Australian Data Breach Notification Scheme: The Complete 2026 Guide

The Australian Data Breach Notification Scheme, formally known as the Notifiable Data Breaches (NDB) scheme, is one of the most important privacy obligations businesses operating in Australia need to understand. Since coming into force in February 2018 under the Privacy Act 1988 (Cth), it has fundamentally reshaped how organisations detect, respond to and disclose data incidents. With the 2022 penalty increases and the ongoing Privacy Act reforms, compliance has become both more urgent and more consequential.

This guide explains exactly what the scheme requires, who it applies to, how to determine whether a breach is notifiable, and the step-by-step process for reporting to the Office of the Australian Information Commissioner (OAIC) and affected individuals.

What Is the Australian Data Breach Notification Scheme?

The Notifiable Data Breaches scheme is a legal framework under Part IIIC of the Privacy Act 1988 that requires covered entities to notify individuals and the OAIC when a data breach is likely to result in serious harm. It is administered by the Australian Information Commissioner and applies across the private and public sectors where the Privacy Act operates.

The scheme was introduced to bring Australia in line with international best practice on breach transparency, giving individuals the information they need to protect themselves after their personal data has been compromised — for example by changing passwords, monitoring credit files or watching for identity fraud.

Legal Basis and Regulator

The scheme sits within the Privacy Act and is enforced by the OAIC. The Commissioner has powers to investigate, direct organisations to notify, accept enforceable undertakings, and seek civil penalties through the Federal Court for serious or repeated interferences with privacy.

Who Must Comply With the NDB Scheme?

The scheme applies to any entity that has existing obligations under the Australian Privacy Principles (APPs). In practice, that includes:

• Australian Government agencies (with limited exceptions).
• Private sector organisations with annual turnover above AUD $3 million.
• All health service providers, including sole practitioners, regardless of turnover.
• Credit reporting bodies and credit providers handling credit information.
• Tax File Number (TFN) recipients, in relation to TFN information.
• Businesses that trade in personal information or provide services under a Commonwealth contract.

Small businesses under the $3 million threshold are often exempt from the Privacy Act — but this exemption is under active review and is expected to be removed as part of the government's Privacy Act reform program. Many small businesses should therefore prepare as if the scheme already applies to them.

What Counts as an "Eligible Data Breach"?

An eligible data breach — the type that must be notified — has three elements that must all be present:

1. Unauthorised access, unauthorised disclosure, or loss of personal information held by the entity.
2. The breach is likely to result in serious harm to one or more individuals.
3. The entity has not been able to prevent the likely risk of serious harm through remedial action.

If remedial action successfully removes the risk of serious harm — for example, a lost encrypted laptop is recovered before decryption is possible — the breach may not need to be notified.

Examples of Notifiable Breaches

• Cyber attackers stealing a customer database containing names, addresses and payment details.
• An employee emailing a spreadsheet of client health records to the wrong recipient.
• Loss of an unencrypted USB stick containing HR files.
• Credential-stuffing attacks that expose account information.
• Ransomware incidents where attackers exfiltrate data before encryption.

What "Serious Harm" Means

Serious harm is not defined exhaustively in the Act, but the OAIC guidance identifies several categories:

• Physical harm — for example, a domestic violence victim's address being disclosed.
• Psychological or emotional harm — such as distress from health information exposure.
• Financial or economic harm — identity theft, credit card fraud, targeted scams.
• Reputational harm — disclosure of embarrassing or sensitive information.

Reporting Timelines and Process

The NDB scheme sets strict timeframes. Understanding the clock is critical, because delay itself can constitute a breach of the Privacy Act.

The 30-Day Assessment Window

If an entity suspects an eligible data breach may have occurred but is not sure, it must carry out a reasonable and expeditious assessment within 30 calendar days. The assessment should determine whether there are grounds to believe an eligible data breach has occurred.

Notification "As Soon As Practicable"

Once an entity has reasonable grounds to believe an eligible data breach has occurred, it must notify the OAIC and affected individuals as soon as practicable. There is no fixed number of days — but "as soon as practicable" generally means within days, not weeks.

