Notifiable Data Breach Scheme: Australia's Mandatory Breach Reporting Guide

Australia's Mandatory Breach Notification Framework

Since February 22, 2018, Australian organizations covered by the Privacy Act 1988 have been required to notify the Office of the Australian Information Commissioner (OAIC) and affected individuals when a data breach is likely to result in serious harm. This is the Notifiable Data Breaches (NDB) scheme, established by Part IIIC of the Privacy Act.

The NDB scheme applies to all entities that have obligations under the Australian Privacy Principles (APPs) — organizations with annual turnover exceeding AUD 3 million, all health service providers, Australian Government agencies, credit reporting bodies, credit providers, and certain other entities regardless of size. If your organization is covered by the Privacy Act, the NDB scheme applies to you.

For a full overview of who is covered by the Privacy Act, see our Australian Privacy Act jurisdiction guide.

What Is an Eligible Data Breach?

Not every security incident triggers the NDB scheme. The scheme applies only to "eligible data breaches," which are defined by three elements:

1. Unauthorized Access, Disclosure, or Loss

An eligible data breach occurs when:

• Unauthorized access — someone who is not permitted to access personal information gains access to it (for example, a hacker, an unauthorized employee, or someone who finds an unencrypted device)
• Unauthorized disclosure — personal information is disclosed in a way that is not authorized (for example, sending an email to the wrong recipient, or a misconfigured database that exposes records publicly)
• Loss — the organization loses personal information in circumstances where unauthorized access or disclosure is likely (for example, a lost unencrypted laptop or USB drive)

Loss alone does not automatically trigger notification. It only becomes an eligible data breach if unauthorized access or disclosure is likely to have occurred as a result of the loss.

2. The Serious Harm Threshold

The breach must be likely to result in serious harm to any of the individuals whose personal information was involved. This is the key test. Not every breach meets this threshold.

The OAIC considers several factors when assessing whether serious harm is likely:

• The kind of information involved. Sensitive information (health, financial, government identifiers like Tax File Numbers) is more likely to result in serious harm than contact details alone.
• The sensitivity of the information. Even within non-sensitive categories, context matters. A home address is more sensitive for a domestic violence survivor than for the average person.
• Whether the information is protected by security measures. If breached data was encrypted with strong encryption and the key was not compromised, serious harm may be unlikely.
• The nature of the harm. Serious harm includes identity theft, financial loss, damage to reputation, physical harm, emotional distress, and loss of employment opportunities.
• Who has obtained the information. A breach to a known, trusted party (such as an accidental disclosure to another staff member) carries different risk than a breach to unknown external actors.
• Whether the organization has taken remedial action. Steps taken to contain the breach and mitigate potential harm are relevant to the assessment.

3. Remediation

If the organization takes action that ensures serious harm is no longer likely — for example, remotely wiping a lost device before anyone accesses it, or recalling a misdirected email before it is read — the breach may not be eligible for notification. However, you must be able to demonstrate that the remedial action was effective.

The Assessment Process

When a breach occurs (or is suspected), the Privacy Act requires organizations to take the following steps:

Step 1: Contain the Breach

Take immediate steps to limit the damage:

• Prevent further unauthorized access (change passwords, revoke access, patch vulnerabilities)
• Recover lost or stolen data or devices if possible
• Isolate affected systems
• Preserve evidence for investigation

Step 2: Assess the Breach

You must conduct a reasonable and expeditious assessment to determine whether the breach is an eligible data breach. The Privacy Act gives you 30 calendar days to complete this assessment from the day you become aware of the breach (or have reasonable grounds to suspect a breach has occurred).

During the assessment, determine:

• What personal information was involved
• How many individuals are affected
• What the likely consequences are for those individuals
• Whether the breach is likely to result in serious harm
• Whether remedial action has reduced the risk below the serious harm threshold

If at any point during the assessment you form the view that the breach is an eligible data breach, you must notify immediately — you do not need to wait for the assessment to be fully complete.

Step 3: Notify (If Required)

If the assessment determines that the breach is an eligible data breach — that is, unauthorized access, disclosure, or loss has occurred and it is likely to result in serious harm — you must notify both the OAIC and affected individuals.

