Australian Data Breach Notification Scheme: Complete Compliance Guide

If your personal information is caught up in a data breach in Australia, you have real rights — and the organisation holding your data has real obligations. The Notifiable Data Breaches (NDB) scheme, part of the Privacy Act 1988, is what forces companies and government agencies to tell you when something has gone wrong. But knowing the law is only half the story. The other half is being ready to act the moment your email, phone number, Medicare details or passwords show up somewhere they shouldn't.

That is exactly where Lunyb fits in. Lunyb is a privacy and scam-protection app that watches for data breach exposure tied to your email and phone, flags suspicious messages and links, and gives you a clear playbook when something leaks. This guide walks you through the Australian Data Breach Notification Scheme end to end — what it covers, who must comply, what notifications must contain — and shows you how to use Lunyb as your personal early-warning system.

What is the Australian Data Breach Notification Scheme?

The Australian Data Breach Notification Scheme — officially the Notifiable Data Breaches (NDB) scheme — is a mandatory reporting regime under Part IIIC of the Privacy Act 1988 (Cth). It requires covered entities to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when an eligible data breach occurs.

The scheme commenced on 22 February 2018 and is regulated by the OAIC. Its core purpose is simple: people have a right to know when their personal information has been compromised so they can take protective action — change passwords, watch for scam calls, freeze credit checks, or lock down accounts. Lunyb is designed to help you do exactly those things quickly, without having to Google each step at 11pm on a Sunday.

Why the scheme matters for everyday Australians

Major Australian breaches over recent years have shown how damaging exposed data can be: identity fraud, SIM swap attacks, targeted phishing, and scam calls that already know your name, address and date of birth. The NDB scheme makes sure you are told — but it does not undo the exposure. That is the gap Lunyb's Data Breach Alerts and Scam Shield close for you personally.

Who must comply with the NDB scheme?

The NDB scheme applies to organisations and agencies that already have obligations under the Privacy Act. In short, if the Australian Privacy Principles (APPs) apply to you, so does the NDB scheme.

• Australian Government agencies covered by the Privacy Act.
• Businesses and not-for-profits with annual turnover above $3 million.
• Private sector health service providers, including GPs, allied health, pharmacies and gyms that hold health information — regardless of turnover.
• Credit reporting bodies, credit providers handling credit eligibility information.
• TFN (Tax File Number) recipients — any entity that handles TFN information.
• Entities that trade in personal information, and some small businesses that opt in or operate related to larger APP entities.

What counts as an "eligible data breach"?

An eligible data breach under the NDB scheme has three elements that must all be present:

1. There is unauthorised access to, unauthorised disclosure of, or loss of personal information held by the entity.
2. The breach is likely to result in serious harm to one or more individuals.
3. The entity has not been able to prevent the likely risk of serious harm through remedial action.

"Serious harm" is not strictly defined in the Act — the OAIC guidance explains it can include physical, psychological, emotional, financial, or reputational harm. Think identity theft, financial fraud, blackmail, workplace or relationship damage, or significant distress.

Examples of breaches that typically must be notified

• A laptop or USB containing unencrypted customer records is lost or stolen.
• A database is accessed by a cyber attacker and personal information is exfiltrated.
• An employee emails a spreadsheet of customer details to the wrong recipient.
• Login credentials are stolen via phishing and used to access a system containing personal information.
• Paper records with sensitive information are disposed of without secure destruction.

Notification obligations: what entities must do

Once an entity suspects an eligible data breach may have occurred, the clock starts. The organisation must act promptly and follow a structured process set out by the OAIC.

1. Assess the suspected breach within 30 days. The entity must take all reasonable steps to assess whether there are reasonable grounds to believe an eligible data breach has occurred.
2. Contain the breach and take remedial action to reduce the risk of harm wherever possible.
3. Notify the OAIC as soon as practicable through the online Notifiable Data Breach form.
4. Notify affected individuals as soon as practicable, either directly or — if that is not practicable — by publishing the statement on the entity's website and taking reasonable steps to publicise it.

What the notification must include

• The identity and contact details of the entity.
• A description of the eligible data breach.
• The kinds of information involved (for example, name, email, driver licence number, health information).
• Recommendations about the steps individuals should take in response.

Penalties and enforcement under the Privacy Act

Non-compliance with the NDB scheme can constitute a serious or repeated interference with privacy under the Privacy Act. Following amendments passed in late 2022, the maximum civil penalties for serious or repeated privacy breaches by bodies corporate were significantly increased — up to the greater of $50 million, three times the benefit obtained from the misuse of information, or 30% of adjusted turnover during the relevant period.

The OAIC has powers to investigate, accept enforceable undertakings, issue determinations, and apply to the Federal Court for civil penalty orders. Reputational damage from public notification can be just as costly as any fine.

Your rights as an individual when notified

If you receive a data breach notification, you have the right to:

• Be told clearly what information was involved and what the organisation recommends you do.
• Make a privacy complaint to the entity, and escalate to the OAIC if you are not satisfied with the response.
• Access and correct your personal information under the APPs.
• Request additional protections such as identity recovery support where offered (for example, through IDCARE).

But rights only help if you act on them. The most important thing is speed — and that is where most people fall behind. Lunyb is built to compress that response window down to minutes.

How Lunyb helps you stay ahead of Australian data breaches

Compliance guides are great for organisations, but what about you — the person whose email, phone number and address end up on a stolen database? Lunyb is a phone privacy and scam-protection app built for that exact problem. Here is how we help you detect, respond and reduce the fallout.

