Australian Data Breach Notification Scheme: Complete 2026 Guide

The Australian Data Breach Notification Scheme, formally known as the Notifiable Data Breaches (NDB) scheme, is one of the most important privacy obligations facing organisations operating in Australia. Since its introduction in February 2018 under Part IIIC of the Privacy Act 1988, it has reshaped how businesses detect, assess, and disclose incidents involving personal information. With penalties strengthened dramatically in recent years and the Office of the Australian Information Commissioner (OAIC) taking a more active enforcement stance, understanding your obligations has never been more critical.

This guide walks you through everything you need to know: who the scheme applies to, what counts as a notifiable breach, the strict timelines involved, how to notify affected individuals and the Commissioner, and the practical steps your organisation should take to stay compliant.

What Is the Notifiable Data Breaches Scheme?

The Notifiable Data Breaches scheme is an Australian federal law requiring certain entities to notify affected individuals and the OAIC when a data breach is likely to result in serious harm. It applies to all organisations covered by the Australian Privacy Principles (APPs) and operates alongside Australia's broader privacy framework.

The scheme was introduced to improve transparency, give individuals the ability to protect themselves after a breach, and incentivise organisations to invest in stronger information security. It sits within the Privacy Act 1988 and is administered by the Australian Information Commissioner.

Key Objectives of the Scheme

• Protect individuals from harm caused by compromised personal information
• Encourage better data handling and security practices
• Build community trust in how personal data is managed
• Create consistent breach reporting standards across Australia

Who Must Comply with the NDB Scheme?

The scheme applies to any entity already subject to the Privacy Act. This is broader than many businesses realise and includes a wide range of organisations across the public and private sectors.

Entities Covered

• Australian Government agencies at federal level
• Businesses with annual turnover over AU$3 million
• Private sector health service providers (regardless of turnover)
• Credit reporting bodies and credit providers
• Tax File Number (TFN) recipients
• Entities that trade in personal information
• Contracted service providers for Commonwealth contracts

Small businesses with turnover under AU$3 million are generally exempt, but there are notable exceptions. If your small business handles health records, provides a residential tenancy database, or sells personal information, you are still covered.

What Counts as an Eligible Data Breach?

An eligible data breach occurs when three conditions are met: there is unauthorised access to or disclosure of personal information (or loss of information where such access is likely), a reasonable person would conclude the breach is likely to result in serious harm to one or more individuals, and the entity has not been able to prevent that harm through remedial action.

Types of Breaches Commonly Reported

1. Malicious or criminal attacks — ransomware, phishing, hacking, social engineering
2. Human error — emails sent to the wrong recipient, lost devices, misconfigured systems
3. System faults — software bugs exposing records, access control failures

According to recent OAIC reports, malicious or criminal attacks consistently account for the majority of notified breaches, with cyber incidents such as compromised credentials and ransomware topping the list.

What Does "Serious Harm" Mean?

Serious harm is not defined narrowly in the legislation but is assessed against reasonable likelihood. It can include:

• Financial harm (fraud, identity theft, stolen funds)
• Physical harm or threats to safety
• Psychological or emotional harm
• Reputational damage
• Discrimination or workplace consequences

Factors that influence this assessment include the sensitivity of the data, whether it is protected by encryption, who obtained it, and whether the information could be combined with other data to amplify harm.

The 30-Day Assessment Rule

If your organisation suspects an eligible data breach has occurred but isn't certain, you must carry out a reasonable and expeditious assessment within 30 calendar days. This is one of the most time-sensitive obligations under the scheme.

During the assessment period, you need to determine:

1. Whether a breach actually occurred
2. What personal information was involved
3. Who may have accessed or obtained the data
4. Whether serious harm is likely
5. Whether remedial action can prevent that harm

If remedial action successfully prevents serious harm — for example, you recover a lost device before data was accessed, or you reset compromised credentials before misuse occurred — the breach may not need to be notified.

Notification Requirements

Once an eligible data breach is confirmed, notification must happen "as soon as practicable." There is no fixed hour-based deadline like the GDPR's 72 hours, but regulators expect prompt action and will scrutinise delays.

What a Statement to the Commissioner Must Include

• The identity and contact details of your organisation
• A description of the breach
• The kinds of information involved
• Recommendations about steps individuals should take to protect themselves

Three Options for Notifying Individuals

Option	When to Use	Example
Notify all individuals	When all affected people can be identified	Email every customer whose record was accessed
Notify only those at risk of serious harm	When risk can be isolated to a subset	Only contact users whose passwords were exposed
Publish a public statement	When direct notification is impractical	Post notice on your website and promote it

Penalties for Non-Compliance

Penalties under the Privacy Act were significantly increased in late 2022 following high-profile incidents. For serious or repeated interferences with privacy, the maximum civil penalty is now the greater of:

• AU$50 million
• Three times the value of the benefit obtained from the misuse of information
• 30% of the entity's adjusted turnover during the breach period

These are among the toughest privacy penalties in the Asia-Pacific region. Beyond direct fines, non-compliance can also trigger regulatory investigations, enforceable undertakings, class actions, reputational damage, and loss of customer trust.