Step-by-Step Response Process

1. Contain the breach to prevent further compromise (isolate systems, revoke credentials, recover devices).
2. Assess the scope, the type of information involved, the individuals affected and the likelihood of serious harm.
3. Consider remedial action — can the risk of serious harm be reduced or eliminated?
4. Notify the OAIC using the online Notifiable Data Breach form.
5. Notify affected individuals directly where practicable, or by publishing a statement if direct contact is not feasible.
6. Review and improve — conduct a post-incident review and update controls, policies and training.

What Must Be Included in a Notification?

Notifications to individuals and the OAIC must contain, at minimum:

• The identity and contact details of the entity.
• A description of the eligible data breach.
• The kinds of information involved.
• Recommendations about the steps individuals should take in response.

Good notifications go further — they explain what happened, when, what the organisation is doing about it, and provide a dedicated contact channel for questions.

Penalties for Non-Compliance

Penalties for serious or repeated interferences with privacy — which include failures under the NDB scheme — were dramatically increased in December 2022 by the Privacy Legislation Amendment (Enforcement and Other Measures) Act.

Entity Type	Maximum Penalty (per contravention)
Individuals	AUD $2.5 million
Body corporates	The greater of: AUD $50 million; OR three times the value of any benefit obtained from the misuse of information; OR 30% of the entity's adjusted turnover in the relevant period

Beyond financial penalties, non-compliance can trigger regulatory investigations, enforceable undertakings, reputational damage, class action litigation, and loss of customer trust — the last of which is often the most expensive outcome.

NDB Scheme vs GDPR: A Quick Comparison

Australian businesses that also handle EU personal data must comply with both regimes. Here's how they compare on the essentials:

Feature	Australian NDB Scheme	EU GDPR
Regulator	OAIC	National Data Protection Authorities
Notification threshold	Likely to cause serious harm	Likely to result in a risk to rights and freedoms
Regulator notification deadline	As soon as practicable	Within 72 hours of awareness
Individual notification	Required if serious harm likely	Required if high risk
Max penalty (business)	Up to AUD $50m / 30% turnover	€20m or 4% global turnover
Extra-territorial reach	Yes, if Australian link	Yes, if targeting EU residents

Building a Compliant Breach Response Program

Meeting the NDB scheme's requirements isn't just about paperwork after a breach — it's about having controls in place so that incidents are detected early and handled correctly. A mature program typically includes the following components.

1. A Written Data Breach Response Plan

The OAIC expects organisations to have a documented plan that identifies roles, decision-makers, escalation paths, communication templates and legal review triggers. This plan should be tested at least annually with tabletop exercises.

2. Data Mapping and Classification

You cannot assess harm from a breach if you don't know what personal information you hold, where it is stored, who it belongs to and how sensitive it is. Maintain an up-to-date data inventory.

3. Technical Safeguards

• Multi-factor authentication on all staff accounts and administrator access.
• Encryption of data at rest and in transit.
• Regular patching and vulnerability management.
• Endpoint detection and response (EDR) tools.
• Encrypted DNS and network-level filtering to reduce phishing exposure.
• Secure link management — when sharing sensitive URLs with customers or staff, use a trusted shortening and analytics service such as Lunyb to control access, monitor click activity, and disable links quickly if a campaign or dataset is compromised.

4. Vendor and Third-Party Management

Many notifiable breaches originate in third-party providers. Ensure contracts include breach notification obligations, security requirements and audit rights. Track your critical vendors and their security posture.

5. Staff Training

Human error — misdirected emails, phishing clicks, weak passwords — remains one of the top causes of notifiable breaches in OAIC reports. Regular, role-specific training measurably reduces this risk.

6. Detection and Logging

You cannot assess a breach within 30 days if you don't detect it for six months. Invest in centralised logging, alerting and monitoring so that suspicious activity is surfaced quickly.

