Australian Data Breach Notification Scheme: Complete 2026 Guide

Since February 2018, Australian organisations have operated under one of the most consequential data protection obligations in the country's history: the Notifiable Data Breaches (NDB) scheme. Established under Part IIIC of the Privacy Act 1988, the scheme requires eligible entities to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to result in serious harm. With penalties rising sharply since 2022 and the OAIC becoming increasingly active, understanding the Australian data breach notification scheme is no longer optional for anyone handling personal information.

This guide breaks down exactly what the scheme requires, who it applies to, how to assess an eligible data breach, and the practical steps your organisation should take when things go wrong.

What Is the Australian Data Breach Notification Scheme?

The Australian data breach notification scheme, formally known as the Notifiable Data Breaches (NDB) scheme, is a legal framework requiring covered organisations to notify individuals and the OAIC when personal information they hold is subject to a data breach likely to cause serious harm. It came into effect on 22 February 2018 and is regulated by the OAIC under the Privacy Act 1988.

The scheme exists to give affected individuals the opportunity to take protective action — changing passwords, monitoring financial accounts, watching for identity theft — and to hold organisations publicly accountable for how they safeguard personal data.

Key objectives of the NDB scheme

• Provide transparency when personal information is compromised
• Empower individuals to mitigate their own risk of harm
• Improve organisational security practices through accountability
• Align Australia with international standards such as the EU's GDPR

Who Must Comply With the NDB Scheme?

The scheme applies to all entities already covered by the Australian Privacy Principles (APPs) under the Privacy Act. This includes a broad range of businesses, agencies, and organisations.

Entities covered by the scheme

• Australian Government agencies (federal departments and most statutory bodies)
• Businesses with annual turnover above AUD $3 million
• Private sector health service providers (regardless of turnover)
• Credit reporting bodies and credit providers
• Tax File Number (TFN) recipients
• Entities that trade in personal information
• Contracted service providers for Australian Government contracts

Small businesses under the $3 million turnover threshold are generally exempt from the Privacy Act — and therefore from the NDB scheme — but exceptions apply if they handle health information, provide services to government, or otherwise fall under specific categories.

What Counts as an Eligible Data Breach?

An eligible data breach occurs when three conditions are all met simultaneously. Understanding this test is central to your compliance obligations.

The three-part test

1. There is unauthorised access to, unauthorised disclosure of, or loss of, personal information held by the entity.
2. This is likely to result in serious harm to one or more individuals.
3. The entity has not been able to prevent the likely risk of serious harm through remedial action.

If all three conditions apply, the organisation must notify. If remedial action successfully removes the likelihood of serious harm — for example, remote wiping a lost device before data can be accessed — notification is not required.

Examples of eligible data breaches

• A cyber attack exposing customer names, addresses, and payment details
• An employee emailing a spreadsheet of client health records to the wrong recipient
• A stolen unencrypted laptop containing personal information
• A misconfigured cloud storage bucket exposing user data publicly
• Ransomware where attackers exfiltrate personal information before encryption

Understanding "Serious Harm"

"Serious harm" is the pivotal concept in determining whether notification is required. The Privacy Act does not exhaustively define it, but the OAIC provides guidance on what should be considered.

Types of serious harm

• Physical harm — including safety risks from stalking or domestic violence
• Psychological harm — distress, anxiety, or reputational damage
• Emotional harm — embarrassment or humiliation from sensitive disclosures
• Financial harm — identity theft, fraud, or unauthorised transactions
• Reputational harm — damage to professional or personal standing

Factors to weigh when assessing likelihood

1. The kind and sensitivity of the information involved
2. Whether the information is protected by security measures such as encryption
3. The persons who have obtained or could obtain the information
4. The nature of the harm that could result
5. Whether the information is combined with other data that increases risk

The 30-Day Assessment Window

When an organisation suspects an eligible data breach may have occurred, it must conduct a reasonable and expeditious assessment within 30 calendar days. This isn't a fixed grace period — the OAIC expects action "as soon as practicable."

Steps in a typical assessment

1. Contain the breach immediately to prevent further compromise
2. Evaluate the scope: what data, how many individuals, what systems
3. Investigate the cause and identify who may have accessed the information
4. Assess whether serious harm is likely, using the factors above
5. Decide whether remedial action can remove the risk of serious harm
6. Document every step of the assessment for potential OAIC review

If, at any point during the 30 days, you determine an eligible data breach has occurred, you must move to notification without waiting for the deadline.

Notification Requirements

Once an eligible data breach is confirmed, the entity must prepare a statement and notify both the OAIC and affected individuals as soon as practicable.

What the statement must contain

• The identity and contact details of the entity
• A description of the eligible data breach
• The kinds of personal information involved
• Recommendations on the steps individuals should take in response

Notifying affected individuals — three options

1. Notify all individuals whose data was involved in the breach
2. Notify only those at likely risk of serious harm (if the breach is limited)
3. Publish the statement publicly if direct notification is not practicable, and take reasonable steps to publicise it

Penalties for Non-Compliance

The consequences for failing to comply with the NDB scheme have escalated dramatically. Following amendments in December 2022, penalties for serious or repeated privacy breaches were significantly increased.

