Australian Data Breach Notification Scheme: A Complete 2026 Guide

If your personal information has ever been caught up in a company's data leak, Australia's Notifiable Data Breaches (NDB) scheme is the law that says someone has to tell you about it. It's also the reason you keep getting those awkward "we are writing to let you know" emails from banks, telcos, health insurers and online stores.

This 2026 guide explains how the Australian data breach notification scheme actually works, what you should do the moment you get a breach notice, and how Lunyb gives you a faster, calmer way to track exposed emails and phone numbers, lock down accounts, and spot the scams that always follow a leak. If you want the short version: don't wait for a letter in the post. Start with a free privacy check at lunyb.com and let Lunyb do the heavy lifting.

What is the Australian Data Breach Notification Scheme?

The Australian data breach notification scheme — officially the Notifiable Data Breaches (NDB) scheme — is a set of rules under Part IIIC of the Privacy Act 1988. It requires covered organisations to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to cause serious harm.

In plain English: if a company that holds your personal information suffers a hack, loses a laptop, emails your file to the wrong person, or has a database stolen, and that breach is likely to seriously harm you, they must tell you about it and tell the regulator.

When did the scheme start?

The NDB scheme commenced on 22 February 2018. Since then it has been strengthened by amendments to the Privacy Act, including significantly increased penalties for serious or repeated interferences with privacy, introduced after high-profile breaches at major Australian organisations.

Who does the scheme apply to?

The scheme applies to entities that already have obligations under the Australian Privacy Principles (APPs). These include:

• Australian Government agencies.
• Businesses and not-for-profits with an annual turnover of more than $3 million.
• Private sector health service providers (regardless of size).
• Credit reporting bodies, credit providers and tax file number recipients.
• Some small businesses that trade in personal information or provide certain services.

If one of these organisations holds your data and suffers an eligible data breach, the law expects them to act.

What counts as an "eligible data breach"?

An eligible data breach under the NDB scheme has three key ingredients:

1. There is unauthorised access to, unauthorised disclosure of, or loss of personal information held by the entity.
2. The access, disclosure or loss is likely to result in serious harm to one or more affected individuals.
3. The entity has been unable to prevent the likely risk of serious harm through remedial action.

"Serious harm" is deliberately broad. It can include financial loss, identity theft, physical safety risks (for example, a family violence situation where an address is exposed), damage to reputation, emotional distress, and psychological harm.

Common examples of eligible breaches

• A cyber attack that steals customer names, emails, phone numbers and ID documents.
• A ransomware incident where attackers exfiltrate personal records before encrypting systems.
• A staff member accidentally emailing a spreadsheet of patients or clients to the wrong distribution list.
• A lost or stolen company device containing unencrypted personal data.
• Credential stuffing attacks that expose account details, order history or addresses.

What organisations must do when a breach happens

The NDB scheme sets out a clear sequence. Understanding it helps you know what to expect — and when something looks off.

1. Contain the breach. Stop ongoing access, revoke credentials, isolate systems.
2. Assess within 30 days. Once an entity is aware there are reasonable grounds to suspect an eligible data breach, it has up to 30 days to carry out a reasonable and expeditious assessment.
3. Notify the OAIC. If the assessment confirms an eligible data breach, the entity must prepare a statement and give it to the Information Commissioner as soon as practicable.
4. Notify affected individuals. The entity must take reasonable steps to notify the people whose data was exposed, either directly or, where that's not practicable, via a public statement on its website.

What a proper breach notice should include

A compliant notification should set out:

• The identity and contact details of the organisation.
• A description of the breach.
• The kinds of personal information involved (for example, name, email, date of birth, ID numbers).
• Recommended steps you should take in response.

If a notice is vague, missing these details, or arrives as a link in an SMS, treat it carefully — scammers routinely impersonate breached brands. We'll come back to that.