Common Mistakes Organisations Make

• Underestimating harm. Deciding a breach isn't notifiable to avoid disclosure is a high-risk strategy that the OAIC scrutinises closely.
• Missing the 30-day assessment window. Delayed investigation is a common enforcement trigger.
• Poor customer communications. Vague or defensive notifications increase complaints and litigation risk.
• Ignoring supply chain incidents. If your processor is breached and it involves your data, you may still have notification obligations.
• No documentation. Even if you decide a breach isn't notifiable, document the reasoning — regulators will ask.

What's Changing: Privacy Act Reform

The Australian Government has committed to the most significant overhaul of the Privacy Act in decades. Expected changes that will affect the NDB scheme include:

• Removal or narrowing of the small business exemption, bringing millions more entities into scope.
• A statutory tort for serious invasions of privacy.
• Shorter, more prescriptive breach notification timeframes — potentially aligning with the GDPR's 72-hour rule.
• Enhanced enforcement powers, including infringement notices for lower-tier contraventions.
• Stronger requirements around children's data and automated decision-making.

Businesses should be planning now for a stricter regime, not waiting until the legislation passes.

Practical Checklist for Australian Organisations

1. Confirm whether your entity is covered by the Privacy Act and the NDB scheme.
2. Complete a personal information inventory and risk assessment.
3. Publish an internal Data Breach Response Plan and appoint a response lead.
4. Implement multi-factor authentication across all systems handling personal data.
5. Encrypt sensitive information at rest and in transit.
6. Train staff annually and run a tabletop breach exercise.
7. Review vendor contracts for breach notification clauses.
8. Prepare draft OAIC notification and customer communication templates.
9. Track OAIC guidance updates and Privacy Act reform milestones.

Where to Get Help

The OAIC website (oaic.gov.au) offers extensive free guidance, including the Data breach preparation and response guide, notification forms and template letters. For organisations without in-house privacy expertise, engaging a specialist privacy lawyer or a certified information privacy professional (CIPP/US, CIPP/E, or IAPP-ANZ members) is highly recommended before an incident, not during one.

For broader guidance on secure link handling, analytics and privacy-conscious digital tools, our team also maintains resources such as the Best URL Shorteners Reviewed and Compared: 2026 Buyer's Guide and an honest review of Lunyb, which cover the security and privacy trade-offs of common marketing tools that often touch personal data.

Frequently Asked Questions

1. Do small businesses have to comply with the NDB scheme?

Currently, most small businesses with annual turnover under AUD $3 million are exempt from the Privacy Act and therefore the NDB scheme. However, health service providers of any size, credit-related entities and businesses that trade in personal information are covered regardless of turnover. The small business exemption is under review and expected to be narrowed or removed as part of the Privacy Act reforms.

2. How quickly must I report a data breach in Australia?

You have up to 30 days to assess whether a suspected incident is an eligible data breach. Once you have reasonable grounds to believe it is, you must notify the OAIC and affected individuals "as soon as practicable" — in practice, within days. Delaying beyond that without justification is itself likely to breach the Privacy Act.

3. What is considered "serious harm" under the scheme?

Serious harm includes physical, psychological, emotional, financial and reputational harm. Examples include identity theft from stolen ID documents, financial fraud from exposed payment data, targeted scams enabled by leaked customer lists, and distress from unauthorised disclosure of health or sexuality information.

4. What happens if I don't notify a breach that I should have?

The OAIC can investigate, direct you to notify, accept an enforceable undertaking, or seek civil penalties in the Federal Court. Since December 2022, penalties for serious or repeated interferences with privacy can reach AUD $50 million, three times the benefit obtained, or 30% of adjusted turnover — whichever is greatest. Reputational damage and class actions often exceed the fines themselves.

5. Do I need to notify if the data was encrypted?

Encryption can be a form of "remedial action" that reduces the likelihood of serious harm. If data is encrypted to a strong standard, the decryption key is not compromised, and there is no reasonable prospect of the data being accessed, the incident may not be an eligible data breach. However, you must document this analysis carefully — encryption alone is not an automatic exemption.