Australian Data Breach Notification Scheme: Complete 2026 Compliance Guide

The Australian Data Breach Notification Scheme — formally known as the Notifiable Data Breaches (NDB) scheme — is one of the most important compliance frameworks Australian organisations must understand. Operating under Part IIIC of the Privacy Act 1988, the scheme requires entities to notify both affected individuals and the Office of the Australian Information Commissioner (OAIC) when an eligible data breach occurs. This guide explains exactly what the scheme covers, who it applies to, how to assess a breach, and what to do when one happens.

What Is the Australian Data Breach Notification Scheme?

The Australian Data Breach Notification Scheme is a mandatory legal framework that requires organisations covered by the Privacy Act 1988 to report eligible data breaches to affected individuals and the OAIC. It came into force on 22 February 2018 and applies whenever personal information is lost, accessed without authorisation, or disclosed in a way likely to cause serious harm.

The scheme is designed to achieve three core outcomes:

Give individuals the opportunity to protect themselves from harm after a breach.
Increase transparency and accountability across Australian businesses and agencies.
Drive improvements in information security practices nationwide.

The scheme is regulated by the OAIC, which has the power to investigate breaches, issue determinations, accept enforceable undertakings, and refer matters to the Federal Court for civil penalties.

Who Must Comply With the NDB Scheme?

The NDB scheme applies to all entities already bound by the Australian Privacy Principles (APPs). This includes a broad cross-section of the economy.

Entities Covered

Australian Government agencies (with limited exemptions).
Businesses and not-for-profit organisations with an annual turnover of more than AUD $3 million.
Private sector health service providers — regardless of turnover.
Credit reporting bodies and credit providers.
Tax File Number (TFN) recipients.
Entities trading in personal information (e.g. selling or purchasing data).
Contracted service providers for Australian Government contracts.

Entities Generally Exempt

Small businesses with turnover under AUD $3 million (unless they fall into a covered category).
Registered political parties.
State and territory authorities (which are governed by separate state-based privacy laws).

Importantly, ongoing reforms to the Privacy Act may soon remove the small business exemption, meaning many more SMEs will be drawn into the scheme by 2026–2027.

What Counts as an "Eligible Data Breach"?

An eligible data breach is one that meets a three-part legal test under section 26WE of the Privacy Act. All three elements must be satisfied before notification obligations are triggered.

Unauthorised access, unauthorised disclosure, or loss of personal information held by the entity.
The breach is likely to result in serious harm to one or more individuals.
The entity has not been able to prevent the likely risk of serious harm through remedial action.

Examples of Eligible Data Breaches

A laptop containing unencrypted customer records is stolen.
An employee emails a spreadsheet of patient data to the wrong recipient.
A database is accessed by cybercriminals using stolen credentials.
A ransomware attack exfiltrates personal information before encryption.
Misconfigured cloud storage exposes identity documents publicly online.

What "Serious Harm" Means

Serious harm is not defined precisely in the Act but is assessed contextually. It can include:

Identity theft and financial fraud.
Physical harm or threats to safety (e.g. exposure of a domestic violence victim's address).
Psychological or emotional distress.
Reputational damage.
Workplace or relationship consequences.

The 30-Day Assessment Window

When an entity suspects an eligible data breach may have occurred but is not certain, the Privacy Act provides a 30-day window to carry out a reasonable and expeditious assessment. The clock starts the moment the entity becomes aware of grounds to suspect a breach.

A robust assessment generally includes:

Initiation — Convening the response team and recording the suspicion.
Investigation — Gathering technical evidence, logs, and witness accounts.
Evaluation — Determining whether the legal test for an eligible breach is met.

If at any point during the 30 days the entity concludes a breach is eligible, it must move to notification "as soon as practicable" — not at the end of the 30 days.

Notification Requirements: What You Must Do

Once a breach is confirmed as eligible, two notifications are required: one to the OAIC and one to affected individuals.

1. Notify the OAIC

Entities must lodge a statement using the OAIC's online Notifiable Data Breach form. The statement must include:

The identity and contact details of the entity.
A description of the breach.
The kinds of information involved.
Recommendations on the steps individuals should take in response.

2. Notify Affected Individuals

Entities must choose one of three notification options:

Option 1: Notify all individuals whose data was involved.
Option 2: Notify only those at likely risk of serious harm.
Option 3: If neither is practicable, publish the statement prominently on the entity's website and take reasonable steps to publicise it.

Penalties for Non-Compliance

Penalties under the Privacy Act were significantly increased in December 2022 following high-profile breaches at Optus and Medibank. For serious or repeated interferences with privacy, the maximum penalties are now substantial.

Entity Type	Maximum Civil Penalty
Individuals	AUD $2.5 million
Body corporates	The greater of: AUD $50 million; 3× the benefit obtained from the conduct; or 30% of adjusted turnover during the breach period

In addition to civil penalties, the OAIC can issue infringement notices, accept enforceable undertakings, seek injunctions, and publicly name non-compliant entities — all of which carry significant reputational risk.

