Security of Critical Infrastructure Act 2018 (SOCI) s45: Handle protected information only as the Act authorises

Protected information (relevant information obtained, generated or adopted under or to comply with the Act, including programs, annual reports, incident reports, incident response plans, evaluation and vulnerability reports, and the fact of declarations, SoNS status, directions and authorisations, where it could prejudice security, defence or stability, is confidential commercial information, or could prejudice an asset's security) may be recorded, used or disclosed only as authorised: for functions under the Act, by a relevant entity for the asset's continued operation or to mitigate risks to it, by the entity it relates to (to relevant Ministers and agencies, with the Secretary's consent, or for its business affairs), to the IGIS or Ombudsman, or as other laws require (the Corporations Act does not authorise disclosing declarations). Unauthorised use or disclosure is an offence.