Beyond financial penalties, the OAIC can issue enforceable undertakings, seek Federal Court injunctions, and publicly name organisations. Reputational damage from a mishandled breach can easily exceed the statutory penalty.

How to Prepare Before a Breach Happens

The most compliant organisations don't wait for an incident to plan their response. Preparation is both a legal expectation under APP 11 (security of personal information) and a practical necessity.

Building a data breach response plan

1. Establish a response team with clearly defined roles (IT, legal, communications, executive)
2. Document data flows so you know what personal information you hold and where
3. Implement detection controls including logging, monitoring, and alerting
4. Draft template notifications for both the OAIC and affected individuals
5. Rehearse the plan through tabletop exercises at least annually
6. Maintain an incident register to track suspected and confirmed breaches

Reducing your attack surface

• Enforce multi-factor authentication across all business systems
• Encrypt personal information both at rest and in transit
• Minimise data collection and enforce retention limits
• Vet third-party providers and their security certifications
• Train staff on phishing recognition and secure data handling
• Use privacy-conscious tools for external-facing links and content sharing — services like Lunyb allow you to share URLs without exposing internal system details or tracking parameters that might inadvertently leak metadata

Common Causes of Notifiable Data Breaches in Australia

The OAIC publishes half-yearly reports summarising the sources and sectors involved in notifications. The consistent themes reveal where organisations should focus their defences.

Top breach sources

• Malicious or criminal attacks — including phishing, ransomware, and compromised credentials, consistently the largest category
• Human error — misdirected emails, unintended disclosures, and lost devices
• System faults — misconfigurations and software vulnerabilities

Most affected sectors

1. Health service providers
2. Finance (including superannuation)
3. Insurance
4. Retail
5. Australian Government agencies
6. Education

How the NDB Scheme Compares Internationally

Australia's regime shares DNA with other major privacy laws but has distinct features worth noting.

Recent Reforms and What's Ahead

The Australian privacy landscape is undergoing its most significant overhaul since the Privacy Act was enacted. The Government's response to the Privacy Act Review Report signalled a series of tranches of reform, several of which directly affect breach notification.

Expected changes

• Potential removal or narrowing of the small business exemption
• Introduction of a statutory tort for serious invasions of privacy
• Tighter timeframes for OAIC notification
• Expanded definitions of personal information to include technical identifiers
• Enhanced enforcement powers for the Information Commissioner

Organisations should treat compliance as a moving target and monitor developments through 2026 and beyond.

Related Reading

For readers looking to strengthen the broader security and privacy posture of their online presence, these guides may be useful:

• Is Lunyb Legit? An Honest Review of the URL Shortener in 2026
• Best URL Shorteners Reviewed and Compared: 2026 Buyer's Guide
• Rebrandly Review 2026: Is It Worth the Price?

Frequently Asked Questions

Do I need to report every data breach to the OAIC?

No. Only eligible data breaches — those likely to result in serious harm that can't be remediated — must be reported. Minor incidents that don't meet the threshold should still be documented internally, but notification is not required. When in doubt, err on the side of transparency and consult the OAIC's guidance.

How long do I have to notify the OAIC after confirming a breach?

The Privacy Act requires notification "as soon as practicable" after the entity is aware, or ought reasonably to be aware, that an eligible data breach has occurred. Unlike the EU's 72-hour rule, there is no fixed hour count, but delays without justification can attract regulatory scrutiny.

What happens if I decide a breach isn't notifiable and the OAIC disagrees?

The Information Commissioner has power to direct an entity to notify, even if the entity initially decided the breach was not eligible. Keeping thorough documentation of your assessment process — including the factors weighed and the reasoning applied — is your best defence in this scenario.

Are small businesses really exempt from the NDB scheme?

Small businesses with under AUD $3 million turnover are generally exempt, but exemptions carved out for health providers, credit reporting, TFN handling, and government contractors mean many small operators are still covered. Ongoing privacy reforms may remove this exemption altogether, so small businesses should not assume permanent immunity.

What should individuals do if they receive a data breach notification?

Take the recommendations in the notice seriously: change passwords, enable multi-factor authentication where possible, monitor bank and credit accounts, place a credit ban if identity documents were exposed, and be alert to targeted phishing attempts using the leaked information. IDCARE (idcare.org) offers free support to Australians affected by identity compromise.

Final Thoughts

The Australian data breach notification scheme is now a mature and increasingly assertive regulatory regime. With penalties in the tens of millions and public expectations of transparency at an all-time high, organisations that treat breach preparedness as a strategic function — rather than a checkbox — will fare best. The fundamentals haven't changed: know what data you hold, protect it proportionately to its sensitivity, detect incidents quickly, and communicate openly when things go wrong. The NDB scheme codifies these principles into enforceable obligations, and every entity handling personal information in Australia should treat compliance as ongoing operational hygiene rather than a one-off project.