Australian Data Breach Notification Scheme: Complete 2026 Guide

The Notifiable Data Breaches (NDB) scheme is one of the most consequential pieces of privacy regulation in Australia. Introduced in February 2018 under the Privacy Amendment (Notifiable Data Breaches) Act 2017, it requires organisations covered by the Privacy Act 1988 to notify both affected individuals and the Office of the Australian Information Commissioner (OAIC) when an eligible data breach occurs. With penalties now reaching into the tens of millions of dollars and high-profile incidents at Optus, Medibank, and Latitude Financial reshaping public expectations, understanding your obligations has never been more important.

This guide breaks down everything Australian businesses, charities, and government agencies need to know about the scheme in 2026 — from who it covers, to what counts as an "eligible" breach, to how to actually file a notification with the OAIC when the clock is ticking.

What Is the Australian Data Breach Notification Scheme?

The Australian data breach notification scheme — formally called the Notifiable Data Breaches (NDB) scheme — is a mandatory legal framework requiring regulated entities to notify the OAIC and affected individuals when personal information is involved in a breach likely to cause serious harm. It sits within Part IIIC of the Privacy Act 1988 (Cth) and is overseen by the Australian Information Commissioner.

The scheme has three core objectives: protect individuals by giving them timely information to mitigate harm, strengthen community confidence that personal data is handled responsibly, and encourage entities to improve their security practices through transparent accountability.

Key Legislation and Regulators

Privacy Act 1988 (Cth) — the overarching privacy framework.
Privacy Amendment (Notifiable Data Breaches) Act 2017 — introduced the NDB scheme.
Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 — dramatically increased penalties.
Office of the Australian Information Commissioner (OAIC) — the primary enforcement body.

Who Must Comply With the NDB Scheme?

The scheme applies to any entity already covered by the Australian Privacy Principles (APPs). This is a broader group than many business owners realise, and ignorance of coverage is not a defence.

Entities Covered

Australian Government agencies (with limited exceptions).
Businesses and not-for-profits with an annual turnover of more than AUD $3 million.
Private sector health service providers, regardless of turnover.
Credit reporting bodies, credit providers, and entities handling tax file numbers.
Businesses that trade in personal information (buying or selling data).
Contractors providing services under Commonwealth contracts.
Small businesses that have opted in to the Privacy Act.

Note that proposed Privacy Act reforms under consideration in 2025–2026 may remove the small business exemption entirely, bringing hundreds of thousands of additional organisations under the scheme. Entities below the current threshold should still monitor developments and consider voluntary compliance as a reputational safeguard.

What Is an "Eligible Data Breach"?

Not every security incident triggers notification obligations. The NDB scheme applies only to eligible data breaches, which the law defines through a three-part test.

The Three-Part Test

Unauthorised access, unauthorised disclosure, or loss of personal information held by the entity.
The breach is likely to result in serious harm to one or more individuals whose information is involved.
The entity has not been able to prevent the likely risk of serious harm through remedial action.

What Counts as "Serious Harm"?

Serious harm can be physical, psychological, emotional, financial, or reputational. The OAIC assesses likelihood by considering the kind and sensitivity of information, the security protecting it (such as encryption), the nature of the recipients, and the type of harm that could result.

Examples of information that frequently triggers notification include Medicare numbers, driver licence details, passport numbers, financial account credentials, health records, and combinations of identifiers that enable identity theft.

Notification Timelines: The 30-Day and 72-Hour Rules

Timelines are where many organisations stumble. The scheme operates on two distinct clocks that are often confused.

The 30-Day Assessment Window

If an entity suspects an eligible data breach may have occurred but is not certain, it has 30 calendar days from the day of becoming aware to conduct a reasonable and expeditious assessment. The assessment must determine whether the three-part test is met.

The "As Soon as Practicable" Rule

Once an entity is aware that there are reasonable grounds to believe an eligible data breach has occurred, it must notify the OAIC and affected individuals as soon as practicable. There is no fixed hour count in the legislation, but in practice the OAIC expects notification within days, not weeks.

Comparison With International Frameworks

Framework	Jurisdiction	Notification Deadline	Max Penalty
NDB Scheme	Australia	As soon as practicable (post 30-day assessment)	AUD $50M / 30% turnover
GDPR	EU / UK	72 hours to regulator	€20M / 4% global turnover
PIPEDA	Canada	As soon as feasible	CAD $100,000 per violation
CCPA / CPRA	California, USA	Without unreasonable delay	USD $7,500 per intentional violation

How to Notify the OAIC: Step-by-Step

The notification process is formalised through an online statement submitted to the Commissioner. Getting the content right matters — incomplete submissions can trigger follow-up investigations.

Required Content of the Statement

The identity and contact details of the entity.
A description of the eligible data breach.
The kinds of information concerned (e.g., names, TFNs, health data).
Recommendations on steps individuals should take in response.

Notifying Affected Individuals

Entities must take reasonable steps to notify each affected person, either directly (email, SMS, phone, mail) or, if direct notification is impracticable, by publishing the statement prominently on their website and promoting it publicly for a reasonable period.

When Communicating Breach Information Externally

Many organisations create a dedicated incident page with FAQs, support contacts, and guidance for affected customers. When sharing this URL across SMS, social media, printed letters, or support call scripts, a clean branded short link is far more trustworthy than a raw long URL. Tools like Lunyb allow you to create short, trackable links that keep communications professional while giving your incident response team visibility into click-through engagement — useful evidence when demonstrating that you took reasonable notification steps.

Penalties and Enforcement in 2026

The penalty regime was transformed by the 2022 enforcement amendments, which were a direct policy response to the Optus and Medibank breaches.

