Notifiable Data Breach requirements in Australia
Think you have a breach right now? Existing clients, call our support team on 1300 369 111.
What is an eligible data breach?
Serious harm can be financial, physical, psychological, emotional or reputational. The OAIC reads “likely” as more probable than not. Common examples include identity theft, significant financial loss and threats to someone’s safety.
A data breach is an eligible data breach, and must be reported, when all three of these are true
- Personal information has been accessed or disclosed without authorisation, or lost in a way that makes that likely
- This is likely to result in serious harm to one or more of the people the information is about
- You have not been able to prevent the likely risk of serious harm with remedial action
Your timeline: assess within 30 days, notify as soon as practicable
If you suspect an eligible data breach, you must take reasonable steps to complete an assessment within 30 calendar days of becoming aware of it. The OAIC expects 30 days to be the maximum, not the target, because the risk to people usually grows with time.
Once you know it is an eligible data breach, you must notify the OAIC and the affected individuals as soon as practicable. The statement must include your organisation’s name and contact details, a description of the breach, the kinds of information involved and the steps people should take in response.
The OAIC recommends four steps for responding to any data breach
01
Contain
Contain the breach to stop further loss.
02
Assess
Assess the risk of serious harm to the people involved.
03
Notify
Notify the OAIC and affected individuals if it is an eligible data breach.
04
Review
Review what happened and fix the cause so it does not happen again.
Which businesses need to comply?
The NDB scheme applies to organisations covered by the Privacy Act. This is not a complete list. If you are unsure whether the scheme applies to you, check the OAIC guidance or ask us.
- Businesses and not-for-profit organisations with annual turnover of more than $3 million
- Private sector health service providers of any size, such as medical and allied health practices and pharmacies
- Credit reporting bodies and credit providers
- Businesses that trade in personal information
- Tax file number (TFN) recipients, for the TFN information they hold
- Australian Government agencies
What are the penalties?
Ransomware payments have their own deadline
If your business has annual turnover of more than $3 million and makes a ransomware or cyber extortion payment, the Cyber Security Act 2024 requires you to report it to the Australian Signals Directorate within 72 hours. Not reporting can attract a civil penalty of up to 60 penalty units. This is separate from the NDB scheme, so one ransomware incident can trigger both obligations.
Using Microsoft 365? Read our guide to protecting data with Microsoft 365 encryption.
Sources
- OAIC, About the Notifiable Data Breaches scheme
- OAIC, When to report a data breach
- OAIC, Data breach preparation and response, Part 4: Notifiable Data Breach (NDB) scheme (ss 26WE, 26WH, 26WK, 26WL)
- OAIC, Guide to privacy regulatory action, Chapter 7: Civil penalties (s 13G)
- Privacy Act 1988 and Cyber Security Act 2024 (s 27), Federal Register of Legislation
- ASD, Ransomware payment and cyber extortion payment reporting