The Department of Home Affairs on 3 July 2026 launched a public consultation on draft amendments to the Security of Critical Infrastructure (SOCI) Act 2018, the legislation that underpins security obligations at Australia’s airports, seaports, data centres and other nationally significant facilities. Although the review is primarily framed as a cyber-security and resilience exercise, proposed changes could reshape compliance settings for airlines, freight operators and even cruise-ship terminals. Among the headline proposals are plans to reduce regulatory duplication across transport hubs, clarify governance expectations and create more agile mechanisms for adding new asset classes when emerging threats materialise. For the travel sector, one practical implication is that airport operators may face streamlined—but more targeted—risk-management program audits, potentially cutting red-tape costs while raising penalties for non-compliance. The consultation follows an independent review delivered by cybersecurity expert Dr Jill Slay AM in January, which found the Act effective but overly complex. Home Affairs will host three virtual town-hall sessions in July before the comment period closes on 31 July 2026. Feedback will inform a second-tranche bill slated for Parliament later this year. Businesses that operate, lease or rely on infrastructure covered by SOCI—airlines, ground-handling companies, border-technology vendors and shipping lines—are encouraged to lodge submissions. Mobility managers should pay attention to any tweaks that might affect biometric-processing equipment or passenger-data obligations, as these flow directly into day-to-day traveller processing. Given the Act’s extraterritorial data-sharing elements, multinational firms are advised to coordinate commentary through global compliance teams to ensure Australian obligations dovetail with EU GDPR and US CBP requirements.
Source: Department of Home Affairs
