The Notifiable Data Breaches (NDB) scheme has been part of the Privacy Act 1988 since February 2018. If your business is covered by the Privacy Act and personal information you hold is lost, stolen or accessed without permission, you may have to tell the people affected and the Office of the Australian Information Commissioner (OAIC). Penalties for serious privacy failures rose sharply in December 2022, so it pays to know the rules before something goes wrong.
What is an eligible data breach?
A data breach becomes an eligible data breach, and must be reported, when all three of these are true:
- personal information has been accessed or disclosed without authorisation, or lost in a way that makes that likely
- this is likely to result in serious harm to one or more of the people the information is about
- you have not been able to prevent the likely risk of serious harm with remedial action
Serious harm can be financial, physical, psychological, emotional or reputational. The OAIC reads “likely” as more probable than not. Common examples include identity theft, significant financial loss and threats to someone’s safety.
Your timeline: assess within 30 days, notify as soon as practicable
If you suspect an eligible data breach, you must take reasonable steps to complete an assessment within 30 calendar days of becoming aware of it. The OAIC expects 30 days to be the maximum, not the target, because the risk to people usually grows with time.
Once you know it is an eligible data breach, you must notify the OAIC and the affected individuals as soon as practicable. The statement must include your organisation’s name and contact details, a description of the breach, the kinds of information involved and the steps people should take in response.
The OAIC recommends four steps for responding to any data breach:
- Contain the breach to stop further loss.
- Assess the risk of serious harm to the people involved.
- Notify the OAIC and affected individuals if it is an eligible data breach.
- Review what happened and fix the cause so it does not happen again.
Which businesses need to comply?
The NDB scheme applies to organisations covered by the Privacy Act. That includes:
- businesses and not-for-profit organisations with annual turnover of more than $3 million
- private sector health service providers of any size, such as medical and allied health practices and pharmacies
- credit reporting bodies and credit providers
- businesses that trade in personal information
- tax file number (TFN) recipients, for the TFN information they hold
- Australian Government agencies
This is not a complete list. If you are unsure whether the scheme applies to you, check the OAIC guidance or ask us.
What are the penalties?
Since December 2022, the maximum civil penalty for a company that seriously interferes with privacy is the greater of:
- $50 million
- three times the value of the benefit obtained from the conduct, or
- if that benefit cannot be worked out, 30% of the company’s adjusted turnover for the relevant period.
For individuals, the maximum is $2.5 million. The figure of $2.1 million that is still quoted on many websites is out of date.
Ransomware payments have their own deadline
If your business has annual turnover of more than $3 million and makes a ransomware or cyber extortion payment, the Cyber Security Act 2024 requires you to report it to the Australian Signals Directorate within 72 hours. Not reporting can attract a civil penalty of up to 60 penalty units. This is separate from the NDB scheme, so one ransomware incident can trigger both obligations.
How GCIT can help
GCIT is an ISO 27001 certified managed IT and cyber security provider based on the Gold Coast. We help businesses:
- work out whether the NDB scheme applies to them
- prepare a data breach response plan before they need it
- investigate a suspected breach in Microsoft 365 and gather the evidence for the 30-day assessment, through our insider threat investigation service
- contain and recover from a cyber incident through our incident response service
If you think you have a breach right now, call our support team on 1300 369 111. To talk about your obligations, call 0755 999 999 or send us a message below.
Sources
- OAIC, About the Notifiable Data Breaches scheme
- OAIC, When to report a data breach
- OAIC, Data breach preparation and response, Part 4: Notifiable Data Breach (NDB) scheme (ss 26WE, 26WH, 26WK, 26WL)
- OAIC, Guide to privacy regulatory action, Chapter 7: Civil penalties (s 13G)
- Privacy Act 1988 and Cyber Security Act 2024 (s 27), Federal Register of Legislation
- ASD, Ransomware payment and cyber extortion payment reporting