##### 35AB  Ministerial authorisation ###### Scope - \(1\) This section applies if the Minister is satisfied that: - \(a\) an incident: - \(i\) has occurred; or - \(ii\) is occurring; or - \(iii\) is imminent; and - \(b\) the incident has had, is having, or is likely to have, one or more relevant impacts on one or more critical infrastructure assets \(each of which is a primary asset\); and - \(c\) there is a material risk that the incident has seriously prejudiced, is seriously prejudicing, or is likely to seriously prejudice: - \(i\) the social or economic stability of Australia or its people; or - \(ii\) the defence of Australia; or - \(iii\) national security; and - \(d\) no existing regulatory system of the Commonwealth, a State or a Territory could be used to provide a practical and effective response to the incident\. - \(1A\) This section also applies if the Minister is satisfied that: - \(a\) an incident: - \(i\) has occurred; or - \(ii\) is occurring; or - \(iii\) is imminent; and - \(b\) the incident has had, is having, or is likely to have, one or more relevant impacts on one or more critical infrastructure assets \(each of which is a primary asset\); and - \(c\) the incident relates to an emergency specified in a national emergency declaration \(within the meaning of the National Emergency Declaration Act 2020\) that is in force; and - \(d\) no existing regulatory system of the Commonwealth, a State or a Territory could be used to provide a practical and effective response to the incident\. ###### Authorisation - \(2\) The Minister may, on application by the Secretary, do any or all of the following things: - \(a\) authorise the Secretary to give directions under section 35AK, relating to the incident and one or more primary assets, to one or more relevant entities; - \(b\) authorise the Secretary to give directions under section 35AK, relating to the incident and one or more specified critical infrastructure sector assets, to one or more relevant entities; - \(c\) authorise the Secretary to give to one or more specified entities a specified direction under section 35AQ that relates to the incident and one or more specified primary assets; - \(d\) authorise the Secretary to give to one or more specified entities a specified direction under section 35AQ that relates to the incident and one or more specified critical infrastructure sector assets; - \(e\) authorise the Secretary to give one or more specified requests under section 35AX that relate to the incident and one or more specified primary assets; - \(f\) authorise the Secretary to give one or more specified requests under section 35AX that relate to the incident and one or more specified critical infrastructure sector assets\. Note 1: Section 35AK deals with information gathering directions\. Note 2: Section 35AQ deals with action directions\. Note 3: Section 35AX deals with intervention requests\. The Minister must not give an authorisation under paragraph \(2\)\(e\) or \(f\) unless the Minister is satisfied that the incident is a cyber security incident: see subsection \(10\)\. - \(3\) An authorisation under subsection \(2\) is to be known as a Ministerial authorisation\. - \(4\) Subsection 33\(3AB\) of the Acts Interpretation Act 1901 does not apply to subsection \(2\) of this section\. Note: Subsection 33\(3AB\) of the Acts Interpretation Act 1901 deals with specification by class\. ###### Information gathering directions - \(5\) A Ministerial authorisation under paragraph \(2\)\(a\) or \(b\): - \(a\) is generally applicable to the incident and the asset or assets concerned; and - \(b\) is to be made without reference to any specific directions\. - \(6\) The Minister must not give a Ministerial authorisation under paragraph \(2\)\(a\) or \(b\) unless the Minister is satisfied that the directions that could be authorised by the Ministerial authorisation are likely to facilitate a practical and effective response to the incident\. ###### Action directions - \(7\) The Minister must not give a Ministerial authorisation under paragraph \(2\)\(c\) or \(d\) in relation to a specified entity unless the Minister is satisfied that: - \(a\) the specified entity is unwilling or unable to take all reasonable steps to respond to the incident; and - \(b\) the specified direction is reasonably necessary for the purposes of responding to the incident; and - \(c\) the specified direction is a proportionate response to the incident; and - \(d\) compliance with the specified direction is technically feasible\. Note: Section 12P provides examples of responding to an incident \(including a cyber security incident\)\. - \(8\) In determining whether the specified direction is a proportionate response to the incident, the Minister must have regard to: - \(a\) the impact of the specified direction on: - \(i\) the activities carried on by the specified entity; and - \(ii\) the