Australian Data Breach Notification Scheme: Complete 2026 Guide

The Australian Data Breach Notification Scheme — more commonly called the Notifiable Data Breaches (NDB) scheme — is one of the most important privacy obligations facing Australian organisations today. Since its introduction in February 2018 under Part IIIC of the Privacy Act 1988, the scheme has reshaped how businesses, government agencies, and not-for-profits respond to data incidents. With penalties recently increased and the Office of the Australian Information Commissioner (OAIC) taking a more assertive enforcement stance, understanding your obligations has never been more critical.

This guide explains what the scheme is, who it applies to, what counts as an eligible data breach, how to notify affected individuals and the OAIC, and what practical steps your organisation should take to stay compliant in 2026.

What Is the Australian Data Breach Notification Scheme?

The Notifiable Data Breaches scheme is a legal framework that requires regulated entities to notify affected individuals and the Australian Information Commissioner when a data breach is likely to result in serious harm. It was introduced by the Privacy Amendment (Notifiable Data Breaches) Act 2017 and became operational on 22 February 2018.

The scheme sits within the broader Privacy Act and works alongside the 13 Australian Privacy Principles (APPs). Its core purpose is simple: give individuals timely information about breaches that affect their personal data so they can take protective action — for example, changing passwords, cancelling cards, or watching for identity fraud.

Key Objectives of the Scheme

• Promote transparency and accountability in data handling.
• Empower individuals to mitigate harm after a breach.
• Encourage organisations to invest in stronger security and incident response.
• Provide the OAIC with oversight data to inform regulation.

Who Must Comply With the NDB Scheme?

The scheme applies to all entities that are already subject to the Privacy Act. This covers a wide range of organisations across both the public and private sectors.

Entities Covered

• Australian Government agencies (with limited exceptions).
• Private sector organisations with an annual turnover above AUD $3 million.
• Small businesses that trade in personal information, provide health services, are contracted service providers for the Commonwealth, or are related to an APP entity.
• Health service providers of any size.
• Credit reporting bodies and credit providers.
• Tax File Number (TFN) recipients.

Importantly, the proposed reforms flowing from the Privacy Act Review are expected to narrow the small business exemption significantly, meaning many more organisations will fall under the scheme in coming years.

What Is an "Eligible Data Breach"?

An eligible data breach — the type that triggers mandatory notification — occurs when three conditions are met.

1. There is unauthorised access to, unauthorised disclosure of, or loss of personal information held by an entity.
2. The breach is likely to result in serious harm to one or more individuals.
3. The entity has not been able to prevent the likely risk of serious harm through remedial action.

Examples of Data Breaches

• A laptop containing unencrypted customer records is stolen.
• A ransomware attack exfiltrates employee files.
• An email containing a client list is sent to the wrong recipient.
• A misconfigured cloud bucket exposes customer data to the public internet.
• Login credentials are phished and used to access an internal CRM.

What Counts as "Serious Harm"?

Serious harm is not defined narrowly in the Act. It can include physical, psychological, emotional, financial, or reputational harm. The OAIC recommends applying an objective "reasonable person" test, considering factors such as:

• The kind and sensitivity of the information involved.
• Whether the information was protected by security measures such as encryption.
• The persons or kinds of persons who obtained the information.
• The nature of the likely harm.

Notification Obligations and Timelines

Once an entity becomes aware of a suspected eligible data breach, the clock starts ticking. The NDB scheme imposes strict assessment and notification timelines.

The 30-Day Assessment Rule

If an entity suspects that there may have been an eligible data breach but is not certain, it must carry out a reasonable and expeditious assessment within 30 calendar days. The assessment should determine whether the incident meets the "eligible data breach" threshold.

Notifying the OAIC

If the entity confirms an eligible data breach has occurred, it must prepare a statement and provide it to the Commissioner as soon as practicable. The statement must include:

• The identity and contact details of the entity.
• A description of the breach.
• The kinds of information involved.
• Recommended steps individuals should take in response.

Notifying Affected Individuals

Entities must also notify the individuals whose information was involved. There are three options:

1. Notify all individuals whose information was part of the breach.
2. Notify only those at likely risk of serious harm.
3. If neither option is practicable, publish the statement on the entity's website and take reasonable steps to publicise it.

NDB Scheme at a Glance: Timelines and Requirements

Requirement	Timeframe	Action
Suspected breach assessment	Within 30 days	Investigate and determine if criteria are met
Notify the OAIC	As soon as practicable	Submit statement via OAIC online form
Notify affected individuals	As soon as practicable	Email, letter, phone, or public notice
Record keeping	Ongoing	Document decisions, even where no notification is required

Penalties for Non-Compliance

In late 2022, the Australian Government passed the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022, which significantly increased the maximum penalties for serious or repeated interference with privacy.

Current Maximum Penalties

For corporations, the maximum penalty is the greater of:

• AUD $50 million; or
• Three times the value of any benefit obtained from the misuse of information; or
• 30% of adjusted turnover during the relevant period.

For individuals, the maximum penalty is AUD $2.5 million. These figures place Australia among the toughest privacy jurisdictions globally and align more closely with the EU's GDPR regime.

Exceptions to the Notification Requirement

Not every incident triggers the full notification process. The NDB scheme provides several specific exceptions.

