Australian Data Breach Notification Scheme: Complete 2026 Compliance Guide

The Australian Data Breach Notification Scheme, formally known as the Notifiable Data Breaches (NDB) scheme, is one of the most significant data protection obligations Australian organisations face. Introduced in February 2018 under Part IIIC of the Privacy Act 1988, the scheme requires eligible entities to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to result in serious harm.

With record-high penalties, growing regulatory scrutiny, and high-profile incidents like the Optus and Medibank breaches reshaping public expectations, understanding your obligations under the NDB scheme is no longer optional. This guide walks Australian businesses through everything they need to know in 2026.

What Is the Australian Data Breach Notification Scheme?

The Notifiable Data Breaches scheme is a legally mandated framework under the Privacy Act 1988 (Cth) that requires organisations covered by the Australian Privacy Principles (APPs) to report eligible data breaches to both affected individuals and the OAIC. The scheme is administered by the Australian Information Commissioner and applies to most Australian Government agencies and private sector organisations with an annual turnover of more than $3 million, along with certain smaller entities.

The core purpose of the scheme is to give individuals timely information about data breaches that could cause them serious harm, allowing them to take protective action such as changing passwords, monitoring bank accounts, or requesting new identification documents.

Who Must Comply?

The following entities are subject to the NDB scheme:

Australian Government agencies
Businesses and not-for-profit organisations with annual turnover above $3 million
Private sector health service providers (regardless of turnover)
Credit reporting bodies and credit providers
Tax File Number (TFN) recipients
Entities that trade in personal information
Contractors handling personal information under Commonwealth contracts

What Qualifies as an Eligible Data Breach?

An eligible data breach occurs when three conditions are met simultaneously. Understanding this threshold is critical because not every security incident triggers notification obligations.

There is unauthorised access to, unauthorised disclosure of, or loss of personal information held by the entity.
The access, disclosure, or loss is likely to result in serious harm to one or more individuals.
The entity has not been able to prevent the likely risk of serious harm through remedial action.

Understanding "Serious Harm"

The Privacy Act does not exhaustively define "serious harm," but the OAIC identifies several categories:

Financial harm — identity theft, fraud, or economic loss
Physical harm — threats to safety, particularly for domestic violence victims
Psychological harm — distress, humiliation, or emotional damage
Reputational harm — damage to standing in a community or profession
Emotional harm — anxiety or embarrassment caused by exposure

Factors relevant to assessing serious harm include the sensitivity of the information (health data, TFNs, and financial details rank highest), the nature of the recipients, whether encryption or other protections were in place, and how long the information was exposed.

Notification Timelines and Process

Timing is the single most litigated aspect of NDB compliance. Australian organisations have very specific windows in which they must act.

The 30-Day Assessment Window

If an entity suspects an eligible data breach may have occurred but is not certain, it must carry out a reasonable and expeditious assessment within 30 calendar days of becoming aware of the potential breach. This is not a grace period — assessments must begin immediately, and delay itself can constitute a breach of the Australian Privacy Principles.

The Notification Requirement

Once an eligible data breach is confirmed, the entity must, as soon as practicable:

Prepare a statement for the Australian Information Commissioner
Notify affected individuals of the contents of that statement
Publish the statement on its website if direct notification is not practicable

What Must the Notification Contain?

Required Element	Description
Entity identity and contact details	Name and contact information of the reporting organisation
Description of the breach	A clear, plain-language explanation of what happened
Type of information involved	Categories of personal information affected (names, addresses, TFNs, health data, etc.)
Recommended steps for individuals	Practical actions individuals should take to protect themselves
Other entities involved	If a joint breach, identify all responsible entities

Penalties for Non-Compliance

The financial and reputational consequences of failing to comply with the NDB scheme have escalated dramatically. Following amendments to the Privacy Act in late 2022, maximum penalties for serious or repeated interferences with privacy now sit at whichever is the greatest of:

AU$50 million
Three times the value of any benefit obtained through the misuse of information
30% of the entity's adjusted turnover during the relevant period

Beyond civil penalties, the OAIC can issue determinations, accept enforceable undertakings, and seek injunctions. Class actions from affected individuals are increasingly common — Medibank alone faced multiple representative proceedings following its 2022 breach.

Step-by-Step Breach Response Playbook

When a suspected breach occurs, having a documented response plan is essential. Here is a practical framework aligned with OAIC guidance.

Step 1: Contain the Breach

Immediately stop the unauthorised access or disclosure. This might mean disabling compromised accounts, revoking access tokens, isolating affected systems, or recovering lost hardware. Document every containment action taken.

Step 2: Assess the Risks

Evaluate what personal information was involved, how many individuals are affected, who may have accessed the data, and whether serious harm is likely. Engage legal counsel and forensic specialists early — their reports may be subject to legal professional privilege if properly structured.

Step 3: Notify

If the breach is eligible, notify the OAIC using the online Notifiable Data Breach form and communicate directly with affected individuals via email, SMS, or postal mail. Where direct notification is impracticable (for example, when contact details are themselves compromised), publish a prominent public statement.

