Australian Data Breach Notification Scheme: Complete 2026 Guide

The Notifiable Data Breaches (NDB) scheme is one of the most important privacy obligations facing Australian organisations. Since it commenced on 22 February 2018, it has reshaped how businesses, government agencies, health providers and not-for-profits respond when personal information is compromised. With cyber incidents at record highs and penalties under the Privacy Act 1988 now reaching into the tens of millions of dollars, understanding the Australian data breach notification scheme is no longer optional — it is a core part of running a compliant, trustworthy organisation.

This guide explains exactly how the NDB scheme works, who must comply, when notification is required, what to include in a report to the Office of the Australian Information Commissioner (OAIC), and how to prepare a response plan that stands up under pressure.

What Is the Australian Data Breach Notification Scheme?

The Australian data breach notification scheme is a legal framework under Part IIIC of the Privacy Act 1988 (Cth) that requires regulated entities to notify affected individuals and the OAIC when an eligible data breach occurs. An eligible data breach happens when there is unauthorised access to, unauthorised disclosure of, or loss of personal information that is likely to result in serious harm to one or more individuals.

The scheme is administered by the OAIC, headed by the Australian Information Commissioner. It applies to any incident where remedial action cannot prevent that serious harm from occurring. The purpose is straightforward: give individuals the opportunity to protect themselves — by changing passwords, monitoring accounts, cancelling cards or watching for identity theft — before criminals can exploit the exposed data.

Key Elements of an Eligible Data Breach

1. Unauthorised access, disclosure or loss of personal information held by the entity.
2. The breach is likely to result in serious harm to any of the individuals to whom the information relates.
3. The entity has been unable to prevent the likely risk of serious harm through remedial action.

Who Must Comply With the NDB Scheme?

The scheme applies to all entities that have existing personal information security obligations under the Australian Privacy Principles (APPs). This includes:

• Australian Government agencies
• Businesses and not-for-profits with an annual turnover of more than AUD $3 million
• All private sector health service providers, regardless of turnover
• Credit reporting bodies and credit providers
• Tax File Number (TFN) recipients
• Certain small businesses that trade in personal information, provide services under Commonwealth contracts, or are related to a larger APP entity

Foreign organisations that carry on business in Australia and collect or hold personal information in Australia are also subject to the scheme, even if they have no physical presence in the country.

What Counts as "Serious Harm"?

Serious harm is not defined exhaustively in the Privacy Act, but the OAIC guidance and case law identify several categories:

• Physical harm — for example, disclosure of a location that endangers a domestic violence survivor.
• Psychological or emotional harm — such as distress from exposure of sensitive health or sexual information.
• Financial harm — identity theft, fraudulent transactions, extortion, loss of employment.
• Reputational harm — release of information that damages a person's standing in the community.

When assessing whether serious harm is likely, entities must consider the sensitivity of the information, whether it was protected by encryption or other safeguards, the nature of the harm, who obtained the information, and the number of individuals affected.

Notification Timelines and the 30-Day Assessment Rule

Timing is one of the most misunderstood aspects of the Australian data breach notification scheme. There are two clocks to be aware of.

1. The 30-Day Assessment Period

If an entity has reasonable grounds to suspect that an eligible data breach may have occurred but is not yet certain, it must carry out a reasonable and expeditious assessment within 30 calendar days. The assessment should determine whether the incident is, in fact, an eligible data breach.

2. Notification "As Soon As Practicable"

Once an entity has reasonable grounds to believe an eligible data breach has occurred, it must notify the OAIC and affected individuals as soon as practicable. There is no fixed 72-hour rule like the EU's GDPR — but "as soon as practicable" has been interpreted strictly, and delays without justification can attract enforcement action.

How to Notify: The Statement to the Commissioner

Notification is made through a formal statement to the Commissioner, submitted via the OAIC's online Notifiable Data Breach form. The statement must include:

1. The identity and contact details of the entity.
2. A description of the eligible data breach.
3. The kind or kinds of information involved (e.g. names, TFNs, health records, financial details).
4. Recommendations about the steps individuals should take in response.

Affected individuals must also be notified of the same information. There are three options for individual notification:

• Option 1: Notify all individuals to whom the information relates.
• Option 2: Notify only those individuals at likely risk of serious harm.
• Option 3: If neither of the above is practicable, publish the statement on the entity's website and take reasonable steps to publicise it.

NDB Scheme vs GDPR: How They Compare

Many Australian organisations also deal with European customers and must therefore understand how the NDB scheme differs from the EU's General Data Protection Regulation.

Feature	Australian NDB Scheme	EU GDPR
Regulator	OAIC	National Data Protection Authorities
Notification trigger	Likely serious harm	Risk to rights and freedoms
Regulator notification window	As soon as practicable	Within 72 hours
Assessment period	Up to 30 days	No formal assessment window
Maximum penalty (serious/repeated)	Up to AUD $50 million or more	€20 million or 4% global turnover
Scope	APP entities	Any controller/processor handling EU data

Penalties for Non-Compliance

Following amendments in the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022, the maximum civil penalty for serious or repeated interferences with privacy increased dramatically. For body corporates, penalties can now reach the greater of:

• AUD $50 million;
• Three times the value of any benefit obtained from the misuse of information; or
• 30% of the entity's adjusted turnover in the relevant period.

The OAIC also has expanded investigative powers, including the ability to conduct assessments, demand information, and share information with other regulators such as the Australian Cyber Security Centre (ACSC) and overseas privacy authorities.

