$1.$ Comment:

$2.$ Can you identify the legislation and tell us about them, as per the question requirement "explain the Australian legislation associated with data protection$?$

$3.$ Comment:

can you be more specific:

$$ What are the laws that were breached?

$$ What are the legal issues$/$consequences of having a data breach?

$3.$Comment:

For the NZ Crimes Act of $1961$ are you able to research and identify how it is associated with Cyber Security, consider reviewing what it states for Cybercrime offences.

$4.$Comment:

For the Bring Your OWN Device Policy, what is it$,$ what should it cover?

Also, Data management policy, why is it needed what should it cover?

$6.$ Comment:

Part $1$ is asking about risks $"$ a risk is an area where if exploited, it could be leveraged by a cyber$-$attack" a risk is the potential for something to occur

so in the example of Data breach, the risk will be Data theft

Please update part $1$

$9.$ Comment:

I am not sure how Number $1$ fits into Training. Consider what information you might provide them and equip them with to train them or keep them informed.

$11.$ Comment:

In this question we are looking for Practices, invest in security systems is not a practice an organisation might look to implement.

$12.$ Comment:

please read over your answers, could or do you mean cloud?

also when you state poor cyber hygiene, what is the threat?