Sydney Data Protection & Security Summit 2027

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

As AI reshapes how organisations collect, process, and act on data, the old framing of data protection as a defensive cost centre is running out of road — this keynote sets the tone for the day by reframing trust, security, and privacy as the foundation for whether AI-driven transformation succeeds or stalls.

• With customers, regulators, and employees increasingly wary of how their data fuels AI systems, the organisations that treat transparency and control as differentiators (not just compliance obligations) are the ones building durable advantage.
• Why the mindset shift from "responding to breaches" to "architecting for inevitability" is what separates organisations that recover quickly from those that suffer lasting reputational and regulatory damage.
• Framing the questions every session will return to: Who's accountable when AI systems handle sensitive data? What does "good enough" security look like when threats and technology are both moving this fast? And how do leaders balance urgency with judgement?

As AI copilots, agents, and analytics tools require broader, faster access to enterprise data to deliver value, organisations face a widening tension between empowering AI-augmented employees and maintaining the access discipline that data protection has always depended on.

• How AI agents and copilots blur the traditional boundary between "user" and "system," and why identity and access management frameworks built for people don't cleanly extend to autonomous tools.
• Moving away from broad, standing permissions toward dynamic, context-aware access that grants AI tools and employees only what's needed for the task at hand.
• Giving finance and business leaders a practical framework for weighing productivity gains from broader data access against quantifiable increases in breach exposure and regulatory risk.

Privacy and security leaders are no longer managing one regulatory relationship; they're navigating overlapping and sometimes conflicting obligations across privacy law reform, sector-specific rules, and emerging AI governance requirements, often with limited resourcing to do it all well.

• Practical approaches to building compliance programs flexible enough to absorb reform without constant rebuilds.
• How organisations operating across APAC are managing divergent data residency and transfer requirements without duplicating infrastructure for every jurisdiction.
• Shifting compliance from a post-hoc legal review into an input that shapes how AI and data systems are architected from day one.

With employees adopting AI tools faster than IT could track or approve them, one security leader built a discovery and governance approach that brought unauthorised AI usage into the light — without triggering a workforce backlash or slowing legitimate innovation.

• How the team mapped unsanctioned AI tool usage across the organisation before deciding on any policy response, since you can't govern what you can't see.
• Designing an approval pathway fast enough that employees chose to use it rather than route around it, turning shadow AI into managed AI.
• Building lightweight, continuous visibility into new AI tools.

A hands-on, interactive session working through a real data protection and security scenario as a room. Details announced soon.

With critical infrastructure and legacy platforms too costly or risky to replace outright, one security leader built a layered protection strategy that meaningfully reduced risk exposure without waiting for a full modernisation program.

• Triaging legacy system vulnerabilities realistically, rather than pursuing an unachievable "patch everything" strategy.
• How network segmentation, enhanced monitoring, and strict access controls around legacy systems provided durable risk reduction, not just a stopgap.
• Building the business case for ongoing investment in legacy security, when the instinct is often to deprioritise spending on systems slated for eventual retirement.

After years of data classification policies that existed on paper but were ignored in practice, one data protection leader built a classification approach employees actually followed, turning a compliance exercise into a functioning control.

• Recognising that asking employees to correctly label sensitive data by hand was never going to scale, and redesigning around automated detection instead.
• How classification was built into the tools people already used daily, rather than requiring a separate step that competed with getting work done.
• How accurate classification became the foundation for access controls, DLP policies, and AI governance decisions downstream.

As AI systems make decisions with real legal and financial consequences, organisations are discovering that liability frameworks built for human decision-making don't map cleanly onto AI-driven processes; leaving legal, privacy, and security leaders to navigate accountability, contracts, and customer trust largely without settled precedent.

• When an AI system's decision leads to a data breach, discriminatory outcome, or regulatory breach, how are legal teams currently allocating fault between the organisation, the AI vendor, and the underlying model provider; and where does existing law simply not have an answer yet?
• How eroded customer trust following an AI-related incident is increasingly translating into legal action and what that means for how legal and privacy teams collaborate on incident response.
• Exploring the tension between regulatory and legal expectations for transparency and explainability, and the practical reality that many AI systems can't yet provide a clear, defensible account of how a specific decision was made.