Your rights as an Australian consumer

The NDB scheme sits inside a broader set of privacy rights. As an individual whose data was involved in a breach, you can:

• Be informed about breaches likely to cause you serious harm.
• Ask the organisation what information of yours was involved and how it was protected.
• Complain to the OAIC if you believe an organisation mishandled your data or failed to notify you.
• Request access to and correction of your personal information under the Australian Privacy Principles.
• Place a ban on your credit report with Australian credit reporting bodies (such as Equifax, illion and Experian) if you suspect identity theft.

Penalties for non-compliance

The Privacy Act now allows significant civil penalties for serious or repeated interferences with privacy. For companies, the maximum penalty can reach the greater of a very large fixed amount, three times the benefit obtained from the misuse of information, or a percentage of adjusted turnover. In short: the regulator has teeth, and it has used them.

What to do the moment you receive a breach notice

When a notice lands in your inbox, resist the urge to either panic or ignore it. Work through this checklist instead.

1. Confirm the notice is real. Go to the company's official website directly (don't click links in the email) and look for a published statement.
2. Read what was exposed. Email + password is different from name + address, which is different from ID documents like passport or driver licence numbers.
3. Change the password on that account, and on any other account where you reused it.
4. Turn on two-factor authentication wherever it's offered, preferably using an authenticator app rather than SMS.
5. Watch for scams for at least the next 6–12 months — phishing emails, fake "support" calls, and SMS messages pretending to be the breached brand.
6. If ID documents were leaked, consider requesting a replacement (for example, a new driver licence card number via your state transport authority) and placing a credit ban.
7. Document everything. Keep copies of the breach notice and any suspicious messages, in case you need to make a report.

Why manual breach response gets overwhelming fast

In theory, the NDB scheme means you'll always be told when your data is exposed. In reality:

• Not every breach meets the "likely serious harm" threshold, so you may never be notified about smaller leaks.
• Not every company that holds your data is covered by the Privacy Act.
• Many breaches involving Australians happen at overseas services that aren't bound by the NDB scheme at all.
• Notices sometimes arrive months after attackers already started using your data.
• Tracking which emails, phone numbers and accounts are exposed across dozens of services is a part-time job.

This is exactly where a tool like Lunyb earns its place on your phone.

How Lunyb helps you stay ahead of Australian data breaches

Lunyb is a privacy and scam-protection app built for people who don't want to become amateur cybersecurity analysts. For readers dealing with the NDB scheme in practice, three parts of Lunyb do most of the work.

1. Data Breach Alerts for your email and phone

Lunyb's Data Breach Alerts monitor your email addresses and phone numbers against known breach data. Instead of waiting for a formal notice from a specific company, you get a heads-up when your details show up in a leak — including from international services that fall outside the Australian scheme. That gives you time to change passwords, rotate logins and watch for targeted scams before attackers get organised.

2. Scam Checker and Scam Shield

Nearly every big Australian breach is followed by a wave of phishing: fake "your account has been locked" emails, fake toll notices, fake bank calls, fake delivery SMS. Lunyb's Scam Checker lets you paste a suspicious message or link and get a quick read on whether it looks dangerous. Scam Shield adds caller protection, so the usual "we're calling from your bank's fraud team" scripts are easier to spot and ignore.

3. Privacy Check, Password Vault and Photo Vault

Privacy Check reviews the permissions your installed apps are asking for, so you can shut down the ones quietly harvesting your contacts, location or photos. The encrypted Password Vault helps you stop reusing passwords across sites — which is the single biggest reason one breach turns into five. The Photo Vault keeps sensitive images (ID scans, documents) off your camera roll and out of cloud backups.

4. On-device tracker and threat blocking

Lunyb includes an on-device DNS shield that blocks known trackers and malicious domains at the network level, right on your phone. It's a quiet background layer that reduces how much of your activity leaks to third parties in the first place — useful whether or not a specific company has been breached.

5. Photo Guard, security score and history eraser

Photo Guard runs reverse-image checks so you can see where your photos appear online. Your security score turns all of this into one number that tells you where to focus next, and the browsing-history eraser helps clear residual traces across your device.

Lunyb vs. doing it all manually after a breach

Extra protections that pair well with the NDB scheme

The NDB scheme is one safety net. A few habits layered on top make a real difference.

