Australian Data Breach Notification Scheme: Complete 2026 Guide

Since February 2018, Australian organisations have operated under one of the most consequential privacy obligations in the country's history: the Notifiable Data Breaches (NDB) scheme. If your business handles personal information and something goes wrong, you may have a legal duty to tell both the affected individuals and the Office of the Australian Information Commissioner (OAIC) — fast. This guide explains exactly how the scheme works in 2026, who it covers, what counts as an eligible data breach, and the step-by-step process your organisation should follow.

What Is the Australian Data Breach Notification Scheme?

The Australian Data Breach Notification Scheme — formally known as the Notifiable Data Breaches (NDB) scheme — is a mandatory reporting framework established under Part IIIC of the Privacy Act 1988 (Cth). It requires covered organisations to notify affected individuals and the OAIC whenever an "eligible data breach" occurs that is likely to result in serious harm.

The scheme took effect on 22 February 2018 and has been progressively strengthened since. Following the Optus and Medibank breaches of 2022, maximum civil penalties for serious or repeated interferences with privacy were raised dramatically — now reaching up to AUD $50 million, three times the benefit obtained from the misuse of information, or 30% of adjusted turnover during the breach period, whichever is greater.

Who Must Comply With the NDB Scheme?

The NDB scheme applies to all entities already covered by the Australian Privacy Principles (APPs) under the Privacy Act. These are known collectively as "APP entities".

Entities Covered

Australian Government agencies (federal departments, most statutory authorities).
Private sector organisations with an annual turnover of more than AUD $3 million.
All health service providers, regardless of turnover (including GPs, pharmacies, allied health, gyms offering weight-loss services).
Credit reporting bodies and credit providers.
Tax File Number (TFN) recipients.
Entities that trade in personal information (e.g. list brokers).
Businesses opting in to the Privacy Act.

Small Business Exemption — Narrowing Fast

Historically, businesses under AUD $3 million turnover were exempt. The Attorney-General's Privacy Act Review has recommended removing this exemption entirely, and reforms rolling out through 2024–2026 are progressively closing it. If you're a small business, don't assume you're outside the scheme — check current OAIC guidance before relying on the exemption.

What Is an "Eligible Data Breach"?

An eligible data breach occurs when three conditions are met simultaneously:

There is unauthorised access to, unauthorised disclosure of, or loss of personal information held by the entity.
The access, disclosure, or loss is likely to result in serious harm to one or more individuals.
The entity has not been able to prevent the likely risk of serious harm through remedial action.

What Counts as "Serious Harm"?

Serious harm isn't defined exhaustively in the Act, but the OAIC interprets it broadly to include:

Physical harm — stalking, family violence risk from leaked addresses.
Psychological harm — distress, anxiety, humiliation (e.g. leaked health records).
Financial harm — identity theft, fraud, unauthorised transactions.
Reputational harm — damage to standing, embarrassment.
Other harms — loss of employment, social exclusion, discrimination.

Common Examples of Eligible Breaches

Ransomware attack exfiltrating customer databases.
Lost unencrypted laptop containing patient records.
Employee emailing a spreadsheet of clients to the wrong recipient.
Misconfigured cloud storage bucket exposing personal data to the public internet.
Insider deliberately accessing records they're not authorised to view.

Notification Timelines: The 30-Day Rule

Once you suspect an eligible data breach may have occurred, the clock starts.

Stage	Maximum Timeframe	Action Required
Suspicion of breach	Day 0	Begin internal triage.
Assessment	Within 30 days	Determine whether it is an eligible data breach.
Notification	As soon as practicable after assessment	Notify OAIC and affected individuals.
Known eligible breach	Immediately	Skip assessment — notify straight away.

The 30-day assessment period is a maximum, not a target. If the breach is clearly serious, you must notify without waiting out the window.

What Must the Notification Contain?

A compliant statement to the OAIC and affected individuals must include:

The identity and contact details of the organisation.
A description of the data breach.
The kinds of information involved (e.g. names, Medicare numbers, passport details, passwords).
Recommended steps individuals should take in response (e.g. reset passwords, monitor accounts, replace ID documents, contact IDCARE).

The OAIC provides an online Notifiable Data Breach form on its website — this is the standard channel. For multi-party breaches (e.g. a breach at a cloud provider affecting multiple clients), only one entity needs to notify, but responsibility must be clearly allocated.

Step-by-Step: Responding to a Suspected Breach

Step 1 — Contain

Immediately stop the breach from worsening. Revoke compromised credentials, isolate affected systems, retrieve misdirected emails using recall functions, and lock down access.

Step 2 — Assess

Form an incident response team. Determine:

What personal information was involved?
How many people are affected?
Who had unauthorised access?
Is the information encrypted or otherwise unreadable?
What harms could reasonably result?

Step 3 — Notify (if required)

If the breach meets the eligible threshold, prepare and submit the OAIC form, and notify affected individuals directly where practicable. If direct notification isn't practicable, publish the statement on your website and promote it.

Step 4 — Review

Conduct a post-incident review. Update your Data Breach Response Plan, close security gaps, retrain staff, and document lessons learned. The OAIC expects organisations to demonstrate continuous improvement.

