Australian Data Breach Notification Scheme: Complete Compliance Guide

If your organisation holds personal information about Australians, the Notifiable Data Breaches (NDB) scheme is not optional reading — it is the rulebook you will be judged against when something goes wrong. And at Lunyb, we think about this every day, because the tools we build are designed to shorten the distance between a breach happening and your team doing something about it.

This guide walks you through what the Australian data breach notification scheme requires, how to assess a suspected breach, how to notify the OAIC and affected individuals, and how Lunyb fits into a modern response plan for both businesses and the people they protect.

What is the Australian Data Breach Notification Scheme?

The Australian data breach notification scheme — formally the Notifiable Data Breaches (NDB) scheme — is part of the Privacy Act 1988 and has been in force since February 2018. It requires covered entities to notify the Office of the Australian Information Commissioner (OAIC) and affected individuals when an eligible data breach is likely to result in serious harm.

The scheme is regulated by the OAIC and applies to most organisations with an annual turnover above AUD $3 million, plus specific smaller entities such as health service providers, credit reporting bodies, TFN recipients, and Australian Government agencies.

Who the scheme applies to

• APP entities — organisations and agencies covered by the Australian Privacy Principles.
• Credit reporting bodies and credit providers handling credit information.
• Health service providers of any size, including allied health and gyms holding health data.
• TFN recipients that handle tax file numbers.
• Australian Government agencies subject to the Privacy Act.

What counts as an eligible data breach

An eligible data breach happens when three conditions are met:

1. There is unauthorised access to, unauthorised disclosure of, or loss of personal information held by the entity.
2. The access, disclosure or loss is likely to result in serious harm to one or more individuals.
3. The entity has not been able to prevent the likely risk of serious harm through remedial action.

Serious harm can be physical, psychological, emotional, financial or reputational. Think identity theft, financial fraud, stalking, discrimination, or loss of professional standing — not just any inconvenience.

Key Obligations Under the NDB Scheme

Compliance is not just about sending an email after something bad happens. The NDB scheme imposes a chain of duties: assess, contain, notify, and improve.

The 30-day assessment window

If you have reasonable grounds to suspect an eligible data breach may have occurred, you must carry out a reasonable and expeditious assessment within 30 calendar days. During this window you investigate scope, data types, affected people and likelihood of serious harm.

Notification requirements

If the assessment confirms an eligible data breach, you must notify as soon as practicable:

• The OAIC — using the Notifiable Data Breach form, which captures entity details, a description of the breach, the kinds of information involved, and recommended steps for individuals.
• Affected individuals — either directly (email, SMS, phone, letter) or, if direct contact is not practicable, by publishing the statement on your website and taking reasonable steps to publicise it.

What a notification must include

1. The identity and contact details of the entity.
2. A description of the data breach.
3. The kinds of information involved (e.g. names, addresses, Medicare numbers, passwords).
4. Recommendations for steps individuals should take in response.

Penalties and Why Compliance Is Getting More Serious

Since the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022, maximum penalties for serious or repeated interferences with privacy have increased dramatically for body corporates — the greater of AUD $50 million, three times the benefit obtained, or 30% of adjusted turnover in the relevant period. The OAIC also has stronger investigation and information-gathering powers.

On top of regulatory risk, there is customer trust. The OAIC publishes six-monthly Notifiable Data Breaches reports that name sectors and attack vectors, and major breaches routinely dominate headlines in Australia. A clean, fast, transparent response is now a competitive advantage.

Step-by-Step: Responding to a Suspected Breach

Every Australian organisation holding personal information should have a written Data Breach Response Plan. Here is a condensed version aligned with OAIC guidance.

1. Contain. Isolate affected systems, revoke credentials, disable compromised accounts, stop further data loss.
2. Assess. Identify what personal information is involved, how many people are affected, who could access it, and what harm is likely.
3. Consult. Bring in privacy, legal, IT security, communications, and executive stakeholders early.
4. Remediate. Take action to reduce the risk of serious harm — for example, force password resets, cancel cards, or recover lost devices.
5. Notify. If the breach is eligible, notify the OAIC and affected individuals with clear, actionable guidance.
6. Review. Conduct a post-incident review, update controls, and train staff.

Common Data Breach Scenarios in Australia

Credential-based attacks

Phishing, credential stuffing and reused passwords remain the single largest source of notifiable breaches reported to the OAIC. One leaked password in a supplier tool can cascade into customer data exposure.

Lost or stolen devices

Unencrypted laptops, USB drives and phones left in taxis or stolen from cars continue to trigger notifications, especially in health and professional services.

Human error

Emailing a spreadsheet to the wrong distribution list, misconfigured cloud buckets, and mail-merge mistakes consistently appear in OAIC reporting.

Malicious or criminal attacks

Ransomware, data-exfiltration extortion and third-party supplier compromise have driven some of Australia's largest notifiable incidents.