Use credit bans and IDCARE when ID is exposed

If a breach exposes documents like your driver licence, passport, or Medicare number, place a credit ban with the major Australian credit reporting bodies and contact IDCARE, Australia's national identity and cyber support service, for a tailored response plan.

Separate your identities

Use different email addresses for banking, shopping and social sign-ups. When a shopping site gets breached, your banking email stays out of the leak.

Be careful with links — including "official" ones

Breached brands and government agencies almost never ask you to click a link in an SMS to "verify" anything. If you need to share links with customers or your community, use a trustworthy, privacy-aware shortener. Lunyb's link shortening and secure QR platform is built around that mindset — if you're comparing options, our Rebrandly review and honest Lunyb review walk through how we think about safe links.

Reporting a breach or privacy concern in Australia

If you believe an Australian organisation has mishandled your personal information or failed to notify you of a breach, you have options:

1. Complain to the organisation first. Give them a reasonable chance to respond in writing.
2. Escalate to the OAIC if you're not satisfied, by lodging a privacy complaint through their official website.
3. Report cybercrime (such as identity theft or fraud) via ReportCyber, the Australian Cyber Security Centre's reporting portal.
4. Contact IDCARE for personalised identity and cyber support if you're being harmed by misuse of your data.

Putting it all together

The Australian data breach notification scheme is a serious, well-designed law — but it was built to tell you after something went wrong at a specific company. Your real protection comes from what you do on your side, every day, across every account and device you own.

That's the problem Lunyb is built to solve. One app gives you breach alerts, scam checking, caller protection, an encrypted vault, Privacy Check, Photo Guard, an on-device DNS shield and a running security score. Plans start from about $19.99/month, renew until cancelled, and you can cancel anytime online. Optional Leak Protection is billed separately and can be paused without cancelling your main plan — clear pricing, no games.

Your next step

1. Go to lunyb.com and take the free privacy quiz — it only takes a couple of minutes and tells you where your exposure is right now.
2. Install the Lunyb app from the App Store or Google Play.
3. Run a Data Breach check on your main email and phone number, then turn on alerts.
4. Move your most-used passwords into the Password Vault and enable Scam Shield.

Do that today and the next time a breach notice lands in your inbox, you'll already be two steps ahead of the scammers that always follow it.

Frequently asked questions

Does the Australian data breach notification scheme apply to all companies?

No. It applies to entities covered by the Privacy Act — mainly Australian Government agencies, businesses and not-for-profits with annual turnover over $3 million, all private sector health service providers, credit reporting bodies, credit providers, TFN recipients, and certain small businesses that trade in personal information. Many small businesses and overseas services are not covered, which is why personal monitoring tools like Lunyb matter.

How quickly must I be notified of a data breach in Australia?

Once an organisation has reasonable grounds to suspect an eligible data breach, it has up to 30 days to assess. If the breach is confirmed, it must notify the OAIC and affected individuals "as soon as practicable". In practice, timing varies — which is another reason to rely on independent breach alerts rather than waiting for a letter.

What should I do first if my email appears in a data breach?

Change the password on that account immediately, enable two-factor authentication, and change the password on any other account that used the same or a similar password. Then run your email through Lunyb's Data Breach Alerts to see every known leak it appears in, and turn on Scam Checker so you can safely vet the phishing attempts that typically follow.

Can Lunyb stop every scam and every breach?No tool can honestly promise that, and we won't. Lunyb is designed to help you catch more risks earlier, respond faster when something does leak, and avoid the most common scams that follow Australian data breaches. That's a meaningful upgrade over trying to monitor everything yourself.

Is Lunyb an Australian service?

Lunyb is available to Australian users via lunyb.com and the mobile apps, and the features in this guide — breach alerts, Scam Checker, Scam Shield, Privacy Check, Password Vault, Photo Vault, Photo Guard, DNS-level tracker blocking, security score and the link/QR tools — are designed to work alongside Australian protections like the NDB scheme, IDCARE and ReportCyber.