Small-group, discussion-based sessions where you'll work through real data protection and security challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

Facing a security team stretched thin and alert fatigue eroding response quality, one CISO restructured detection and triage around automation and prioritisation; dramatically compressing the time between compromise and containment.

• How the team re-engineered alert prioritisation so analysts spent time on genuine threats instead of drowning in low-value notifications.
• Where automated containment actions (isolating endpoints, revoking access) were safely delegated to systems versus kept as human decisions.
• How the leader secured budget and buy-in for detection tooling improvements proactively, before an incident forced the issue.

As AI accelerates both attack sophistication and organisational response capabilities, traditional incident response playbooks are becoming dangerously outdated, forcing security leaders to rebuild readiness around machine-speed detection and response.

• How AI-powered attacks (automated phishing, deepfake-enabled social engineering, AI-assisted lateral movement) have shrunk the window between initial compromise and material damage, and what that means for detection SLAs.
• Where automated triage and containment genuinely reduce risk versus where removing human judgement from the incident response chain creates new liability.
• How faster, more complex breaches are colliding with notification obligations under the Australian Privacy Act, and what "reasonable steps" now looks like when regulators expect speed AI hasn't universally delivered yet.

As enterprises rely on growing networks of AI vendors, SaaS platforms, and outsourced service providers, sensitive data increasingly flows through systems organisations neither built nor fully control; turning vendor risk management into one of the hardest unsolved problems in data protection.

• Why static vendor assessments fail to capture real-time risk, and what continuous monitoring of third-party access actually looks like in practice.
• The unique challenges of assessing AI and model providers, where questions about training data use, data retention, and model behaviour go beyond traditional security due diligence.
• Lessons from real incidents on managing incident response, regulatory notification, and reputational fallout when the failure originated outside your own walls.

Unwind with your peers for a couple of drinks on us!

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

As AI reshapes how organisations collect, process, and act on data, the old framing of data protection as a defensive cost centre is running out of road — this keynote sets the tone for the day by reframing trust, security, and privacy as the foundation for whether AI-driven transformation succeeds or stalls.

• With customers, regulators, and employees increasingly wary of how their data fuels AI systems, the organisations that treat transparency and control as differentiators (not just compliance obligations) are the ones building durable advantage.
• Why the mindset shift from "responding to breaches" to "architecting for inevitability" is what separates organisations that recover quickly from those that suffer lasting reputational and regulatory damage.
• Framing the questions every session will return to: Who's accountable when AI systems handle sensitive data? What does "good enough" security look like when threats and technology are both moving this fast? And how do leaders balance urgency with judgement?

As AI copilots, agents, and analytics tools require broader, faster access to enterprise data to deliver value, organisations face a widening tension between empowering AI-augmented employees and maintaining the access discipline that data protection has always depended on.

• How AI agents and copilots blur the traditional boundary between "user" and "system," and why identity and access management frameworks built for people don't cleanly extend to autonomous tools.
• Moving away from broad, standing permissions toward dynamic, context-aware access that grants AI tools and employees only what's needed for the task at hand.
• Giving finance and business leaders a practical framework for weighing productivity gains from broader data access against quantifiable increases in breach exposure and regulatory risk.

Privacy and security leaders are no longer managing one regulatory relationship; they're navigating overlapping and sometimes conflicting obligations across privacy law reform, sector-specific rules, and emerging AI governance requirements, often with limited resourcing to do it all well.

• Practical approaches to building compliance programs flexible enough to absorb reform without constant rebuilds.
• How organisations operating across APAC are managing divergent data residency and transfer requirements without duplicating infrastructure for every jurisdiction.
• Shifting compliance from a post-hoc legal review into an input that shapes how AI and data systems are architected from day one.

