Guides & Obligations
Data Breach and Privacy Act Obligations for Australian Business
If your business holds personal information, the Notifiable Data Breach scheme and the Australian Privacy Principles already apply to you. These guides explain what the obligations actually are, what happens when a breach occurs, and what evidence you need to show you took reasonable steps beforehand.
The NDB Scheme and What Follows a Breach
The Notifiable Data Breach scheme sets out when a business covered by the Privacy Act must assess a suspected breach and when it must notify. These guides cover whether the Act applies to you, the obligation itself, and the sequence of events that follows a real incident.
Does the Privacy Act Apply to You?
Most businesses under $3 million turnover are exempt, but health providers and several others are covered regardless. How to tell.
Notifiable Data Breach Obligations Explained
What counts as an eligible data breach, the 30-day assessment and the separate duty to notify, and the records worth keeping.
What Happens After a Data Breach
A breach triggers NDB obligations, OAIC scrutiny, and insurer assessment. Your pre-existing compliance position shapes all three.
APP 11 and Reasonable Steps
APP 11 requires businesses covered by the Privacy Act to take reasonable steps to protect personal information. What that means in practice.
Which Standard Applies, and What It Actually Proves
Certification and legal obligation are not the same thing. These guides sort out which frameworks apply to an Australian business, what a certificate does and does not demonstrate, and the evidence that stands behind it.
SMB1001 Compliance
Bronze, Silver and Gold are self-attested by a company director. See what each tier asks for and what the certificate proves.
SMB1001 Evidence Requirements
Control by control: what an insurer, customer or regulator asks you to produce, and what a defensible record looks like.
Compare the Frameworks
SMB1001, APP 11, the NDB scheme and Essential Eight: which are law, which are voluntary, and who verifies each.
My Health Record Security Requirements
Registered practices need a reviewed security and access policy, annual training and records kept for up to five years, produced within 7 days of a request.
Evidence of Reasonable Steps
Reasonable steps is not a checkbox. It is a position you either can or cannot demonstrate when a regulator, insurer, or client asks. These guides cover what that evidence looks like and how it is maintained.
How to Prove Cyber Compliance
Training alone is not enough. What evidence actually demonstrates your business met its obligations.
Cyber Compliance Evidence System
Track training, governance, and accountability so evidence exists before it is needed.
Evidence for Client Questionnaires
Clients and partners increasingly require proof of cyber compliance during onboarding.
Verify a Compliance Certificate
Confirm by Certificate ID that an individual has met their compliance obligations.
What Happens When Compliance Lives in a Spreadsheet
Most Australian businesses start with a workbook, a policy folder and an inbox, and that holds while there is little to maintain. These guides cover where the arrangement stops keeping a compliance position current, how it compares with a purpose-built system, and what moving across involves.
Why Spreadsheets Fail as a Compliance System
A spreadsheet records a compliance position. It does not keep one current. Where registers drift, and what has to be maintained by hand.
Compliance Software vs Spreadsheets
Fourteen areas compared, from policy lifecycle to audit trail, including where a manual process still holds up.
Moving From Spreadsheets to a System
Warning signs that the workbook has stopped holding up, and an eight-step way to move policies, training and evidence across.
What Applies When Your Business Uses AI
There is no Australian AI law. The obligations that reach AI use are the ones you already had, and they land on decisions most businesses have not made yet: what tools are approved, what information may go into them, and who checks what comes out.
AI Compliance in Australia
What actually applies, which obligations reach AI use, and what a business should be able to demonstrate about how it is governed.
AI and Reasonable Steps
AI made compliance documents fast to produce. It did not change what APP 11 asks you to demonstrate, and that gap is now wider.
Does Your Privacy Policy Need to Mention AI?
What the OAIC expects now, what changes on 10 December 2026, and the questions to answer before editing a word of the policy.
Automated Decision-Making and APP 1.7
From 10 December 2026, privacy policies must disclose automated decisions that significantly affect people. Not only AI: rules-based tools count too.
Where Liability Actually Lands
The OAIC acts against the organisation. Directors answer separately, under their own Corporations Act duties. And cyber insurance pays for losses; it does not transfer the obligation.
Cyber Governance & Legal Risk for Directors
Cyber risk is a board issue. If it was not overseen with care and diligence, directors may have to answer for that failure. What good oversight looks like on the record.
Cyber Insurance Requirements
Cyber insurers expect documented evidence of reasonable steps. Understand what they require.
Insurance Does Not Replace Compliance
Cyber insurance covers financial loss but does not satisfy your obligations under the Privacy Act.
What the OAIC Checks, and What Happens Next
How matters start, what the regulator looks at, and the outcomes it can reach: determinations, notices and court penalties.
Keep reading: For ongoing coverage of Australian data breaches as they are reported, see the Cleverer articles. For obligations specific to your sector, see cyber compliance by industry, and for how Cleverer protects your data see security & data protection, and for the training side see cyber compliance training.
Would Your Business Stand Up to Scrutiny After a Breach?
The NDB scheme does not ask whether you intended to comply. It asks what you had in place. If a breach happened tomorrow, the evidence you can produce today is the evidence you would rely on.
Check Your ReadinessBook a Call
General information only. This page is not legal advice.