Building a Compliant Data Breach Response Plan

Every covered entity should maintain a documented Data Breach Response Plan. The OAIC explicitly recommends this and considers its existence (or absence) when assessing whether an organisation took reasonable steps to protect information.

Core Components of a Response Plan

Response team — Named individuals from IT, legal, compliance, communications, and executive leadership.
Detection and escalation procedures — How staff report suspected incidents and to whom.
Containment playbooks — Technical steps such as isolating systems, revoking credentials and rotating keys.
Assessment framework — A documented method for applying the three-part eligible breach test.
Notification templates — Pre-drafted statements for the OAIC and affected individuals.
Post-incident review — Root cause analysis and remediation planning.

Practical Security Measures That Reduce Breach Risk

Multi-factor authentication on all administrative accounts.
Encryption of personal information at rest and in transit.
Strict access controls based on the principle of least privilege.
Regular vulnerability scanning and penetration testing.
Secure handling of links and shared resources — using privacy-respecting tools like Lunyb for shortened URLs ensures that links sent to customers or staff don't leak tracking data or expose internal endpoints.
Comprehensive staff training on phishing and social engineering.

How the NDB Scheme Compares to GDPR

Australian businesses operating internationally often need to comply with both the NDB scheme and the EU General Data Protection Regulation (GDPR). While the two share goals, they differ on key details.

Feature	NDB Scheme (Australia)	GDPR (EU)
Notification threshold	"Likely to result in serious harm"	"Likely to result in a risk to rights and freedoms"
Time to notify regulator	As soon as practicable (after 30-day assessment)	Within 72 hours of awareness
Individual notification	Required if eligible breach	Required if high risk to individuals
Maximum penalty (corporate)	Up to AUD $50M or 30% of turnover	Up to €20M or 4% of global turnover
Small business exemption	Yes (under review)	No

Recent Trends in Australian Data Breach Reporting

The OAIC publishes biannual Notifiable Data Breaches reports. Consistent themes have emerged since 2022:

Malicious or criminal attacks remain the leading cause of breaches, typically over 65% of reports.
Phishing and credential compromise are the dominant initial attack vectors.
Health and finance sectors are consistently the most-affected industries.
Human error breaches — particularly misdirected emails — remain a stubborn second category.
Supply chain and third-party breaches are rising sharply, often involving SaaS vendors.

These trends reinforce that strong identity controls, vendor risk management, and staff awareness are no longer optional — they are core compliance obligations.

What's Changing: Privacy Act Reform

The Australian Government has been progressively reforming the Privacy Act since the 2022 Privacy Act Review Report. Reforms passed and proposed include:

A new statutory tort for serious invasions of privacy.
Enhanced OAIC enforcement powers, including the ability to issue infringement notices for minor breaches.
Proposed removal of the small business exemption.
New requirements around automated decision-making transparency.
Stronger rules around children's privacy and direct marketing.

Entities should monitor these changes closely, as obligations under the NDB scheme will expand alongside them.

Practical Checklist for Australian Organisations

Confirm whether your entity is covered by the Privacy Act.
Map all personal information you collect, store, and share.
Document a written Data Breach Response Plan.
Train all staff on incident identification and reporting.
Implement MFA, encryption, and least-privilege access.
Review third-party contracts for data security obligations.
Test your response plan with tabletop exercises annually.
Maintain a register of all suspected and confirmed incidents.
Audit privacy practices against the APPs at least annually.

Frequently Asked Questions

1. How quickly must I report a data breach to the OAIC?

Once you have determined an eligible data breach has occurred, you must notify the OAIC and affected individuals "as soon as practicable". If you only suspect a breach, you have up to 30 days to investigate — but you should act sooner if you confirm the breach earlier.

2. What happens if I don't report a notifiable data breach?

Failing to comply with the NDB scheme is treated as an interference with privacy under the Privacy Act. Penalties can reach up to AUD $50 million, or 30% of adjusted turnover, for corporations. The OAIC may also issue public determinations that significantly damage reputation.

3. Does the scheme apply to small businesses?

Generally, businesses with annual turnover under AUD $3 million are exempt — but there are major exceptions, including private health providers, credit reporting entities, and contracted Commonwealth service providers. The small business exemption is also under review and likely to be narrowed or removed.

4. Is a lost laptop always a notifiable data breach?

Not necessarily. If the laptop is fully encrypted and credentials are strong, the likely risk of serious harm may be sufficiently low that notification is not required. If the device contained unencrypted personal information, notification is almost always required.

5. Do I have to notify if a third-party vendor causes the breach?

Yes. Under the Privacy Act, the entity that holds the personal information remains accountable, even if a vendor or processor is the proximate cause. This is why vendor due diligence and contractual data protection clauses are essential.

Final Thoughts

The Australian Data Breach Notification Scheme is more than a reporting obligation — it is a framework that shapes how organisations think about personal information, security risk, and accountability. With penalties rising sharply, expanding regulatory powers, and an increasingly aggressive threat landscape, Australian organisations cannot afford to treat compliance as a checkbox exercise. A documented response plan, strong technical controls, staff awareness, and disciplined vendor management together form the foundation of meaningful privacy compliance in 2026 and beyond.