functioning of the asset or assets concerned; and - \(b\) the consequences of compliance with the specified direction; and - \(c\) such other matters \(if any\) as the Minister considers relevant\. - \(9\) The Minister must not give a Ministerial authorisation under paragraph \(2\)\(c\) or \(d\) in relation to a specified entity if the specified direction: - \(a\) requires the specified entity to permit the authorised agency to do an act or thing that could be the subject of a request under section 35AX; or - \(b\) requires the specified entity to take offensive cyber action against a person who is directly or indirectly responsible for the incident\. - \(9A\) Without limiting paragraph \(2\)\(c\) or \(d\), a direction referred to in that paragraph may require a specified entity to disclose specified personal information \(within the meaning of the Privacy Act 1988\) held by the entity to another specified entity for a specified purpose\. - \(9B\) However, the Minister must not give a Ministerial authorisation under paragraph \(2\)\(c\) or \(d\), to the extent that it authorises the giving of a direction covered by subsection \(9A\), unless the Minister has obtained the agreement of the Minister administering the Privacy Act 1988\. ###### Intervention requests - \(10\) The Minister must not give a Ministerial authorisation under paragraph \(2\)\(e\) or \(f\) that relates to the incident and an asset unless the Minister is satisfied that: - \(aa\) the incident is a cyber security incident; and - \(a\) giving a Ministerial authorisation under paragraph \(2\)\(c\) or \(d\) would not amount to a practical and effective response to the incident; and - \(b\) if there is only one relevant entity for the asset—the relevant entity is unwilling or unable to take all reasonable steps to respond to the incident; and - \(c\) if there are 2 or more relevant entities for the asset—those entities, when considered together, are unwilling or unable to take all reasonable steps to respond to the incident; and - \(d\) the specified request is reasonably necessary for the purposes of responding to the incident; and - \(e\) the specified request is a proportionate response to the incident; and - \(f\) compliance with the specified request is technically feasible; and - \(g\) each of the acts or things specified in the specified request is an act or thing of a kind covered by section 35AC\. Note: Section 12P provides examples of responding to a cyber security incident\. - \(11\) In determining whether the specified request is a proportionate response to the incident, the Minister must have regard to: - \(a\) the impact of compliance with the specified request on the functioning of the asset; and - \(b\) the consequences of acts or things that would be done in compliance with the specified request; and - \(c\) such other matters \(if any\) as the Minister considers relevant\. - \(12\) The Minister must not give a Ministerial authorisation under paragraph \(2\)\(e\) or \(f\) if compliance with the specified request would involve the authorised agency taking offensive cyber action against a person who is directly or indirectly responsible for the incident\. - \(13\) The Minister must not give a Ministerial authorisation under paragraph \(2\)\(e\) or \(f\) unless the Minister has obtained the agreement of: - \(a\) the Prime Minister; and - \(b\) the Defence Minister\. - \(14\) An agreement under subsection \(13\) may be given: - \(a\) orally; or - \(b\) in writing\. - \(15\) If an agreement under subsection \(13\) is given orally, the Prime Minister or the Defence Minister, as the case requires, must: - \(a\) do both of the following: - \(i\) make a written record of the agreement; - \(ii\) give a copy of the written record of the agreement to the Minister; and - \(b\) do so within 48 hours after the agreement is given\. ###### Ministerial authorisation is not a legislative instrument - \(16\) A Ministerial authorisation is not a legislative instrument\. ###### Other powers not limited - \(17\) This section does not, by implication, limit a power conferred by another provision of this Act\. --- ## Source and attribution Saved copy: C2018A00029 / C2026C00213 / f578e546a17068939a3a5a928474713f844dfae8 Scope: navPoint\_173 Compiled 2026\-06\-04\. This does not establish legal commencement\. Official source: https://www\.legislation\.gov\.au/C2018A00029/2026\-06\-04/2026\-06\-04/text/1/epub/OEBPS/document\_1/document\_1\.html Licence: https://creativecommons\.org/licenses/by/4\.0/ Based on content from the Federal Register of Legislation at 1 October 2026\. For the latest information on Australian Government legislation please go to https://www\.legislation\.gov\.au\. Converted XHTML into Tiptap JSON; recovered lists from paragraph classes; kept literal labels and text\. Print layout is changed\. The Commonwealth Coat of Arms is not covered by the CC BY licence\.