OAIC Notification

The OAIC notification must include:

• The identity and contact details of your organization
• A description of the breach — what happened, when it happened, and what information was involved
• The kinds of information involved in the breach
• Recommendations for the affected individuals about steps they should take in response to the breach

The OAIC provides an online Notifiable Data Breach statement form on its website. This is the standard method for notifying the Commissioner.

Individual Notification

You must also notify each individual whose personal information was involved in the breach, or who is at risk of serious harm. The notification must include:

• The identity and contact details of your organization
• A description of the breach
• The kinds of information involved
• Recommendations about steps the individual should take

If it is not practicable to notify each individual directly (for example, you do not have current contact details), you must publish a notification on your website and take reasonable steps to publicize the notification.

The notification must be written in plain language that the individuals can understand. Avoid legal jargon and technical terms.

What If You Are Not Sure?

If you suspect a breach has occurred but are not yet sure whether it meets the eligible breach threshold, you are in the assessment phase. You have 30 days to complete the assessment, but you should act as quickly as possible. The OAIC has emphasized that the 30-day period is a maximum, not a target — assessments should be completed as quickly as reasonably possible.

If after a reasonable assessment you determine that serious harm is not likely, you do not need to notify. However, you should document your assessment, the factors you considered, and your conclusion. This documentation protects you if the OAIC later questions your decision.

Penalties for Non-Compliance

The penalty regime for serious or repeated privacy breaches in Australia was significantly strengthened in December 2022 by the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022. Maximum penalties for serious or repeated interferences with privacy are now:

• For bodies corporate: The greater of AUD 50 million, three times the value of any benefit obtained from the contravention, or 30% of the entity's adjusted turnover in the relevant period
• For individuals: AUD 2.5 million

Failure to comply with the NDB scheme — including failing to notify when required, or failing to conduct a timely assessment — can constitute an interference with privacy and attract these penalties.

The OAIC can also accept enforceable undertakings, make determinations requiring organizations to take specific actions, and seek civil penalties through the Federal Court.

Common Scenarios

Phishing attack resulting in compromised credentials: If an employee's credentials are compromised and the attacker accesses personal information in the organization's systems, this is unauthorized access. Assess whether the information accessed is likely to result in serious harm.

Misdirected email: Sending an email containing personal information to the wrong recipient is an unauthorized disclosure. Whether it meets the serious harm threshold depends on what information was in the email and who received it.

Ransomware: Ransomware attacks typically involve unauthorized access to personal information. Even if the data was not exfiltrated (only encrypted), the unauthorized access itself can constitute a breach. If there is any doubt about whether data was exfiltrated, assume it was and assess accordingly.

Lost or stolen devices: A lost laptop containing unencrypted personal information is a loss where unauthorized access is likely. If the device was encrypted with strong encryption and the password was not compromised, the risk of unauthorized access may be low enough that serious harm is unlikely.

Third-party breach: If a service provider you use suffers a breach affecting your customers' data, you may still have notification obligations. The NDB scheme places obligations on the entity that holds the information, which can include both the entity that collected it and the entity that stores or processes it.

Building a Breach Response Plan

Every organization covered by the NDB scheme should have a documented breach response plan. At minimum, it should include:

1. Who to contact — the internal breach response team, including senior management, legal counsel, IT, and communications
2. Containment procedures — standard steps for isolating affected systems and preventing further harm
3. Assessment framework — a structured approach to evaluating whether a breach is eligible, including the factors the OAIC considers
4. Notification templates — pre-drafted notification statements for the OAIC and for affected individuals, which can be customized per incident
5. Communication plan — how to communicate with affected individuals, the media, and other stakeholders
6. Post-incident review — a process for reviewing what happened, what went wrong, and how to prevent recurrence

Test your plan at least annually through tabletop exercises or simulations.

Related Guides

• Australian Privacy Act Jurisdiction Guide — full overview of the Privacy Act
• Data Protection Laws by Country — global comparison
• DSAR Record Keeping and Audit Trails — documentation best practices

References

• Privacy Act 1988 Part IIIC: Notification of eligible data breaches. Privacy Act
• OAIC NDB guidance: OAIC Notifiable Data Breaches
• OAIC NDB statement form: OAIC NDB form
• Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022: Legislation