With employees adopting AI tools faster than IT could track or approve them, one security leader built a discovery and governance approach that brought unauthorised AI usage into the light — without triggering a workforce backlash or slowing legitimate innovation.

• How the team mapped unsanctioned AI tool usage across the organisation before deciding on any policy response, since you can't govern what you can't see.
• Designing an approval pathway fast enough that employees chose to use it rather than route around it, turning shadow AI into managed AI.
• Building lightweight, continuous visibility into new AI tools.

A hands-on, interactive session working through a real data protection and security scenario as a room. Details announced soon.

With critical infrastructure and legacy platforms too costly or risky to replace outright, one security leader built a layered protection strategy that meaningfully reduced risk exposure without waiting for a full modernisation program.

• Triaging legacy system vulnerabilities realistically, rather than pursuing an unachievable "patch everything" strategy.
• How network segmentation, enhanced monitoring, and strict access controls around legacy systems provided durable risk reduction, not just a stopgap.
• Building the business case for ongoing investment in legacy security, when the instinct is often to deprioritise spending on systems slated for eventual retirement.

After years of data classification policies that existed on paper but were ignored in practice, one data protection leader built a classification approach employees actually followed, turning a compliance exercise into a functioning control.

• Recognising that asking employees to correctly label sensitive data by hand was never going to scale, and redesigning around automated detection instead.
• How classification was built into the tools people already used daily, rather than requiring a separate step that competed with getting work done.
• How accurate classification became the foundation for access controls, DLP policies, and AI governance decisions downstream.

As AI systems make decisions with real legal and financial consequences, organisations are discovering that liability frameworks built for human decision-making don't map cleanly onto AI-driven processes; leaving legal, privacy, and security leaders to navigate accountability, contracts, and customer trust largely without settled precedent.

• When an AI system's decision leads to a data breach, discriminatory outcome, or regulatory breach, how are legal teams currently allocating fault between the organisation, the AI vendor, and the underlying model provider; and where does existing law simply not have an answer yet?
• How eroded customer trust following an AI-related incident is increasingly translating into legal action and what that means for how legal and privacy teams collaborate on incident response.
• Exploring the tension between regulatory and legal expectations for transparency and explainability, and the practical reality that many AI systems can't yet provide a clear, defensible account of how a specific decision was made.

Small-group, discussion-based sessions where you'll work through real data protection and security challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

Facing a security team stretched thin and alert fatigue eroding response quality, one CISO restructured detection and triage around automation and prioritisation; dramatically compressing the time between compromise and containment.

• How the team re-engineered alert prioritisation so analysts spent time on genuine threats instead of drowning in low-value notifications.
• Where automated containment actions (isolating endpoints, revoking access) were safely delegated to systems versus kept as human decisions.
• How the leader secured budget and buy-in for detection tooling improvements proactively, before an incident forced the issue.

As AI accelerates both attack sophistication and organisational response capabilities, traditional incident response playbooks are becoming dangerously outdated, forcing security leaders to rebuild readiness around machine-speed detection and response.

• How AI-powered attacks (automated phishing, deepfake-enabled social engineering, AI-assisted lateral movement) have shrunk the window between initial compromise and material damage, and what that means for detection SLAs.
• Where automated triage and containment genuinely reduce risk versus where removing human judgement from the incident response chain creates new liability.
• How faster, more complex breaches are colliding with notification obligations under the Australian Privacy Act, and what "reasonable steps" now looks like when regulators expect speed AI hasn't universally delivered yet.

As enterprises rely on growing networks of AI vendors, SaaS platforms, and outsourced service providers, sensitive data increasingly flows through systems organisations neither built nor fully control; turning vendor risk management into one of the hardest unsolved problems in data protection.

• Why static vendor assessments fail to capture real-time risk, and what continuous monitoring of third-party access actually looks like in practice.
• The unique challenges of assessing AI and model providers, where questions about training data use, data retention, and model behaviour go beyond traditional security due diligence.
• Lessons from real incidents on managing incident response, regulatory notification, and reputational fallout when the failure originated outside your own walls.

Unwind with your peers for a couple of drinks on us!