Exceptions to Notification

You may not need to notify if:

Remedial action prevents serious harm — e.g. a lost laptop had full-disk encryption and the key wasn't compromised.
Enforcement body exception — notification would prejudice certain law enforcement activities.
Inconsistency with secrecy provisions — other Commonwealth laws override.
Multi-party breach — another entity has already notified.

These exceptions are narrow. Document your reasoning carefully if you rely on them — the OAIC can and does request justification.

Penalties for Non-Compliance

Failing to notify, or mishandling personal information generally, can trigger serious consequences following the 2022 reforms:

Breach Type	Maximum Penalty (Body Corporate)
Serious or repeated interference with privacy	Greater of: AUD $50M, 3× benefit obtained, or 30% of adjusted turnover
Individual (serious/repeated)	AUD $2.5 million
Administrative/infringement notices	Up to AUD $66,000 per contravention (indexed)

Beyond fines, reputational damage, class action exposure (Australian courts have increasingly entertained data breach class actions), customer churn, and regulator scrutiny can dwarf the direct penalty.

Reducing Breach Risk: Practical Measures

Prevention beats notification every time. Core controls that align with APP 11 (security of personal information) include:

Data minimisation — only collect what you need, delete what you don't.
Encryption — at rest and in transit, with proper key management.
Multi-factor authentication on all administrative and remote-access accounts.
Network segmentation so a single compromise doesn't expose the whole environment.
Staff training — phishing remains the leading initial access vector reported to the OAIC.
Vendor due diligence — your supply chain is your attack surface.
Privacy-respecting third-party tools — e.g. when sharing campaign or marketing links, choose services that don't profile or resell data. Privacy-first link platforms like Lunyb let teams shorten and track URLs without exposing customer click data to advertising networks (see our honest review of Lunyb).
Tested incident response plan — tabletop exercises at least annually.

The OAIC Statistics: What Trends Reveal

The OAIC publishes bi-annual Notifiable Data Breaches Reports. Recent editions consistently highlight:

Malicious or criminal attacks account for roughly two-thirds of notified breaches.
Human error (misaddressed emails, unintended disclosure) remains around one-quarter of incidents.
Health service providers, finance, and government consistently top the sector list.
Contact information, identity details, and financial data are the most-exposed categories.
Many breaches involve fewer than 100 individuals, but major incidents affecting millions dominate headlines.

Building a Data Breach Response Plan

Every APP entity should have a written Data Breach Response Plan. At minimum it should include:

Clear definitions of what constitutes a suspected breach.
Named response team with roles — legal, IT, communications, executive sponsor.
Escalation pathway with contact details available 24/7.
Assessment framework mapped to the eligible data breach criteria.
Template notifications for OAIC and individuals, pre-approved by legal.
External contacts — forensic providers, cyber insurer, PR agency, IDCARE.
Record-keeping protocols — the OAIC may ask to see your assessment file.

Looking Ahead: The Privacy Act Reform Agenda

Australia is in the middle of the most significant privacy reform since 1988. Tranche 1 of the reforms passed in late 2024, introducing a statutory tort for serious invasions of privacy, a children's online privacy code, and enhanced OAIC enforcement powers. Further tranches are expected to:

Remove or further narrow the small business exemption.
Introduce a "fair and reasonable" test for data handling.
Strengthen individual rights (erasure, objection, portability).
Tighten breach notification timeframes (potentially aligning with the EU's 72-hour rule).

Organisations should treat current NDB compliance as a floor, not a ceiling, and build processes that can scale to stricter obligations.

FAQ

How quickly must I notify the OAIC after discovering a breach?

You have up to 30 days to assess whether a suspected breach is an eligible data breach. If you already know it meets the criteria, you must notify the OAIC and affected individuals "as soon as practicable" — which in practice means within days, not weeks. Delays without a credible explanation risk enforcement action.

Does the NDB scheme apply to small businesses?

Historically, businesses with annual turnover under AUD $3 million were exempt, but exceptions have always applied (health providers, TFN handlers, credit providers, and others must comply regardless of size). Ongoing Privacy Act reforms are expected to remove the small business exemption, so small operators should begin preparing now.

What's the difference between a data breach and an eligible data breach?

A data breach is any unauthorised access, disclosure, or loss of personal information. An eligible data breach is one that is likely to result in serious harm and cannot be remediated in time. Only eligible data breaches trigger mandatory notification under the NDB scheme — but all breaches should be logged internally.

Do I have to notify every affected individual personally?

Where practicable, yes — directly by email, SMS, phone, or post. If direct notification isn't practicable (e.g. you don't have current contact details for millions of people), you can publish the notification statement on your website and take reasonable steps to publicise it. The OAIC prefers direct notification where possible.

What are the maximum penalties for failing to notify?

For bodies corporate, serious or repeated interferences with privacy — including failures to notify — can attract penalties of up to AUD $50 million, three times the value of any benefit obtained, or 30% of adjusted turnover during the breach period, whichever is greatest. Individuals can face fines up to AUD $2.5 million.