If you run an electrical or data cabling business in Australia, the honest answer is that cyber liability cover is not automatically necessary for every sole trader. It becomes worth reviewing when you hold customer personal information, when your turnover or activities bring you inside the Privacy Act, or when a single email compromise could stop you quoting, invoicing or accessing job records for days. This guide sets out the thresholds, the official data and the verification steps so you can decide for your own business rather than by rule of thumb.
The Privacy Act threshold that decides most cases
The starting point is whether the Privacy Act 1988 applies to you at all. The Office of the Australian Information Commissioner states that most small businesses with an annual turnover of $3 million or less, counting all income from all sources, are not covered by the Privacy Act. That figure is a turnover test, not a profit test, and it includes every income stream rather than just electrical work.
The same guidance sets out exceptions that override turnover entirely. Regardless of how small the business is, the Privacy Act covers a business that is a health service provider, a contractor providing services under a Commonwealth contract, or a business that has opted in to coverage. For trades, the contractor exception is the one most likely to matter, because it can apply to work performed under Commonwealth arrangements even when turnover is well below the threshold.
If none of those exceptions apply and turnover stays under the threshold, the notifiable data breaches scheme does not bind you in the same way. That does not make a breach harmless. It changes who you must notify and on what timeline, not whether customers, subcontractors or your own cash flow can be damaged.
What the notifiable data breaches scheme requires
For organisations covered by the Privacy Act, the OAIC explains that under the Notifiable Data Breaches scheme you must notify affected individuals and the OAIC when a data breach is likely to result in serious harm. The trigger is the likelihood of serious harm, so the assessment matters as much as the incident itself.
The OAIC’s own examples of data breaches are deliberately ordinary. They include a device holding customers’ personal information being lost or stolen, and a database containing personal information being hacked. For an electrical or data cabling business, the first example is the realistic one: a laptop, phone or tablet left on site, in a van or in a café, holding client names, addresses, gate codes, alarm details or payment records.
That framing is useful when you weigh cover. The question is not whether you are a likely target of a sophisticated attack. It is whether you hold information that would cause serious harm if it went missing, and whether you could absorb the cost of responding if it did.
What cybercrime actually costs Australian small businesses
The Australian Signals Directorate’s Annual Cyber Threat Report 2024-25 puts the average self-reported cost of cybercrime per report at $56,600 for small businesses, up 14 percent, compared with $97,200 for medium and $202,700 for large businesses. These are averages of self-reported figures, so they describe the reports ASD received rather than every incident in the economy, but they are the closest official benchmark available.
The same report says ASD’s Australian Cyber Security Centre received over 84,700 cybercrime reports in FY2024-25, an average of one every 6 minutes. Volume at that scale means the question for a trade business is exposure management, not whether the sector is interesting to attackers.
ASD’s 2024-25 fact sheet for businesses breaks down what businesses actually reported. The top categories were email compromise with no financial loss at 19 percent, business email compromise fraud with financial loss at 15 percent, and identity fraud at 11 percent. Construction appears in the top 10 reporting sectors at 3 percent of incidents reported to ASD’s ACSC. Electrical and data cabling work sits close to that sector, and the dominant reported problem is email, not exotic malware.
What cyber insurance typically covers
business.gov.au describes cyber insurance as cover for costs relating to cyber extortion or ransomware, business interruption from a cyber event, network security and data breaches including data recovery, and the inadvertent release of customer personal information. Those categories map onto the risks above: the lost device, the hijacked inbox, the invoice that gets redirected, and the days of lost work while systems are rebuilt.
The same page notes that management liability packages can include cyber and privacy liability alongside other covers. That matters for how you buy. If you already hold a management liability or business package policy, cyber cover may sit inside it in some form, which changes whether a standalone policy is the right next step.
Coverage wording, sub-limits, exclusions and notification conditions vary between insurers and policies. Nothing here describes what any particular policy will pay, and no policy should be assumed to respond to a given event without reading its terms.
Does a data cabling business need different treatment?
Data cabling work deserves a closer look because of what the job involves. You may be working inside client premises, touching network infrastructure, and holding documentation about layouts, access points and equipment. Insurance for data cablers is often discussed alongside cyber cover for exactly this reason: the work combines physical site access with information about how a client’s network is built.
That does not automatically create a Privacy Act obligation. It does mean the practical consequences of a lost device or a compromised email account can extend beyond your own business, because client network details may be involved. If you subcontract or work under a head contractor, check what the contract requires of you before assuming your existing cover is sufficient.
How to verify your own position
Work through the threshold first. Calculate annual turnover across all income sources, then check whether any exception applies to you, particularly the Commonwealth contract exception. The OAIC’s small business guidance is the authoritative page for this test, and it is worth reading directly rather than relying on a summary.
Next, list what personal information you actually hold and where. Client contact details, site access information, payment records, staff records and subcontractor details all count. Then ask what would happen if each category disappeared tomorrow: who would need to be told, what would it cost, and how long would work stop.
Finally, read your current policies. Check whether cyber or privacy liability already appears in a management liability or business package, and note any sub-limits. If you want advice on how a policy would respond to your specific circumstances, speak with a qualified adviser rather than relying on general guidance. Where official rules and thresholds matter to your decision, confirm the current version on the relevant government or regulator website, since guidance is updated over time.
Common questions
Is cyber cover legally required for electricians in Australia? No general rule requires it. The legal obligation that catches most attention is the notifiable data breaches scheme, which applies to organisations covered by the Privacy Act, and Privacy Act coverage depends on turnover and on the exceptions described above.
Does the $3 million threshold mean I am exempt forever? No. It is based on annual turnover counting all income from all sources, so growth, additional income streams or a change in the type of work can move you across it. The exceptions can also apply regardless of turnover.
What is the single most likely incident for a trade business? Based on ASD’s 2024-25 reporting, email compromise and business email compromise fraud dominate what businesses report, ahead of more technical attack types. A lost or stolen device holding customer information is the other realistic scenario the OAIC highlights.
Where can I check official guidance? The OAIC publishes small business privacy guidance and information on the notifiable data breaches scheme. ASD’s ACSC maintains a small business hub with a cyber security guide, guidance on preventing business email compromise and ransomware, and a free cyber health check tool. business.gov.au explains what cyber insurance can cover.
参考资料
- OAIC《Small business》
- OAIC《About the Notifiable Data Breaches scheme》
- Australian Signals Directorate《Annual Cyber Threat Report 2024-2025》
- Australian Signals Directorate《Annual Cyber Threat Report 2024-25 factsheet for businesses and organisations》
- Australian Signals Directorate《Small business hub》
- business.gov.au《Types of business insurance》
Partner links. Using them costs you nothing extra and may earn us a commission.