Australian Data Breach Notification Scheme: Complete 2026 Guide

The Australian Data Breach Notification Scheme — formally known as the Notifiable Data Breaches (NDB) scheme — has reshaped how organisations across Australia handle personal information. Since it came into force on 22 February 2018, any entity covered by the Privacy Act 1988 must report eligible data breaches to the Office of the Australian Information Commissioner (OAIC) and to affected individuals. With penalties increased dramatically in late 2022 and further reforms rolling out through 2024 and 2025, understanding this scheme is no longer optional for Australian businesses.

This guide explains exactly who the scheme applies to, what counts as an eligible data breach, the step-by-step notification process, timelines, penalties, and practical steps your organisation can take to stay compliant and ready to respond.

What Is the Notifiable Data Breaches Scheme?

The Notifiable Data Breaches scheme is a legal framework under Part IIIC of the Privacy Act 1988 that requires covered organisations to notify both the OAIC and affected individuals when a data breach is likely to result in serious harm. The scheme is designed to give people the chance to protect themselves — for example, by changing passwords, contacting their bank, or watching for identity theft — and to improve transparency and accountability for how Australian businesses handle personal data.

The OAIC, led by the Australian Information Commissioner, administers the scheme and publishes a public statistical report every six months summarising the breaches reported, which sectors are most affected, and what caused them.

Who the Scheme Applies To

The NDB scheme covers any entity that already has obligations under the Australian Privacy Principles (APPs). This includes:

Australian Government agencies
Businesses and not-for-profits with an annual turnover above AUD $3 million
Private sector health service providers (regardless of size)
Credit reporting bodies and credit providers
Tax File Number (TFN) recipients
Small businesses that trade in personal information or are related to a larger APP entity

Reforms currently progressing through Parliament are expected to remove the $3 million small-business exemption in the coming years, bringing almost all Australian businesses within scope.

What Counts as an Eligible Data Breach?

An eligible data breach occurs when three conditions are met at the same time:

There is unauthorised access to, unauthorised disclosure of, or loss of personal information held by an entity.
This is likely to result in serious harm to one or more individuals.
The entity has not been able to prevent the likely risk of serious harm through remedial action.

Examples of Reportable Breaches

A ransomware attack that exfiltrates customer records
An employee emailing a spreadsheet of client details to the wrong recipient
A lost or stolen laptop containing unencrypted personal information
Misconfigured cloud storage exposing files publicly
Credential stuffing attacks resulting in account takeovers

What "Serious Harm" Means

Serious harm is not defined exhaustively in the Act, but the OAIC guidance says it can include physical, psychological, emotional, financial, or reputational harm. Factors to weigh include the kind of information involved (health data, financial data, and government identifiers are high-risk), whether the data was encrypted, who obtained it, and how likely it could be misused.

Notification Timelines and Process

The clock on the NDB scheme starts the moment an organisation becomes aware that there are reasonable grounds to suspect an eligible data breach may have occurred.

The 30-Day Assessment Window

If an entity only suspects a breach, it has 30 calendar days to carry out a reasonable and expeditious assessment to determine whether the incident qualifies as an eligible data breach. The OAIC expects assessments to be completed as quickly as possible — 30 days is a maximum, not a target.

Notifying the OAIC and Individuals

Once an entity has reasonable grounds to believe an eligible data breach has occurred, it must notify the OAIC and affected individuals as soon as practicable. There is no fixed hour-based deadline like the EU's 72-hour GDPR rule, but "as soon as practicable" is interpreted strictly.

The notification must include:

The identity and contact details of the organisation
A description of the data breach
The kinds of information involved
Recommendations about the steps individuals should take in response

Methods of Notifying Individuals

Organisations can choose one of three approaches:

Option 1: Notify all individuals whose data was involved in the breach
Option 2: Notify only those at likely risk of serious harm
Option 3: If neither of the above is practicable, publish the statement on the organisation's website and take reasonable steps to publicise it

Penalties for Non-Compliance

Penalties under the Privacy Act were significantly increased in December 2022 following a wave of high-profile Australian breaches. Serious or repeated interferences with privacy can now attract the greater of:

Entity Type	Maximum Penalty
Individuals	AUD $2.5 million
Body corporate (fixed)	AUD $50 million
Body corporate (benefit-based)	3× the value of any benefit obtained from the misuse of information
Body corporate (turnover-based)	30% of adjusted turnover during the relevant period

The OAIC also has strengthened powers to conduct assessments, issue infringement notices for less serious breaches, and seek enforceable undertakings.

Comparing the NDB Scheme to GDPR

Many Australian organisations also deal with European customers and need to understand how the schemes differ.

Feature	Australian NDB Scheme	EU GDPR
Regulator	OAIC	Supervisory authority in each member state
Trigger	Likely serious harm	Risk to rights and freedoms
Deadline to notify regulator	As soon as practicable (up to 30 days to assess)	Within 72 hours of awareness
Individual notification	Required if serious harm likely	Required if high risk
Maximum penalty	Up to AUD $50 million or 30% turnover	€20 million or 4% global turnover

Step-by-Step: How to Respond to a Suspected Breach

A clear incident response playbook will save precious hours when a breach actually happens. Here is a practical framework aligned with OAIC guidance.

