Australian Data Breach Notification Scheme: Complete Compliance Guide

Since February 2018, Australian organisations have lived under one of the strictest mandatory breach disclosure regimes in the Asia-Pacific region. The Notifiable Data Breaches (NDB) scheme, introduced as Part IIIC of the Privacy Act 1988, fundamentally changed how businesses respond when personal information is compromised. With penalties now reaching up to AU$50 million per contravention following the 2022 amendments, understanding your obligations under the Australian data breach notification scheme is no longer optional — it's a board-level priority.

This guide walks through who must comply, what constitutes an eligible data breach, the statutory 30-day assessment window, notification requirements to the Office of the Australian Information Commissioner (OAIC), and practical steps to build a compliant response programme.

What Is the Australian Data Breach Notification Scheme?

The Notifiable Data Breaches scheme is a federal regulatory framework that requires organisations covered by the Privacy Act 1988 to notify both affected individuals and the OAIC when an "eligible data breach" occurs. It applies to incidents involving personal information that are likely to result in serious harm.

The scheme sits within the broader Australian Privacy Principles (APPs) framework and operates alongside sector-specific obligations like the My Health Records Act 2012 and the Consumer Data Right regime. Crucially, the NDB scheme is harm-based — not every security incident triggers mandatory notification, only those meeting the statutory threshold of "likely serious harm".

Who Must Comply?

The scheme applies to all "APP entities", which includes:

Australian Government agencies (federal)
Businesses and not-for-profits with annual turnover exceeding AU$3 million
Private sector health service providers (regardless of turnover)
Credit reporting bodies and credit providers
Tax File Number recipients
Entities that trade in personal information
Contracted service providers for Australian Government contracts

Small businesses under the AU$3 million threshold are generally exempt unless they fall into one of the special categories above. However, the federal government has signalled intent to remove this small business exemption as part of ongoing Privacy Act reforms.

What Counts as an "Eligible Data Breach"?

An eligible data breach occurs when three conditions are simultaneously met under section 26WE of the Privacy Act:

There is unauthorised access to, unauthorised disclosure of, or loss of personal information held by an entity.
The access, disclosure or loss is likely to result in serious harm to one or more individuals.
The entity has not been able to prevent the likely risk of serious harm through remedial action.

"Serious harm" is not defined exhaustively in the Act but is interpreted broadly. It can include physical, psychological, emotional, financial, or reputational harm. The OAIC considers factors such as the kind and sensitivity of information, whether it is protected by security measures (such as encryption), the persons who have obtained or could obtain the information, and the nature of the harm.

Examples of Eligible Breaches

A lost unencrypted laptop containing client tax file numbers and Medicare details
A ransomware attack where attackers exfiltrate customer databases
Misdirected emails sending bulk personal information to wrong recipients
A web application vulnerability exposing user accounts with passwords and payment details
An employee accessing and selling customer data without authorisation

When Notification May Not Be Required

Notification obligations may be avoided where remedial action is taken quickly enough that serious harm is no longer likely — for instance, if a misdirected email is recalled before being opened, or if stolen data was strongly encrypted with keys that remain secure.

The 30-Day Assessment Window

One of the most operationally challenging aspects of the Australian data breach notification scheme is the statutory assessment timeline. Under section 26WH, when an entity has reasonable grounds to suspect an eligible data breach may have occurred, it must:

Carry out a reasonable and expeditious assessment of whether there are reasonable grounds to believe the breach is eligible
Take all reasonable steps to ensure this assessment is completed within 30 calendar days of the suspicion arising
Notify the Commissioner and affected individuals as soon as practicable once eligibility is established

The 30 days is a maximum, not a target. If an entity already has reasonable grounds to believe an eligible breach has occurred (skipping the suspicion phase), notification must happen immediately — not at day 30.

Notification Requirements: What and How

Once a breach is confirmed as eligible, the entity must prepare a statement that includes:

The identity and contact details of the entity
A description of the eligible data breach
The kinds of information concerned
Recommendations about steps individuals should take in response

This statement must be submitted to the OAIC via the online Notifiable Data Breach form, and copies provided to affected individuals.

Three Notification Options to Individuals

Option	When to Use	Practical Notes
Option 1: Notify all individuals to whom the information relates	When you cannot reasonably identify which specific individuals are at risk	Often used after large database breaches
Option 2: Notify only individuals at likely risk of serious harm	When affected cohort can be identified with reasonable accuracy	Preferred where data segmentation allows
Option 3: Publish a statement on the entity's website	Only when Options 1 and 2 are not practicable	Must take reasonable steps to publicise the statement

Penalties and Enforcement

The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 dramatically increased the consequences of non-compliance. For serious or repeated interferences with privacy, the maximum penalty for body corporates is now the greater of:

AU$50 million
Three times the value of any benefit obtained through the misuse of information
30% of the entity's adjusted turnover during the relevant period

The OAIC also has expanded investigative powers, including the ability to conduct assessments, issue infringement notices, and seek civil penalty orders through the Federal Court. High-profile enforcement actions against Optus, Medibank, and Latitude Financial have shown the regulator's willingness to pursue significant cases publicly.

Building a Compliant Breach Response Programme

Compliance is not achieved through a written policy alone — it requires operational readiness. A mature programme typically includes the following components.

