asks for
    • Report breaches, or suspected breaches, that involve the My Health Record system to the OAIC and the System Operator.
    • Do not contact patients directly. Ask the System Operator to do so.
    • Breaches that involve only your own clinic records fall under the Notifiable Data Breaches scheme.
    Incident reporting
    As soon as practicable after you become aware.
    Penalties
    Civil penalties apply for not reporting on time.
    How Primary Guard can help
    Endpoint protection, access control and monitoring help protect patient records. Endpoint security (EDR/XDR), Identity & Access Management, Autonomous SOC.

    Official source: OAIC: My Health Record breach notification guide · Last checked October 2026

    How Primary Guard supports your compliance work

    Most of these rules ask for the same things: see incidents fast, report them on time, control who has access, test your defences and protect customer data. These Primary Guard services support those controls.

    Compare security vendors on our security and compliance battlecards.

    Frequently asked questions

    What is the Primary Guard Cybersecurity Compliance Finder?

    It is a free guide to the main cybersecurity and data protection rules in Malaysia, Singapore, Indonesia, Thailand, the Philippines and Australia. Pick a country and an industry to see which rules may apply, what they ask for and how fast incidents must be reported. Each rule links to its official source.

    Is the Compliance Finder legal advice?

    No. It is general guidance written by Primary Guard's product marketing team. Each rule shows the month it was last checked. Laws change, and whether a rule applies to you depends on your facts. Check the official source and ask your legal adviser before you act.

    Which cyber incident reporting deadlines are the shortest?

    In this guide, the shortest are 1 hour to MAS for Singapore financial institutions, 2 hours for some critical infrastructure incidents in Singapore, 6 hours for the initial report to NACSA in Malaysia and 12 hours for significant incidents under Australia's SOCI Act. Data breach notices under data protection laws are mostly 72 hours in Malaysia, Thailand and the Philippines, and 3 days in Singapore and Indonesia. Check each rule card for the exact deadline in your country.

    How can Primary Guard help with compliance?

    Our services support the controls these rules expect: 24/7 monitoring and incident response with Autonomous SOC, endpoint detection, identity and access management, threat intelligence, breach and attack simulation, and web security. They support your compliance work but do not certify it. Responsibility stays with the organisation.

    Not sure which rules apply to you?

    Talk to our team. We will help you map the rules above to the controls you already have and the gaps you still need to close.

    Talk to our team