How to Prepare Your Organisation

Compliance isn't a one-off project. It requires embedded processes, trained staff, and tested response plans. Here are the practical steps every organisation should take.

1. Develop a Data Breach Response Plan

Your plan should clearly define roles, decision-making authority, escalation paths, communication templates, and timelines. It should map directly to the NDB scheme's assessment and notification requirements.

2. Maintain a Data Inventory

You can't protect what you can't see. Map where personal information is stored, who has access, and how it flows between systems and third parties. This is also essential for conducting rapid assessments during an incident.

3. Strengthen Technical Controls

• Enforce multi-factor authentication across all critical systems
• Encrypt personal information at rest and in transit
• Patch systems and applications promptly
• Use encrypted DNS and secure network architecture
• Implement least-privilege access and regular access reviews
• Monitor and log activity for anomaly detection

4. Train Your Staff

Human error accounts for a significant portion of notifiable breaches. Regular training on phishing, secure handling of records, and incident reporting dramatically reduces risk. Staff should also know how to escalate suspected breaches quickly.

5. Vet Third-Party Vendors

Many breaches now originate through suppliers. Ensure contracts include privacy obligations, breach notification requirements back to you, and audit rights. Review vendor security postures regularly.

6. Secure Your Public-Facing Links and Communications

Phishing campaigns frequently exploit lookalike or unmanaged links. Using a trusted link management platform like Lunyb lets you issue branded, trackable short URLs for customer communications, making it easier for recipients to recognise legitimate messages and for your team to monitor click activity for suspicious patterns. For a wider comparison of options, see our 2026 URL shortener buyer's guide.

NDB Scheme vs GDPR: Key Differences

Many Australian organisations also handle data of EU residents and must comply with both regimes. Here's how the two compare at a high level.

Aspect	Australian NDB Scheme	EU GDPR
Notification deadline to regulator	As soon as practicable	Within 72 hours
Threshold for notification	Likely to result in serious harm	Likely to result in risk to rights and freedoms
Assessment window	30 days	No formal window
Maximum penalty	AU$50M / 3x benefit / 30% turnover	€20M or 4% global turnover
Regulator	OAIC	National Data Protection Authorities
Covers small businesses	Generally no (under AU$3M)	Yes, regardless of size

Recent Trends and Enforcement

The OAIC publishes biannual Notifiable Data Breaches Reports, offering valuable insight into current threats. Consistent themes include:

• Health service providers remain the most frequently affected sector
• Finance, legal, and recruitment sectors see high reporting volumes
• Cyber incidents dominate, with compromised credentials and phishing most common
• Supply chain breaches increasingly cause multi-entity notifications
• Secondary notifications — where a vendor breach affects your customers — are growing

Enforcement activity has also sharpened. Following several landmark incidents in telecommunications, health insurance, and retail, the OAIC has pursued representative actions and investigations with greater intensity.

Common Mistakes to Avoid

1. Underestimating the 30-day assessment clock — delays without justification can themselves be a compliance failure
2. Over-relying on encryption as a reason not to notify — if keys were also compromised, the protection is void
3. Vague notifications that don't give individuals actionable guidance
4. Failing to notify the Commissioner while notifying individuals
5. Not documenting assessments — even where you conclude a breach isn't notifiable, keep records of your reasoning
6. Ignoring vendor incidents that affect your data holdings

Building a Culture of Privacy

Compliance with the NDB scheme is strongest when privacy is embedded into organisational culture rather than treated as a legal checkbox. This means privacy-by-design in new products, regular board-level reporting on privacy risk, and clear accountability for data stewardship.

Organisations that treat the NDB scheme as a baseline — rather than a ceiling — are better positioned to withstand incidents, retain customer trust, and adapt to the ongoing reforms to Australia's Privacy Act, which continue to raise the bar on consent, transparency, and individual rights.

Frequently Asked Questions

How quickly must I notify a data breach in Australia?

You must notify affected individuals and the Commissioner "as soon as practicable" after determining there is an eligible data breach. If you only suspect a breach, you have up to 30 days to assess whether it is notifiable. The OAIC expects prompt action and will consider unjustified delays unfavourably.

Does the NDB scheme apply to small businesses?

Most small businesses with annual turnover under AU$3 million are exempt from the Privacy Act and therefore the NDB scheme. However, exceptions apply to health service providers, credit reporting bodies, businesses trading in personal information, and TFN recipients, which must comply regardless of size.

What if the breach involves encrypted data?

Encryption can be a mitigating factor, but it isn't an automatic exemption. If encryption keys were also exposed, the encryption is effectively void. Even for strong encryption, you must document your assessment of why serious harm is unlikely and keep records of that analysis.

What are the penalties for failing to notify?

Serious or repeated interferences with privacy can attract civil penalties of up to AU$50 million, three times the benefit obtained, or 30% of adjusted turnover during the breach period — whichever is greatest. These significant penalties were introduced in 2022 to deter non-compliance.

Do I need to notify if a third-party vendor caused the breach?

Yes. If personal information you hold is compromised through a vendor, you remain responsible under the Privacy Act. You and the vendor may both have notification obligations. Clear contractual terms requiring prompt vendor notification to you are essential for meeting your own timelines.