Key Exceptions

• Remedial action: If the entity takes action quickly enough to prevent the likely risk of serious harm.
• Multiple entities: Where multiple entities are involved, only one may need to notify (though all should coordinate).
• Enforcement bodies: Notification may be delayed if it would prejudice enforcement activities.
• Secrecy provisions: Where another law prohibits disclosure.
• Declaration by the Commissioner: The OAIC may declare that notification is not required in certain circumstances.

Building a Compliant Incident Response Plan

Compliance with the NDB scheme is not just about reacting — it requires planning. A robust data breach response plan is essential.

Core Components of a Response Plan

1. Identify: Establish mechanisms to detect breaches quickly (SIEM tools, staff reporting, monitoring).
2. Contain: Limit the breach impact by isolating affected systems, revoking credentials, or stopping data flows.
3. Assess: Evaluate the scope, the type of data involved, and likelihood of serious harm.
4. Notify: Comply with OAIC and individual notification obligations.
5. Review: Document the incident, identify root causes, and update controls to prevent recurrence.

Practical Security Measures to Reduce Breach Risk

• Encrypt personal information at rest and in transit.
• Implement multi-factor authentication across all staff accounts.
• Apply the principle of least privilege to data access.
• Maintain a current data inventory and classification scheme.
• Conduct regular phishing simulations and staff privacy training.
• Use secure link-sharing tools when distributing URLs that could carry tracking or identifiable parameters. For example, services like Lunyb allow organisations to shorten and manage links in a privacy-conscious way, reducing accidental exposure in marketing or internal communications.
• Patch systems and perform annual penetration testing.

Common Data Breach Trends in Australia

According to the OAIC's biannual Notifiable Data Breaches Reports, certain patterns continue to dominate the Australian breach landscape.

Leading Causes of Breaches

Cause	Typical Share of Reports	Example
Malicious or criminal attack	~65-70%	Phishing, ransomware, credential stuffing
Human error	~25-30%	Emails sent to wrong recipient, lost devices
System fault	~3-5%	Misconfigured database, software bug

The health, finance, and government sectors consistently report the highest number of breaches — unsurprisingly, as they hold large volumes of sensitive personal information.

How the NDB Scheme Interacts With Other Laws

Compliance with the NDB scheme does not relieve an organisation of obligations under other laws. Entities should be aware of overlaps and additional requirements.

Related Obligations

• SOCI Act (Security of Critical Infrastructure): Mandatory cyber incident reporting to the Australian Signals Directorate for critical infrastructure entities.
• APRA CPS 234: Information security standards for banks, insurers, and super funds.
• My Health Records Act: Separate notification obligations for health data breaches.
• GDPR: If your Australian business handles EU resident data, you may have GDPR notification duties (within 72 hours).
• State-based public sector privacy laws: NSW, Victoria, Queensland, and the ACT have their own schemes for state agencies.

Preparing for the 2026 Privacy Act Reforms

Australia's privacy regime is undergoing its biggest overhaul in decades. The Privacy and Other Legislation Amendment Act 2024 began rolling out reforms, with further tranches expected through 2026.

Key Changes to Watch

• Likely removal or narrowing of the small business exemption.
• Introduction of a statutory tort for serious invasions of privacy.
• New requirements around automated decision-making transparency.
• Potential shortening of the 30-day assessment period.
• Expanded enforcement powers for the OAIC, including infringement notices.

Organisations that build strong privacy foundations now will be well-placed to adapt. For related reading, see our 2026 buyer's guide to secure link management and our honest review of Lunyb for safer link sharing.

Frequently Asked Questions

How quickly must I notify the OAIC after a data breach?

You must notify the Commissioner "as soon as practicable" after you are satisfied an eligible data breach has occurred. If you only suspect a breach, you have up to 30 days to complete an assessment. Many organisations submit notifications within days of confirmation to demonstrate good faith.

What happens if I fail to report an eligible data breach?

Failing to notify can be treated as a serious or repeated interference with privacy. The OAIC can seek civil penalties through the Federal Court of up to AUD $50 million for corporations, or 30% of adjusted turnover during the relevant period. The regulator can also issue determinations requiring remediation and compensation.

Does the NDB scheme apply to small businesses?

Generally, small businesses with annual turnover under AUD $3 million are exempt from the Privacy Act — and therefore the NDB scheme. However, exceptions apply to health service providers, businesses that trade in personal information, Commonwealth contractors, and related entities. Proposed reforms are expected to significantly reduce this exemption.

Do I need to notify if the data was encrypted?

Strong encryption can reduce the likelihood of serious harm, which may mean the breach is not "eligible" and notification is not required. However, you must still assess the circumstances, including key management and whether decryption is feasible for the attacker. Document your reasoning either way.

Can one incident trigger notifications under multiple laws?

Yes. A single cyber incident could trigger NDB notification, SOCI Act reporting, APRA CPS 234 notification, GDPR obligations, and contractual duties to clients — all with different timelines. A well-designed incident response plan maps each pathway so no obligation is missed.

Final Thoughts

The Australian Data Breach Notification Scheme is more than a compliance checkbox — it is a trust mechanism between organisations and the individuals whose data they hold. With penalties now in the tens of millions and reforms tightening the regime further, Australian entities need to treat privacy as a board-level priority. Strong technical controls, documented response plans, and a culture of transparency are the best protection against both breaches and regulatory consequences.

For practical tooling to reduce the risk of accidental data exposure in marketing, support, and internal communications, consider adopting privacy-aware link management from providers like Lunyb, and review your incident response plan at least annually.