How to develop a cyber and data security policy
- Author: Creative Australia
On this page
Why does cyber and data security matter?
As an arts and cultural organisation you may hold confidential information or sensitive data like:
- personal information about staff, volunteers, artists, audiences, donors and members
- financial records
- contracts
- artwork files
- board papers
- other internal documents.
A cyber and data security policy helps your organisation manage this information safely.
What should a cyber and data security policy do?
A cyber and data security policy explains how your organisation protects the information and systems it relies on. It should:
- set out how information is collected, stored, used, shared and protected
- help staff, volunteers, leaders and board members understand what they need to do
- be practical, clear and easy to apply
- reflect your organisation’s size and needs.
If you’re a small organisation with simple systems, you may only need a short policy. If you’re a larger organisation, or one that holds sensitive data, you may need more detailed rules and procedures.
Step 1. Understand what your policy needs to cover
Start by identifying what information you hold, where it is stored, who can access it and what could happen if it was lost, stolen, changed or shared without permission.
Good data handling helps protect the people and communities connected to your organisation.
Check whether privacy laws apply to you
If your organisation collects personal information, check whether the Privacy Act and Australian Privacy Principles apply to you. Seek legal advice if you are unsure.
The Privacy Act 1988 covers Australian Government agencies, organisations with annual turnover of more than $3 million and other organisations like small businesses and not-for-profits.
Step 2. Involve the right people
Board and management should agree how the organisation will manage cyber and data security. The board doesn’t need to manage every technical detail. It just needs to understand the main risks and ask how they’re being managed.
You may also need input from:
- staff and individuals: anyone who manages ticketing, donations, marketing and customer data
- experts: this can include IT providers, legal advisers, cyber security specialists and insurers.
When to seek specialist advice
You should seek specialist advice if your organisation handles sensitive information, uses complex systems, uses artificial intelligence tools, or you’re unsure about your organisation’s obligations.
Step 3. Decide what needs protection
Make a simple list of the information your organisation collects, creates or stores. This may include:
- personal information about staff, volunteers, artists, audiences, donors or members
- sensitive information, such as health, identity, access or demographic information
- financial information, including bank details and payment records
- contracts, board papers, legal documents and internal reports
- creative assets, unpublished material and intellectual property
- system logins, passwords and administrator access.
Step 4. Set clear roles and responsibilities
Your policy should make responsibilities clear. This helps people know who can approve access, respond to incidents, update procedures and report serious issues to the board.
Examples of roles and responsibilities
- The board oversees cyber and data security as part of organisational risk.
- The CEO or senior leader makes sure the policy is implemented.
- A nominated staff member or contractor manages systems, access and incident reporting.
- Staff and volunteers follow agreed procedures and report concerns quickly.
Step 5. Put safeguards in place
Most organisations can reduce risk with simple safeguards that people use consistently. Choose safeguards that match your systems, the information you hold and the resources you have.
Examples of safeguards
- Use strong passwords and multi-factor authentication where possible.
- Give people access only to the information and systems they need for their role.
- Remove access when staff, volunteers or contractors leave.
- Back up important information and test whether the backups can be restored.
- Keep software, devices and security tools up to date.
- Store sensitive information securely and avoid collecting information you do not need.
- Use secure disposal processes when information or devices are no longer needed.
Step 6. Plan how you’ll respond to an incident
A cyber incident can include a lost device, a suspicious email, an unauthorised login, accidental disclosure, ransomware or a data breach. Your policy should clearly explain what to do if someone suspects something’s gone wrong. This is known as an incident response plan.
Incident response plan
An incident response plan names the person or role responsible for coordinating the response. It should also explain how the organisation will:
- record the incident
- reduce further harm
- communicate with affected people
- contact service providers
- decide whether legal notification is required.
Step 7. Include artificial intelligence (AI) in your policy
Artificial intelligence (AI) can help organisations work more efficiently. But it can also create risks for privacy, data security, bias, accuracy, copyright, confidentiality and reputation. Treat artificial intelligence as a governance issue, not only a technology issue.
Boards and leaders should know where artificial intelligence is being used, including tools built into existing software. They should also set rules for what information must not be entered into public or third-party tools.
Examples of governing AI
- Do not enter confidential, personal or sensitive information into AI tools unless your organisation has approved the tool and checked the privacy, security and contract settings.
- Check AI outputs before using them for organisational decisions, public information or advice.
- Keep human oversight over decisions that affect people, communities, finances, legal obligations or organisational reputation.
- Review artificial intelligence use regularly as tools, risks and regulations change.
Step 8. Review the policy regularly
Cyber and data risks change quickly. You should review your policy regularly. It should be done at least once a year, after an incident or when there are significant changes. These changes might be to your systems, suppliers, activities or legal obligations.
When reviewing it, make sure the policy is:
- still accurate
- well understood by everyone, especially those with key responsibilities
- easy to follow in practice.
Cyber and data security policy template
Not sure where to start? Use our template to document your cyber and data security policy.