1. Data Mapping and Classification

You cannot assess potential harm if you don't know what personal information you hold, where it is stored, and who has access. Maintain a current data inventory categorising information by sensitivity (basic identifiers, financial, health, government identifiers like TFNs and Medicare numbers, biometric data).

2. Detection and Logging

Most breaches are detected weeks or months after they occur. Implement security information and event management (SIEM) tooling, file integrity monitoring, and behavioural analytics to shorten the dwell time between incident and detection. Without detection, the 30-day clock cannot even begin appropriately.

3. Incident Response Plan

A documented and rehearsed incident response plan should define:

Roles and responsibilities (incident commander, legal, communications, technical lead)
Escalation thresholds and decision authority
Forensic preservation procedures
Internal and external communication templates
Engagement protocols with legal counsel, cyber insurers, and the Australian Cyber Security Centre (ACSC)

4. Eligibility Assessment Framework

Create a standardised template for assessing whether a suspected breach meets the eligibility threshold. This should walk responders through the seriousness factors the OAIC considers, document the reasoning, and produce an audit trail.

5. Preventive Controls

Strong preventive controls reduce both the likelihood of breaches and the scope of those that do occur. Key measures include encryption at rest and in transit, multi-factor authentication, least-privilege access controls, regular vulnerability scanning, and secure handling of links and redirects. For organisations sharing many external links in marketing or operations, using a privacy-focused link management service like Lunyb can help limit personal data exposure in tracking parameters and provide audit logs of who accessed what.

Common Pitfalls and How to Avoid Them

Pitfall 1: Treating the 30 Days as a Deadline Rather Than a Maximum

Entities that delay assessment until day 28 or 29 routinely struggle to make defensible decisions and complete notifications. Aim for assessment completion within 5-10 business days for most cases.

Pitfall 2: Failing to Document the Assessment

If you conclude a suspected breach was not eligible (so no notification is made), the OAIC may still ask why. A contemporaneous written assessment showing the factors considered is essential.

Pitfall 3: Notifying Too Narrowly

When in doubt about whether a particular individual is affected, the safer course is to notify. Failure to notify someone who suffers harm carries far greater legal and reputational risk than over-notification.

Pitfall 4: Ignoring Third-Party Breaches

If a service provider holding your customers' data is breached, your entity remains responsible for notification. Vendor contracts must mandate prompt breach notification to you, ideally within 24-72 hours of detection.

Interaction With Other Regulatory Regimes

A single incident often triggers multiple disclosure obligations:

SOCI Act 2018: Operators of critical infrastructure must report cyber incidents to the ACSC within 12 hours (critical) or 72 hours (significant)
APRA CPS 234: Regulated financial entities must notify APRA within 72 hours of material information security incidents
ASX Listing Rules: Listed entities may have continuous disclosure obligations if the incident is materially price-sensitive
State health privacy laws: Victoria, NSW and ACT have separate health information regimes
GDPR: Australian entities offering goods or services to EU residents may have parallel 72-hour notification obligations

For organisations operating across jurisdictions, building a unified incident response that satisfies the tightest applicable timeline is more efficient than trying to optimise each separately.

Recent Trends and Reform Direction

The federal government has accepted, in principle or in full, the majority of recommendations from the 2022 Privacy Act Review. Expected reforms over the coming years include:

Removal of the small business exemption (subject to transition arrangements)
A direct right of action for individuals to sue for serious privacy interferences
A new statutory tort for serious invasions of privacy (introduced in 2024)
Tighter definitions of "consent" and "fair and reasonable" handling of information
Potentially shortening the 30-day assessment window for certain breach categories

Organisations should track these developments and build flexibility into their privacy programmes. For further reading on related topics, see our coverage of privacy-respecting link tools and our broader 2026 buyer's guide for evaluating vendor data handling practices.

Frequently Asked Questions

Does the Australian data breach notification scheme apply to small businesses?

Generally no, if the business has annual turnover of AU$3 million or less. However, exceptions apply for health service providers, credit reporting bodies, businesses that trade in personal information, TFN recipients, and Australian Government contractors. The small business exemption is also under review and may be removed in coming Privacy Act reforms.

How quickly must I notify the OAIC after discovering a breach?

You must notify "as soon as practicable" after forming a reasonable belief that an eligible data breach has occurred. The 30-day window applies to the assessment phase (going from suspicion to belief), not to delaying notification once eligibility is confirmed. In practice, well-prepared entities often notify within days of confirmation.

What if encrypted data is stolen — do I still need to notify?

Possibly not, if the encryption is strong, keys remain secure, and there is no other pathway to serious harm. The OAIC considers the security protections as a factor in the harm assessment. However, you should still document the assessment and consider whether metadata or other contextual information could still cause harm.

What are the maximum penalties under the Privacy Act?

For serious or repeated interferences with privacy by body corporates, penalties can reach the greater of AU$50 million, three times the value of benefit obtained, or 30% of adjusted turnover during the relevant period. Individuals face penalties up to AU$2.5 million.

Do I have to notify if I'm not sure whether serious harm is likely?

If you only suspect an eligible breach has occurred, you must conduct an assessment within 30 days to determine whether reasonable grounds for belief exist. Where it remains genuinely unclear after assessment whether serious harm is likely, the cautious approach — and the one most defensible to the regulator — is to notify.