How Lunyb Helps You Meet the NDB Scheme in Practice

The NDB scheme is a legal framework, but compliance is lived day to day in the tools your staff and customers actually use. Lunyb is built for exactly that layer — the personal and operational privacy habits that make breaches less likely, and make response faster when something slips through.

Data Breach Alerts for email and phone

Lunyb's Data Breach Alerts monitor your email addresses and phone numbers against known breach corpora and notify you when they appear in a new exposure. For individuals, this means you learn about a breach as soon as it is known — often before the breached company's own notification lands. For small business owners, directors and executives, it is an early signal that credentials tied to your corporate accounts may be in criminal hands.

Privacy Check and Security Score

Our Privacy Check reviews the permissions apps have on your phone, and the Security Score gives you a single, honest number to track improvement over time. For NDB-covered entities, we think this is a natural complement to staff awareness training: give your people a tool that nudges them to tighten their own privacy posture, and you reduce the chance that a lost phone becomes a notifiable event.

Scam Checker and Scam Shield

Because phishing is the dominant path into most Australian breaches, Lunyb includes a Scam Checker for suspicious messages and links, plus Scam Shield caller protection. Staff and family members can paste a dodgy SMS or link and get a clear read before they click. Catching one fake myGov, Australia Post or bank message can prevent an entire credential-theft chain.

Encrypted Password and Photo Vault

Reused and weak passwords are the fuel of credential stuffing. Lunyb's encrypted Password Vault lets individuals and small teams stop reusing credentials, while the Photo Vault keeps sensitive images (IDs, Medicare cards, licences) out of general camera rolls where they are easy to leak.

On-device tracker and threat blocking

Lunyb's on-device, network-level protections use an encrypted DNS shield to block known tracker and threat domains before they ever load. That means fewer third-party scripts collecting personal data from staff devices, and fewer opportunities for malicious domains to deliver payloads.

Photo Guard, data-broker exposure help and browsing-history eraser

Our Photo Guard reverse-image tool, data-broker style exposure help, and browsing-history eraser support the ongoing clean-up work that follows almost every personal breach — reducing the surface area attackers can use for social engineering against you or your team.

Secure link shortening and QR for breach communications

When you need to send affected customers to a notification page, the links you use matter. Lunyb's link shortener and secure QR platform gives you clean, branded short links and QR codes you control, instead of generic shorteners that scammers routinely spoof. If you are comparing options, see our take in Rebrandly Review 2026: Is It Worth the Price (or Try Lunyb)? and our own transparency piece, Is Lunyb Legit? Honest Review of the Privacy-First URL Shortener (2026).

Lunyb vs Manual Compliance Habits

You can do a lot of this by hand. The question is whether you will, consistently, across every device and every family member or staff member.

Building a Breach-Ready Culture

The NDB scheme rewards organisations that have thought about breaches before they happen. A few practical moves to pair with Lunyb:

• Maintain a written Data Breach Response Plan with named roles and escalation paths.
• Keep an up-to-date data map of what personal information you hold, where, and why.
• Run tabletop exercises at least annually, including a scenario involving a third-party supplier.
• Require multi-factor authentication everywhere it is available.
• Give staff and their families access to practical privacy tools — a breach of a personal account often becomes a work problem.

Get Ahead of the Next Breach with Lunyb

You cannot guarantee you will never be breached. You can guarantee how quickly you learn, how calmly you respond, and how much personal risk your people carry into work every day. That is the problem Lunyb is built to help solve.

Head to lunyb.com to take our free privacy quiz, or download the Lunyb app from the App Store or Google Play. Plans start from about $19.99/month, renew until cancelled, and you can cancel anytime online. Optional Leak Protection is billed separately and can be paused without cancelling your main plan — because clear, honest terms are part of how we think privacy should work.

Frequently Asked Questions

Who has to comply with the Australian data breach notification scheme?

The NDB scheme applies to APP entities under the Privacy Act, including most businesses with annual turnover over AUD $3 million, all health service providers, credit reporting bodies, credit providers handling credit eligibility information, TFN recipients and Australian Government agencies.

How quickly do I have to notify the OAIC of a data breach?

You must assess a suspected eligible breach within 30 calendar days of becoming aware of it. Once you confirm it is an eligible data breach, you must notify the OAIC and affected individuals as soon as practicable — not at the end of the 30 days if you already know sooner.

What personal information is covered?

Any information or opinion about an identified or reasonably identifiable individual, including names, contact details, government identifiers like Medicare and TFN, financial information, health information and online identifiers.

Do I need to notify every breach?No. You only need to notify when the breach is likely to result in serious harm and you cannot prevent that risk through remedial action. Minor incidents fully contained before harm is likely do not need to be notified, though you should still document them.

How does Lunyb support NDB compliance?

Lunyb helps on the practical, human side of compliance — Data Breach Alerts for email and phone, Scam Checker and Scam Shield for phishing, encrypted Password and Photo Vaults, on-device tracker and threat blocking, Privacy Check, and secure branded short links and QR codes for customer communications. It does not replace your legal obligations under the Privacy Act, but it helps your organisation and your people stay breach-ready.