Vikas Thakur / / 13 min readUnder the Cyber Security Act 2024, a business with turnover over $3 million that pays a ransomware demand has 72 hours to report it to the Australian Signals Directorate. Here is who is caught, what the report needs, and what to build into your incident response workflow.
Vikas Thakur / / 13 min readBefore and after photos taken on a staff phone, saved into a practice management platform, or synced to a cloud photo library are all personal information under the Privacy Act, and moving them to an overseas recipient triggers Australian Privacy Principle 8. Here is where clinical photos actually end up in a typical cosmetic clinic, and what to check before the next one is taken.
Vikas Thakur / / 11 min readA $3 million turnover threshold exempts most small businesses from the Privacy Act. Cosmetic clinics and dental practices are not among them, because section 6D(4)(b) removes the exemption for any business that provides a health service and holds health information.
Vikas Thakur / / 12 min readGoogle Analytics 4 fires some events automatically and needs others built by hand, and one of the six a clinic booking funnel depends on can echo a treatment name straight into a tracking parameter. Here is which six to set up, and which two need a second look before they ship.
Vikas Thakur / / 13 min readGoogle Analytics 4 does not log or store IP addresses by default, but Enhanced Measurement still sends the full page URL on every event, and a URL like /book/dermal-fillers carries the same kind of health inference the OAIC targeted in its June 2026 tracking-pixel determinations. Six settings, checked in the right order, change how much of that leaves your property.
Vikas Thakur / / 10 min readHealth service providers reported 225 data breach notifications in 2025, more than any other sector, according to the OAIC. Here is where a clinic or dental practice website creates that exposure and what to fix in the build.