Contain the breach. Isolate affected systems, revoke compromised credentials, and stop further unauthorised access.
Assemble the response team. This typically includes IT security, legal, privacy, communications, and an executive sponsor.
Preserve evidence. Keep logs, system snapshots, and documentation that may be needed for forensic analysis or regulator queries.
Assess the breach. Within the 30-day window, determine what data was involved, how many people are affected, and whether serious harm is likely.
Remediate where possible. If you can prevent serious harm (e.g., through remote wipe of a lost device before access occurred), the breach may not be "notifiable".
Notify the OAIC. Use the OAIC's online Notifiable Data Breach form, which is the official reporting channel.
Notify affected individuals. Provide clear, plain-English information and practical next steps.
Review and improve. Conduct a post-incident review and update policies, training, and controls.

Common Causes of Notifiable Breaches in Australia

Each OAIC statistical report shows consistent patterns in what causes breaches. Malicious or criminal attack remains the leading category, followed by human error and system faults.

Top Attack Vectors

Phishing — compromised credentials remain the single biggest source of cyber incidents
Ransomware — often combined with data exfiltration ("double extortion")
Brute-force and credential stuffing — exploiting reused passwords
Supply-chain compromise — breaches of third-party service providers

Top Human-Error Causes

Personal information sent to the wrong recipient by email
Unintended release or publication of data
Loss of paperwork or portable storage
Failure to redact information in documents

Practical Steps to Reduce Breach Risk

Compliance with the NDB scheme is ultimately a byproduct of good information security. The following controls dramatically reduce both the likelihood and impact of breaches.

Technical Controls

Enforce multi-factor authentication (MFA) for all staff and admin accounts
Encrypt personal information at rest and in transit
Patch operating systems and applications promptly
Segment networks so a single compromise cannot reach all data
Use encrypted DNS and reputable email filtering to block phishing
Monitor logs with a SIEM or managed detection and response service
Back up data offline and test restoration regularly

Governance Controls

Maintain an up-to-date data inventory and data flow map
Classify information by sensitivity
Minimise the data you collect and retain
Conduct Privacy Impact Assessments for new projects
Train every employee on privacy and phishing awareness at least annually
Vet third-party suppliers and bake privacy clauses into contracts

Protecting Links and Shared Content

Even small operational tools can leak information if they are not chosen carefully. Marketing teams, for example, often share links to internal documents, campaigns, or customer portals. Using a privacy-conscious link management platform such as Lunyb helps avoid unnecessary tracking and metadata exposure compared with some legacy shorteners. For a deeper look at how it stacks up, see our honest review of Lunyb and our Rebrandly comparison.

What's Changing: Privacy Act Reforms

The Australian Government has committed to a staged modernisation of the Privacy Act, with the first tranche of reforms passed in late 2024. Changes most relevant to the NDB scheme include:

A new statutory tort for serious invasions of privacy
Enhanced OAIC enforcement powers, including civil penalty tiers for mid-range breaches
Greater transparency requirements for automated decision-making
Children's Online Privacy Code development
Future removal of the small-business exemption

Organisations should expect further obligations around breach reporting detail, response timelines, and record-keeping as subsequent tranches are passed.

Building a Breach-Ready Culture

Legal compliance is only half the story. Companies that respond well to breaches — Australian examples include those that notified quickly, communicated clearly, and offered free credit monitoring — tend to retain customer trust. Those that delay, downplay, or obscure incidents face regulatory action, class actions, and lasting reputational damage.

Build the muscle now: run tabletop exercises, test your notification templates, confirm your OAIC reporting account is set up, and make sure your board understands the scheme. When (not if) something happens, you will be ready.

Frequently Asked Questions

Do small businesses need to comply with the Notifiable Data Breaches scheme?

Most businesses with annual turnover under AUD $3 million are currently exempt, but there are important exceptions: health service providers, credit providers, TFN recipients, and any small business that trades in personal information must comply regardless of size. Upcoming Privacy Act reforms are expected to remove the small-business exemption entirely, so it is wise to prepare now.

How quickly must I notify the OAIC after a data breach?

You must notify "as soon as practicable" once you have reasonable grounds to believe an eligible data breach has occurred. If you only suspect a breach, you have up to 30 calendar days to assess whether it qualifies. The OAIC expects assessments to be completed much faster than 30 days whenever possible.

What happens if I fail to report a notifiable breach?

Failing to comply with the NDB scheme is treated as an interference with privacy under the Privacy Act. Penalties can reach AUD $50 million, three times the benefit obtained, or 30% of adjusted turnover for serious or repeated contraventions. The OAIC can also issue infringement notices, accept enforceable undertakings, or seek injunctions.

Do I need to notify if the stolen data was encrypted?

Strong encryption can be a form of remedial action that prevents the likely risk of serious harm, in which case the breach may not be "notifiable". However, you must be confident the encryption is robust, the keys were not compromised, and the data cannot be accessed. Document your reasoning carefully — the OAIC may still ask questions.

Does the NDB scheme apply to breaches by overseas service providers?

Yes. If you are an APP entity and you disclose personal information to an overseas recipient, you generally remain accountable for how that information is handled. A breach by your overseas processor that affects Australian individuals can still be notifiable, and you should ensure your contracts require prompt notification to you.