Notifiable Data Breaches
Notifiable Data Breach Obligations for Australian Businesses
The Notifiable Data Breaches scheme requires businesses covered by the Privacy Act to assess a suspected data breach quickly and to report an eligible one to the OAIC and the people at risk. Once a breach is reported, the next question is usually whether reasonable steps were in place before it happened.
General information only. This page is not legal advice.
What counts as an eligible data breach?
Not every incident is notifiable. Under Part IIIC of the Privacy Act, a breach is an eligible data breach when all three of these are true.
1. Access, disclosure or loss
Personal information was accessed or disclosed without authorisation, or lost in circumstances where that is likely to happen. A misdirected email counts. So does a stolen laptop or a compromised mailbox.
2. Likely serious harm
A reasonable person would conclude it is likely to result in serious harm to someone the information is about. Harm can be financial, physical, psychological, emotional or reputational. The kind of information, how sensitive it is, whether it was protected and who now has it all go into that judgement.
3. Not contained in time
If you act quickly enough that serious harm is no longer likely, for example by recovering a misdirected file before it is opened, the breach is not eligible and notification is not required.
The scheme applies to businesses and agencies with obligations under APP 11, and to credit reporting bodies, credit providers and holders of tax file number information. Most small businesses with turnover of $3 million or less are outside it, but not all of them. Check whether the Privacy Act applies to your business.
Sources: Privacy Act 1988 (Cth), Part IIIC (ss 26WE to 26WL) · OAIC, Notifiable data breaches
Two clocks: 30 days to assess, then notify as soon as practicable
The 30-day figure is the one everyone remembers, and it is often misread. It is an assessment deadline, not a notification deadline.
When you suspect a breach
- You have reasonable grounds to suspect an eligible breach, but not yet to believe one occurred.
- You must carry out a reasonable and expeditious assessment.
- You must take all reasonable steps to complete it within 30 days of becoming aware.
- Thirty days is a maximum, not a target. The OAIC expects an assessment to move as quickly as the facts allow.
When you believe it is eligible
- Prepare a statement and give it to the OAIC as soon as practicable.
- The statement covers who you are, what happened, the kinds of information involved and what people should do to protect themselves.
- Notify affected individuals as soon as practicable: everyone affected, only those at risk, or by publishing the statement if neither is practicable.
- Do not wait for the 30 days to run out if you already know.
What businesses often assume, and what the Act actually says
What businesses often assume
- Every breach has to be reported to the OAIC
- We have 30 days to notify
- The law requires a written data breach response plan
- IT will handle it if something happens
- Small businesses are outside the scheme
What the Act actually says
- Only eligible breaches are notifiable, though every suspected one has to be assessed
- Thirty days is for the assessment. Notification is as soon as practicable
- A plan is OAIC recommended practice, not a statutory requirement, and it is the main thing that makes the timeline achievable
- Deciding whether serious harm is likely is a judgement the business owns, not its IT provider
- Many are outside it, but health providers, TFN holders and others are not
Where Breach Preparedness Fails in Practice
The NDB scheme itself is about assessing and notifying. An OAIC inquiry after a breach rarely stops there, because the same facts usually raise the question of whether APP 11 reasonable steps were in place beforehand. Cleverer Breach Watch records publicly reported Australian breaches and the official source material behind each one.
No agreed process
Without a response plan, the first days go on working out who decides. The assessment clock is already running.
Staff cannot escalate
If staff do not recognise a suspected breach or know who to tell, the business can become aware long before anyone with authority does.
No assessment trail
A business that decides a breach is not eligible should be able to show how it reached that view, and when. A conclusion with no reasoning behind it is hard to defend.
Older gaps exposed
An inquiry into a breach often turns to what was in place before it: access controls, staff training, supplier oversight and whether anyone was reviewing them.
Self-Assessment
Would your team know what to do if a breach occurred today?
Answer 10 questions to assess whether your business is taking reasonable steps, including breach preparedness.
Are You Meeting Your Privacy Act Obligations?
The Privacy Act 1988 and APP 11 require organisations covered by the Act to take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. This assessment helps identify where your obligations may not be met.
Answer 10 questions to identify where your business may not be taking reasonable steps.
What Happens After a Notifiable Breach
Notifying is not the end of it. The OAIC reads every notification, and how the business handled the breach shapes what follows with the regulator, its insurer and its clients.
OAIC Investigation
The OAIC may ask questions, open an investigation or take enforcement action. Failing to assess or notify as required is itself an interference with privacy, and an inquiry into the breach commonly looks at whether APP 11 reasonable steps were taken beforehand. See what regulators check, and what they can do.
Insurance Implications
Cyber insurers look at whether the answers in your proposal were accurate and whether you met your policy conditions, including how quickly you told them. Poor records make both harder to show.
Client and Commercial Impact
People at risk have to be told. Clients and partners then ask what was in place and what has changed. A dated answer is much easier to give than a reconstructed one.
What You Should Be Able to Demonstrate
The Act does not prescribe a set of breach records. These are the records that let a business answer the questions the OAIC, an insurer or a client will reasonably ask. Items marked as practice are recommended, not required by law.
Before the breach
- A data breach response plan, and the people named in it (practice)
- Staff who know how to report a suspected breach (practice)
- Records that security controls were in place and reviewed
- A current list of where personal information is held
During the response
- When the business became aware, and when the assessment finished
- How serious harm was assessed, and the reasons for the decision
- What containment or remedial action was taken, and when
- The statement given to the OAIC and the notices sent to individuals
After the breach
- The changes made so it does not happen the same way again
- A review of how the response went (practice)
- Sign-off by the owner, board or senior manager
- Evidence the fixes were completed, not just agreed
Cleverer's incident register links each incident to a structured NDB assessment that records the breach type, the kinds of information involved, the harm assessment, an owner and a due date 30 days from when the business became aware, with each status change dated. It supports the assessment; the decision and any legal advice remain yours.
Related compliance resources
- What happens after a data breach
- How to prove cyber compliance under the Privacy Act
- What regulators assess under the Privacy Act
- Compliance evidence your insurer expects
- The dated records a breach assessment relies on
- Privacy Act, APP 11 & compliance frameworks
- GRC for small business: building the record before a breach
Be ready to prove it.
Compliance obligations do not wait for a breach. Insurers, regulators, and clients expect documented evidence of reasonable steps, not a promise that you are working on it. The cost of being unable to demonstrate compliance is measured in liability, not intent.
