General information about the law, not legal advice. Each guide names the official place to check.
00 · the timetableThe clocks, side by side
The first deadline in each regime, and what follows it. Each row is a summary; the guide behind it has the law’s own words.
| Regime | The clock starts when | First deadline | Then |
|---|---|---|---|
| A work incident in Queensland | The person conducting the business or undertaking becomes aware that a notifiable incident arising out of it has occurred (Work Health and Safety Act 2011, s 38). | Immediately | After a phone notice, a written notice within 48 hours if the regulator requires one. A record kept for at least 5 years. |
| A work incident in Victoria | An employer or self-employed person becomes aware of an incident at a workplace they manage and control (Occupational Health and Safety Act 2004, s 38). | Immediately | A written record to the regulator within 48 hours, and a copy kept for at least 5 years. |
| A cyber incident on a critical infrastructure asset covered by Part 2B | The responsible entity for an asset that Part 2B of the Security of Critical Infrastructure Act 2018 applies to becomes aware of the incident (ss 30BB, 30BC and 30BD). | 12 h or 72 h | 12 hours for a significant impact on the asset’s availability, 72 hours for a relevant impact. After a report made orally, a written record within 84 or 48 hours. |
| A ransomware payment | The payment is made, or the business becomes aware that it has been made on its behalf (Cyber Security Act 2024, s 27, in Part 3, which commenced on 29 May 2025). | 72 h | One report, about the payment, to the designated Commonwealth body. |
| A product linked to a death or serious injury or illness | A supplier of consumer goods becomes aware of the death, injury or illness, and considers, or learns that someone else considers, that the goods caused it or may have (Australian Consumer Law, s 131). | 2 days | A written notice to the Commonwealth Minister. |
| Environmental harm in Queensland | A person becomes aware, or ought reasonably to have become aware, of an event that causes or threatens serious or material environmental harm (Environmental Protection Act 1994, ss 320A to 320D). | 24 h | Notice to the occupiers or registered owners of affected land, or public notice, as soon as reasonably practicable. |
01 · the starting gunWhen each clock starts
The deadlines are easy to compare. The moments they run from are not, and a business that reads only the number can miss the start.
- Becoming aware. The Queensland and Victorian work duties, the critical infrastructure reports and the supplier’s report all run from the moment the duty holder becomes aware.
- Ought to have known. Queensland’s environmental duty also runs from “the time when the person ought reasonably to have become aware of the event”, so it can run from a time when the person did not yet know, but should have.
- Paying. The ransomware report runs from making the payment, or from becoming aware that it has been made.
- The follow-up. Written follow-ups keep their own time. Victoria’s 48 hours run from being required to notify; Queensland’s run from when the regulator requires a written notice; the critical infrastructure written records run from when the oral report is given.
For critical infrastructure reports, the national guidance adds that an entity “is not considered to become aware merely because an automated system has detected an incident”, and that it becomes aware on confirmation, or when it should have if it had followed its own monitoring and escalation processes.
02 · overlapsOne event, more than one clock
The regimes run side by side. A ransomware attack on a critical infrastructure asset can call for a cyber incident report under the SOCI Act and, if a ransom is paid, a separate payment report. The national guidance on critical infrastructure incidents puts it plainly: “You may need to consider whether you have ransomware payment reporting obligations under the Cyber Security Act 2024.” That Act counts the responsible entity for an asset to which Part 2B of the SOCI Act applies as a reporting business entity under its own limb, which has no turnover test.
The supplier’s two-day report has a carve-out of its own: it does not apply where the supplier or another person is required to notify the death, injury or illness under a law, or an industry code of practice, specified in the regulations. Which laws and codes those are is a question for the regulations, which this guide does not set out.
03 · the guidesFive regimes, one guide each
- Notifiable incidents at work in Queensland and VictoriaWhat counts, the immediate notice, the site kept for an inspector (some action, such as helping the injured, is still allowed), and the five-year record.
- Ransomware payments: the 72-hour reportA report about a payment, owed by a business, other than a Commonwealth or State body or a critical infrastructure responsible entity, whose turnover for the previous financial year exceeds $3 million (for a business carried on for only part of that year, a threshold worked out by a formula), or by the responsible entity for a critical infrastructure asset that Part 2B of the SOCI Act applies to.
- Critical infrastructure cyber incidents: 12 and 72 hoursThe two reports under Part 2B of the SOCI Act, and what makes an impact significant or relevant.
- Product incidents: a supplier’s two-day reportSection 131 of the Australian Consumer Law, its four exceptions, and what the notice must say.
- Environmental incidents in Queensland: the duty to notifyWho tells whom within 24 hours under sections 320A to 320G of the Environmental Protection Act 1994, and the notices to people on affected land.