Data breach notification in Australia: what you must do
Under the Notifiable Data Breaches scheme, covered organisations must tell the OAIC and affected people about an eligible data breach that is likely to cause serious harm. This is general information, not legal advice.
What the scheme requires
The scheme sits within the Privacy Act 1988 and is run by the Office of the Australian Information Commissioner (OAIC). If a covered organisation has an eligible data breach, it must notify the OAIC and the people affected.
Who it applies to
It generally covers businesses with annual turnover above $3 million, Australian Government agencies and some smaller organisations, such as health service providers. The rules change over time, so confirm with the OAIC or a legal adviser whether they apply to you.
What counts as an eligible data breach
Unauthorised access to or disclosure of personal information, or the loss of it, where serious harm to the people involved is likely and the harm has not been prevented by action you have taken.
If you suspect a breach
- Contain it
- Reset passwords, remove access, isolate affected devices and keep logs and evidence.
- Assess it
- Work out what information was involved and who could be harmed. The Act expects a suspected breach to be assessed quickly and within 30 days.
- Notify
- If it is an eligible breach, notify the OAIC and the affected people as the scheme requires.
- Review
- Find how it happened and close the gap so it does not repeat.
What helps before it happens
Multi-factor authentication, limited administrator access, logging, tested backups and staff who know how to report a problem reduce both the chance and the size of a breach. A vulnerability assessment and a Microsoft 365 review show where you are exposed.
Common questions
What is the Notifiable Data Breaches scheme?
A requirement under the Privacy Act 1988 for covered organisations to notify the OAIC and affected people when an eligible data breach is likely to cause serious harm.
Does a small business have to report a data breach?
It depends. The scheme generally covers businesses with annual turnover above $3 million and some smaller organisations, such as health service providers. Check with the OAIC or a legal adviser.
How long do we have to assess a suspected breach?
The Act expects a reasonable and expeditious assessment, completed within 30 days of becoming aware of the suspicion.
Where do we report a cyber incident?
Report cybercrime through ReportCyber at cyber.gov.au. Data breach notifications go to the OAIC.
Start with the free cyber checkup.
The checkup is free and runs on its own site. If you would rather talk first, email the team.