Step 4: Review and Remediate

Conduct a post-incident review. Identify the root cause, update policies and controls, retrain staff, and consider whether additional technical measures — such as multi-factor authentication, encryption at rest, or improved access logging — are warranted.

Common Causes of Notifiable Data Breaches in Australia

The OAIC publishes biannual Notifiable Data Breaches Reports, which offer valuable insight into where Australian organisations are failing. Consistent themes include:

Malicious or criminal attacks (approximately 65% of breaches) — phishing, ransomware, and credential compromise dominate
Human error (approximately 30%) — misdirected emails, unauthorised disclosures, and lost devices
System faults — misconfigurations exposing databases or cloud storage

The health sector and finance sector consistently top the list of notifying industries, reflecting both the sensitivity of the data they hold and the attractiveness of these sectors to attackers.

Best Practices for NDB Compliance

Compliance is not just about responding to breaches — it is about building a culture and infrastructure that reduces their likelihood and impact.

Governance and Documentation

Maintain a current Data Breach Response Plan approved by executive leadership
Keep a register of personal information holdings and data flows
Conduct regular Privacy Impact Assessments for new projects
Ensure your Privacy Policy is accurate, accessible, and up to date

Technical Safeguards

Enforce multi-factor authentication for all administrative and remote access
Encrypt personal information both at rest and in transit
Implement least-privilege access controls and regular access reviews
Deploy endpoint detection and response tools
Use encrypted DNS and secure link-sharing tools when distributing sensitive URLs — services like Lunyb allow organisations to create trackable, revocable short links without exposing underlying destinations

People and Process

Deliver annual privacy and cyber security training to all staff
Run tabletop breach simulations at least annually
Assign clear roles: incident commander, communications lead, legal lead, technical lead
Vet third-party vendors and include breach notification clauses in contracts

How the NDB Scheme Interacts with Other Frameworks

Australian organisations rarely deal with the NDB scheme in isolation. Common overlapping obligations include:

Framework	Interaction with NDB
GDPR (EU)	Applies if you offer goods/services to EU residents; has a 72-hour notification window
SOCI Act (critical infrastructure)	Requires cyber incident reporting to ASD within 12 or 72 hours depending on impact
APRA CPS 234	Financial institutions must notify APRA of material information security incidents within 72 hours
My Health Records Act	Separate mandatory notification regime for My Health Record data
State/territory laws	NSW, Queensland, and Victoria have their own public sector schemes

A single incident may trigger multiple notification obligations with different timelines and recipients. Response plans should map these overlaps in advance.

Recent Reforms and What to Expect in 2026

The Australian Government has been progressing significant privacy reforms following the Attorney-General's Privacy Act Review. Key changes either enacted or under consideration include:

Removal or reduction of the small business exemption (currently protecting entities under $3 million turnover)
Introduction of a statutory tort for serious invasions of privacy
Tiered civil penalties for less severe breaches
Expanded OAIC powers, including infringement notices
Enhanced children's privacy protections and a Children's Online Privacy Code

Organisations should treat the current $3 million threshold as an increasingly unreliable safe harbour and prepare for broader coverage in the near future.

Frequently Asked Questions

How quickly must I notify the OAIC of a data breach?

You must notify the OAIC and affected individuals "as soon as practicable" after determining that an eligible data breach has occurred. If you only suspect a breach, you have up to 30 days to assess whether it qualifies — but the assessment itself must begin immediately and be conducted expeditiously.

What happens if I decide a breach is not "eligible" and don't notify?

You should document your assessment thoroughly, including the reasoning behind your conclusion. If the OAIC later disagrees, you may face investigation and penalties. When in doubt, seek legal advice — over-notification is generally safer than under-notification, though both carry risks.

Does the NDB scheme apply to small businesses?

Generally, businesses with annual turnover under $3 million are exempt from the Privacy Act and therefore the NDB scheme. However, exceptions apply to health service providers, credit providers, TFN recipients, and businesses that trade in personal information. Proposed reforms may remove this exemption entirely, so smaller organisations should prepare for future coverage.

Can I be penalised for a breach caused by a third-party supplier?

Yes. Under Australian Privacy Principle 11, entities remain responsible for personal information they hold, including when it is processed by contractors or cloud providers. Robust vendor due diligence, contractual data protection clauses, and clear breach notification requirements from suppliers are essential.

What should I include in my breach response plan?

At minimum: clearly defined roles and escalation paths, containment procedures, an assessment methodology, notification templates for both individuals and the OAIC, communication protocols for media and stakeholders, evidence preservation processes, and post-incident review procedures. Test the plan annually through tabletop exercises.

Final Thoughts

The Australian Data Breach Notification Scheme is not a static compliance checkbox — it is an evolving obligation embedded within a broader modernisation of Australian privacy law. Organisations that treat NDB compliance as an integrated part of their information governance, invest in preventative controls, and rehearse their response processes will not only avoid penalties but also preserve customer trust when incidents inevitably occur.

With penalties now reaching tens of millions of dollars and public tolerance for breaches at an all-time low, the cost of unpreparedness has never been higher. Start with a plan, test it regularly, and treat every near-miss as a lesson.