Security of Critical Infrastructure Act 2018 (SOCI) s12F(3): Tell a data storage or processing provider that it holds business critical data

When the responsible entity for a critical infrastructure asset becomes aware that another entity provides it, on a commercial basis, a data storage or processing service relating to business critical data (personal information of at least 20,000 individuals, research and development, systems needed to operate the asset, operating information, risk management and continuity information), it must take reasonable steps to inform that provider, as soon as practicable. The notice is what makes the provider's asset a critical data storage or processing asset under s 12F(2).