Notifiable Data Breach Obligations for Australian Businesses
The Notifiable Data Breaches scheme requires Australian businesses to assess and report eligible data breaches to the OAIC and affected individuals. Failure to comply is not just a regulatory risk — it is evidence that reasonable steps were not in place when they were needed most.
Most Businesses Are Not Prepared for a Notifiable Breach
Many Australian businesses know the NDB scheme exists but have not tested whether their team could respond within the required timeframes, or whether their documentation would withstand regulatory review.
What businesses often assume
- A breach response plan exists somewhere in the policy folder
- IT will handle it if something happens
- Staff will know to escalate suspicious activity
- Insurance will cover any regulatory fallout
- Small businesses are unlikely to be investigated
What the NDB scheme actually requires
- A documented response plan that staff have been made aware of
- The ability to assess a suspected breach within 30 days
- Clear escalation pathways from staff to decision-makers
- Notification to the OAIC and affected individuals if the threshold is met
- Evidence that the organisation took reasonable steps before and after the breach
Where Breach Preparedness Fails in Practice
The NDB scheme does not just assess what happened — it assesses what was in place before the breach occurred and how the organisation responded.
No documented plan
Without a breach response plan, the 30-day assessment window becomes chaotic. Decisions are reactive, not structured.
Staff cannot escalate
If staff do not know what constitutes a suspected breach or who to report it to, the assessment clock starts without anyone knowing.
No evidence trail
Regulators assess the organisation's response. Without documentation, there is no evidence that the response was timely or adequate.
Compliance gaps exposed
A breach investigation often reveals pre-existing compliance failures — untrained staff, missing certifications, and weak oversight.
Would your team know what to do if a breach occurred today?
Answer 10 questions to assess whether your business is taking reasonable steps — including breach preparedness.
Are You Meeting Your Privacy Act Obligations?
The Privacy Act 1988 and APP 11 require organisations to take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. This assessment helps identify where your obligations may not be met.
Answer 10 questions to identify where your business may not be taking reasonable steps.
What Happens After a Notifiable Breach
The consequences of a notifiable breach extend beyond the breach itself. How your organisation responds — and what evidence it can produce — determines the regulatory and commercial outcome.
OAIC Investigation
The OAIC may investigate whether the organisation had reasonable steps in place before the breach. Compliance gaps discovered during investigation compound the original failure.
Insurance Implications
Cyber insurers assess whether the organisation met its obligations. A breach combined with poor compliance evidence can affect claim outcomes and future premiums.
Client and Commercial Impact
Affected individuals must be notified. Clients, partners, and stakeholders will ask what measures were in place. The absence of documented compliance is difficult to explain.
What You Should Be Able to Demonstrate
If a breach occurs and the NDB scheme is triggered, your organisation should be able to produce evidence of the following.
Before the breach
- Documented breach response plan
- Staff awareness of escalation procedures
- Role-based compliance coverage
- Current certifications and completion records
During the response
- Timeline of assessment activities
- Records of who was involved in the response
- Communication with affected individuals
- OAIC notification (if threshold met)
After the breach
- Remedial actions taken
- Updated processes and controls
- Evidence of ongoing compliance activity
- Board or governance-level review
Be ready to prove it.
Compliance obligations do not wait for a breach. Insurers, regulators, and clients expect documented evidence of reasonable steps — not a promise that you are working on it. The cost of being unable to demonstrate compliance is measured in liability, not intent.