Common Causes of Notifiable Breaches in Australia

The OAIC publishes biannual statistics on notifications. The most common causes consistently include:

1. Malicious or criminal attacks — phishing, ransomware, compromised credentials and social engineering account for the majority of notifications.
2. Human error — emails sent to the wrong recipient, misconfigured cloud storage, or lost devices.
3. System faults — software bugs, integration errors, and misapplied access controls.

Health service providers, finance, insurance, government and education consistently top the list of sectors reporting the most breaches. This reflects both the sensitivity of the data they hold and the sophistication of attacks targeting them.

Building an NDB-Ready Response Plan

Compliance is much easier when an incident response plan is in place before a breach occurs. A robust plan for the Australian data breach notification scheme should include the following elements.

1. A Data Breach Response Team

Nominate a cross-functional team including legal, IT/security, communications, HR and executive sponsors. Document who leads the team and who has authority to notify regulators.

2. Detection and Escalation Procedures

Ensure staff know how to identify and report suspected incidents — including phishing, lost devices, misdirected emails and suspicious system behaviour. Escalation should reach the response team within hours, not days.

3. Assessment Framework

Create a documented process for the 30-day assessment, including the criteria used to determine whether serious harm is likely. Templates and decision trees speed up decisions when everyone is under stress.

4. Containment and Remediation

Have technical playbooks for common scenarios — credential compromise, ransomware, cloud data exposure and lost hardware. Effective remediation can sometimes prevent an incident from becoming a notifiable breach at all.

5. Notification Templates

Prepare draft statements for the OAIC and affected individuals. Pre-approved language for common breach types dramatically reduces time-to-notify.

6. Post-Incident Review

Every incident should feed back into training, controls and policy. The OAIC expects organisations to demonstrate continuous improvement.

Practical Security Measures That Reduce Risk

The NDB scheme does not prescribe specific technical controls, but the Australian Privacy Principles — particularly APP 11 — require entities to take reasonable steps to protect personal information. The following measures are widely regarded as baseline expectations in 2026:

• Multi-factor authentication (MFA) on all remote and privileged access.
• Encryption of personal information at rest and in transit.
• Least-privilege access controls and regular access reviews.
• Endpoint detection and response (EDR) tools on all corporate devices.
• Regular patching aligned with the ACSC's Essential Eight.
• Encrypted DNS and secure browser configurations for staff who handle sensitive data.
• Vendor and supply-chain risk assessments — third-party breaches are increasingly common.
• Data minimisation: don't collect or retain personal information you don't need.

Small operational habits matter too. When sharing links to internal resources, customer portals or one-off documents, use a privacy-respecting link management platform such as Lunyb so that URLs can be tracked, expired and revoked — reducing the risk of stale links becoming an entry point for attackers. You can read more in our honest review of Lunyb, or compare options in our 2026 URL shortener buyer's guide.

Exceptions to Notification

Not every breach must be reported. The Privacy Act recognises several exceptions:

• Remedial action exception — if the entity takes action so that the breach is no longer likely to cause serious harm, no notification is required.
• Enforcement-related activities — notification may be avoided if it would prejudice an enforcement investigation.
• Inconsistency with secrecy provisions — where other Commonwealth laws prohibit disclosure.
• Multi-party breaches — when several entities are affected by the same breach, only one needs to notify, provided the others are covered by that notification.

Recent Trends and Enforcement Signals

The OAIC has become significantly more active. Recent trends worth noting include:

• Increased use of Commissioner-initiated investigations following high-profile breaches.
• Greater scrutiny of how long organisations take to detect and assess incidents.
• Focus on ransomware — the OAIC treats data exfiltrated during ransomware attacks as an unauthorised disclosure, even if it is not publicly released.
• Coordination with the ACSC, ASIC and APRA on major incidents in financial services and critical infrastructure.
• Push toward reforms recommended in the Privacy Act Review Report, including a possible statutory tort for serious invasions of privacy and mandatory breach reporting within a fixed 72-hour window.

Frequently Asked Questions

Do I have to report every data breach in Australia?

No. Only eligible data breaches — those likely to cause serious harm that cannot be prevented through remedial action — must be reported under the NDB scheme. However, it is best practice to log and internally investigate all incidents, because patterns may reveal larger issues.

How quickly do I need to notify the OAIC?

You must notify as soon as practicable after forming a reasonable belief that an eligible data breach has occurred. If you only suspect a breach, you have up to 30 days to complete an assessment. Delays must be justifiable and documented.

Does the NDB scheme apply to small businesses?

Generally, businesses with turnover under AUD $3 million are exempt from the Privacy Act, but there are important exceptions. Small health service providers, businesses that trade in personal information, TFN recipients, and contractors delivering services to the Commonwealth are all covered regardless of size.

What happens if I fail to notify?

Failure to comply can constitute a serious interference with privacy, exposing body corporates to civil penalties of up to AUD $50 million (or higher based on turnover or benefit). The OAIC can also issue determinations requiring the entity to change practices, apologise or compensate affected individuals.

Are overseas companies subject to the Australian NDB scheme?

Yes. Foreign organisations that carry on business in Australia and collect or hold personal information about Australians are subject to the Privacy Act and the NDB scheme. This includes many global SaaS providers, e-commerce platforms and cloud services.

Final Thoughts

The Australian data breach notification scheme is more than a compliance checkbox — it is a framework for earning and keeping trust in an environment where cyber incidents are inevitable. Organisations that invest in prevention, prepare a clear response plan and treat notification as an act of transparency rather than a threat will fare far better than those that scramble at the last minute. With penalties climbing, regulator activity increasing, and further Privacy Act reform on the horizon, 2026 is the year to get your data breach readiness right.