Data Breach Alerts for your email and phone

Lunyb's Data Breach Alerts continuously monitor for exposure tied to your email address and mobile number. When we see your details appear in a known breach dataset, you get a clear alert telling you what was exposed and what to do next — change this password, enable two-factor authentication, lock this account. No more waiting for a corporate letter to catch up to a leak that happened months ago.

Scam Checker and Scam Shield for post-breach phishing

Once your details are leaked, the scam calls, SMS "MyGov" messages and fake delivery links start arriving. Lunyb's Scam Checker lets you paste a suspicious message or link and get a quick read on whether it is safe. Scam Shield helps catch dodgy callers before you answer. These are the tools you want on your phone the week after a breach notification lands.

Privacy Check and Security Score

Our Privacy Check walks through the apps on your phone and flags which ones have permissions they probably shouldn't. The Security Score gives you a running sense of how exposed you are and what to fix first. It turns "I should probably do something about my privacy" into a short, concrete to-do list.

Encrypted Password and Photo Vault

Reusing passwords is the single biggest reason one breach becomes ten. Lunyb's encrypted Password Vault helps you store strong, unique logins, while the Photo Vault keeps sensitive images (passport scans, licence photos, medical documents) locked behind a separate layer so a compromised cloud account does not hand them over.

On-device tracker and threat blocking

Lunyb includes a local DNS shield that blocks known trackers and malicious domains at the network level on your device. That means fewer third parties quietly profiling you, and fewer sketchy domains loading in the first place. It is not a silver bullet — nothing is — but it meaningfully reduces how much data leaves your phone.

Browsing-history eraser and data-broker exposure help

After a breach, a lot of exposure lives on in search results and data-broker profiles. Lunyb helps you clear browsing traces and provides guidance to reduce how much of your personal information is sitting on broker sites waiting for the next scammer.

Lunyb vs doing it all yourself

You can technically do most of this manually. You can also do your own tax return by hand. Here is an honest comparison of the two paths.

Task	DIY approach	With Lunyb
Know when your email/phone leaks	Check multiple breach sites manually, hope you remember	Automatic Data Breach Alerts tied to your details
Check if a text or link is a scam	Google the sender, guess	Paste it into Scam Checker for a quick read
Review risky app permissions	Scroll through phone settings one app at a time	Privacy Check walks you through them in one place
Store passwords and sensitive photos	Browser autofill, camera roll	Encrypted Password Vault and Photo Vault
Block trackers and bad domains	Configure DNS settings yourself	Built-in on-device DNS shield
Know what to fix first	Guesswork	Security Score with prioritised actions

Pricing is straightforward: Lunyb plans start from about $19.99/month and renew until you cancel. You can cancel anytime online. Optional Leak Protection is billed separately and can be paused without cancelling your main plan. Clear terms are part of why you can trust us — no surprises, no lock-ins.

What to do if you receive an NDB notification

If a company tells you your data was involved in a breach, work through this checklist. Lunyb covers most of these in-app.

1. Read the notification carefully. Note exactly which fields were exposed — email, password, phone, address, Medicare, licence, TFN.
2. Change the affected password and any other account that reused it. Use Lunyb's Password Vault to generate strong, unique replacements.
3. Turn on two-factor authentication everywhere it is offered, ideally with an authenticator app rather than SMS.
4. Watch for scam calls and messages, especially ones that quote real details about you. Run anything suspicious through Lunyb's Scam Checker.
5. Consider a credit ban with Equifax, Experian and illion if financial data was exposed. Bans are free in Australia and prevent new credit being opened in your name.
6. Replace compromised ID documents if licence or passport numbers were leaked. State transport agencies issue new licence numbers for verified breach victims.
7. Contact IDCARE (1800 595 160) for free, government-funded identity and cyber support.
8. Keep monitoring. Breach fallout can surface months later. Lunyb's ongoing Data Breach Alerts and Security Score keep the pressure on so you don't have to remember.

Ready to lock down your data? Start with Lunyb

The Australian Data Breach Notification Scheme is a strong law, but it is a reporting law — it tells you after the fact. Your personal protection has to live on your phone, in your inbox, and in the habits you build around passwords, apps and links. Lunyb puts all of that in one app.

Head to lunyb.com to take our free privacy quiz and see where you stand, or download the Lunyb app from the App Store or Google Play and run your first Privacy Check and Data Breach Alert scan today. If you want to see how we think about product transparency, you can also read our own honest review of Lunyb.

Frequently asked questions

When did the Australian Data Breach Notification Scheme start?

The Notifiable Data Breaches scheme commenced on 22 February 2018 under Part IIIC of the Privacy Act 1988 (Cth) and is regulated by the Office of the Australian Information Commissioner (OAIC).

How long does an organisation have to notify me of a breach?

Once an entity suspects an eligible data breach, it must assess within 30 days whether the breach meets the threshold, and then notify the OAIC and affected individuals "as soon as practicable" after forming that belief.

What is considered "serious harm" under the scheme?

The Act does not list specific examples, but OAIC guidance explains serious harm can be physical, psychological, emotional, financial or reputational — for example identity theft, fraud, extortion, workplace damage or significant distress.

Does the NDB scheme apply to small businesses?

Generally it applies to businesses with annual turnover above $3 million, but small businesses are also covered if they are health service providers, trade in personal information, handle TFNs or credit information, or are contracted service providers to the Australian Government.

How does Lunyb help me after a breach?

Lunyb provides Data Breach Alerts tied to your email and phone, Scam Checker and Scam Shield for post-breach phishing, a Privacy Check for your app permissions, an encrypted Password and Photo Vault, and on-device tracker and threat blocking — so you can detect exposure early and respond in minutes rather than months.