Maximum Penalties for Serious or Repeated Interference

For bodies corporate, the maximum penalty is the greatest of:

AUD $50 million; or
Three times the value of any benefit obtained through the misuse of information; or
30% of the entity's adjusted turnover in the relevant period.

For individuals, the maximum civil penalty is AUD $2.5 million. The OAIC also has strengthened information-gathering powers, can conduct assessments of entities' practices, and can accept enforceable undertakings or seek Federal Court orders.

Common Causes of Eligible Data Breaches

The OAIC's biannual Notifiable Data Breaches Reports consistently identify the same recurring causes. Understanding them helps prioritise prevention investment.

Top Causes (OAIC Reporting Trends)

Malicious or criminal attacks (around 65–70% of notifications) — phishing, compromised credentials, ransomware, and brute-force attacks.
Human error (around 25–30%) — emails sent to the wrong recipient, misconfigured cloud storage, lost devices, unredacted documents.
System faults (around 3–5%) — software bugs exposing data unintentionally.

The health, finance, insurance, retail, and education sectors consistently report the highest number of breaches.

Building a Data Breach Response Plan

Having a documented, tested data breach response plan is not just best practice — the OAIC explicitly expects it as part of reasonable security measures under APP 11. A good plan reduces assessment time, improves decision quality under pressure, and demonstrates due diligence if the regulator investigates.

Essential Plan Components

Response team roster with named roles: incident lead, legal counsel, communications, IT security, privacy officer, executive sponsor.
Containment procedures for isolating affected systems and preserving forensic evidence.
Assessment framework aligned to the three-part eligibility test with documentation templates.
Notification templates for the OAIC statement, affected individuals, media, and regulators in other jurisdictions.
Escalation triggers for involving external legal, forensic, and PR support.
Post-incident review procedures to identify root causes and remediation actions.

Testing and Training

Tabletop exercises at least annually are considered the baseline standard. Simulate a credential-stuffing attack, a lost laptop, and a cloud misconfiguration scenario — the three archetypes behind most Australian notifications.

Preventive Security Measures That Reduce Breach Risk

While no control eliminates risk entirely, a layered approach materially reduces both the likelihood of a breach and the severity of harm if one occurs — which can mean the difference between a notifiable and a non-notifiable incident.

Technical Controls

Encryption at rest and in transit — strong encryption can be a decisive factor in whether a breach is "likely to result in serious harm".
Multi-factor authentication on all administrative and remote access accounts.
Encrypted DNS and secure network segmentation to limit lateral movement.
Data minimisation — don't collect or retain what you don't need. The ACMA and OAIC have both signalled sharper focus on over-retention.
Regular patching and vulnerability scanning.
Robust logging to support rapid forensic assessment within the 30-day window.

Organisational Controls

Appointed Privacy Officer with clear reporting lines to the board.
Mandatory privacy and security training with phishing simulations.
Vendor due diligence and contractual data protection clauses.
Clear data classification scheme so staff know what is sensitive.

Interaction With Other Notification Obligations

The NDB scheme is not the only reporting obligation Australian organisations may face. Depending on sector and incident type, parallel notifications may be required to:

The Australian Signals Directorate (ASD) / ACSC for cyber incidents affecting critical infrastructure assets under the SOCI Act.
APRA for regulated financial entities under CPS 234.
The Australian Securities Exchange for listed entities with continuous disclosure obligations.
State and territory privacy regulators where state information is involved.
Overseas regulators (e.g., GDPR authorities) if EU/UK data subjects are affected.

Coordinating these simultaneously is complex and is a key reason legal counsel should be engaged early in any suspected breach.

FAQ: Australian Data Breach Notification Scheme

Does the NDB scheme apply to small businesses?

Generally no — businesses with annual turnover under AUD $3 million are exempt unless they fall into specific categories (health providers, credit reporting, TFN handlers, Commonwealth contractors, or data traders). However, proposed Privacy Act reforms would remove this exemption, and voluntary compliance is increasingly expected by larger business partners.

What happens if we fail to notify an eligible data breach?

Failure to comply is treated as an interference with privacy. The OAIC can investigate, issue determinations, accept enforceable undertakings, or seek civil penalties through the Federal Court. For serious or repeated non-compliance, penalties can reach AUD $50 million or 30% of adjusted turnover for corporations.

Do we need to notify if the data was encrypted?

Not automatically. Strong encryption is a key factor in assessing whether serious harm is likely. If stolen data is encrypted with keys that remain secure, the risk of serious harm may be sufficiently low that the breach is not "eligible". However, you must still document the assessment, and if any doubt exists about key compromise, notification should proceed.

Can we notify the OAIC before we complete our assessment?

Yes. Entities are encouraged to engage with the OAIC early, especially for large or complex breaches. You can submit a preliminary notification and provide additional details as the investigation progresses. Early engagement is viewed favourably in any subsequent regulatory assessment.

How does the scheme interact with the My Health Records Act?

Breaches involving the My Health Record system have their own, stricter notification regime under the My Health Records Act 2012, which requires notification to both the OAIC and the System Operator (the Australian Digital Health Agency). The NDB scheme operates alongside, not instead of, that framework.

Final Thoughts

The Australian data breach notification scheme has evolved from a compliance checkbox into a central pillar of corporate risk management. With penalties now large enough to materially affect balance sheets, boards and executives are rightly treating breach preparedness as a strategic priority. The organisations that fare best when incidents occur are those that invested in prevention, documented their decisions, communicated transparently, and treated affected individuals with genuine care.

Preparation is not optional. Build the plan, test it, invest in the controls, and when the day comes, act quickly and honestly. The scheme rewards organisations that take their obligations seriously — and punishes those that don't.