##### 12F  Meaning of critical data storage or processing asset - \(1\) An asset is a critical data storage or processing asset if: - \(a\) it is owned or operated by an entity that is a data storage or processing provider; and - \(b\) it is used wholly or primarily to provide a data storage or processing service that relates to business critical data and that is provided by the entity to an end‑user that is: - \(i\) the Commonwealth; or - \(ii\) a body corporate established by a law of the Commonwealth; or - \(iii\) a State; or - \(iv\) a body corporate established by a law of a State; or - \(v\) a Territory; or - \(vi\) a body corporate established by a law of a Territory; and - \(c\) the entity knows that the asset is used as described in paragraph \(b\); and - \(d\) the asset is not a critical infrastructure asset that is covered by a paragraph of subsection 9\(1\) \(other than paragraph 9\(1\)\(d\)\)\. Note 1: The rules may prescribe that a specified critical data storage or processing asset is not a critical infrastructure asset \(see section 9\)\. Note 2: A critical data storage or processing asset that is owned or operated by a carrier may also be a critical telecommunications asset\. - \(2\) An asset is a critical data storage or processing asset if: - \(a\) it is owned or operated by an entity that is a data storage or processing provider; and - \(b\) it is used wholly or primarily to provide a data storage or processing service that: - \(i\) is provided by the entity to an end‑user that is the responsible entity for a critical infrastructure asset; and - \(ii\) relates to business critical data; and - \(c\) the entity knows that the asset is used as described in paragraph \(b\); and - \(d\) the asset is not a critical infrastructure asset that is covered by a paragraph of subsection 9\(1\) \(other than paragraph 9\(1\)\(d\)\)\. Note 1: The rules may prescribe that a specified critical data storage or processing asset is not a critical infrastructure asset \(see section 9\)\. Note 2: A critical data storage or processing asset that is owned or operated by a carrier may also be a critical telecommunications asset\. - \(3\) If: - \(a\) an entity \(the first entity\) is the responsible entity for a critical infrastructure asset; and - \(b\) the first entity becomes aware that a data storage or processing service: - \(i\) is provided by another entity on a commercial basis to the first entity; and - \(ii\) relates to business critical data; the first entity must: - \(c\) take reasonable steps to inform that other entity that the first entity has become aware that the data storage or processing service: - \(i\) is provided by the other entity on a commercial basis to the first entity; and - \(ii\) relates to business critical data; and - \(d\) do so as soon as practicable after becoming so aware\. Civil penalty for contravention of this subsection: 50 penalty units\. --- ## Source and attribution Saved copy: C2018A00029 / C2026C00213 / f578e546a17068939a3a5a928474713f844dfae8 Scope: navPoint\_29 Compiled 2026\-06\-04\. This does not establish legal commencement\. Official source: https://www\.legislation\.gov\.au/C2018A00029/2026\-06\-04/2026\-06\-04/text/1/epub/OEBPS/document\_1/document\_1\.html Licence: https://creativecommons\.org/licenses/by/4\.0/ Based on content from the Federal Register of Legislation at 1 October 2026\. For the latest information on Australian Government legislation please go to https://www\.legislation\.gov\.au\. Converted XHTML into Tiptap JSON; recovered lists from paragraph classes; kept literal labels and text\. Print layout is changed\. The Commonwealth Coat of Arms is not covered by the CC BY licence\.