Data breach policies and what the Privacy Act requires of your business

Australian businesses hold personal information in almost everything they do: customer names, addresses and payment details, staff records, supplier data, and sometimes health or other sensitive information. That information is valuable, which is why it is a target for phishing, ransomware and simple human error. When it is lost, stolen or accidentally disclosed, the Privacy Act 1988 (Cth) (the Act) does not leave you to improvise. It sets out what you must do to protect personal information and how you must respond when a breach happens.

This guide sets out who those obligations apply to, the three duties that matter most for data breaches, the penalties for getting it wrong, and a practical checklist to work through. The question most businesses ask first is whether they need a data breach policy. The short answer is that no Australian law requires a document with that name, but the Act's obligations are designed to be discharged through exactly the kind of documented, tested process a good policy provides.

Who the obligations apply to

The Australian Privacy Principles (APPs) and the Notifiable Data Breaches (NDB) scheme apply to organisations and Australian government agencies. A business is an organisation under the Act if its annual turnover for the previous financial year was more than $3 million (s 6D of the Privacy Act 1988 (Cth)). Note the timing: the test looks at the previous financial year, so a business that has grown past the threshold is covered even before its current year accounts are finalised.

Businesses with turnover of $3 million or less are small business operators and are generally exempt. The exemption falls away, however, if the business:

Provides a health service and holds health information: most medical, allied health, fitness, workplace rehabilitation and alternative health providers are covered regardless of turnover.
Trades in personal information: disclosing personal information about someone for a benefit, service or advantage, or collecting it for a benefit, service or advantage, brings the business within the Act.
Works under a Commonwealth contract: contracted service providers for Commonwealth contracts are covered.
Is a credit reporting body or a related body corporate of a business that is not a small business.

If any of these descriptions fit, the business carries the full set of privacy obligations whatever its size.

Duty 1: take reasonable steps to secure personal information (APP 11)

Australian Privacy Principle 11 is the core security obligation. An entity that holds personal information must take such steps as are reasonable in the circumstances to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. The principle expressly states that reasonable steps include technical and organisational measures, and it also requires you to destroy or de-identify personal information once you no longer need it.

What is reasonable depends on your circumstances: the amount and sensitivity of the information, the size and resources of the business, the cost of available measures and the risk of harm. For a typical small to medium business, reasonable steps will usually include access controls and multi-factor authentication, encryption of laptops and mobile devices, patching and password policies, staff privacy and security training, tested backups, and checking how third-party providers handle data. A documented approach to these measures is the practical way to show you have taken them.

Duty 2: manage personal information openly and transparently (APP 1)

Australian Privacy Principle 1 requires an entity to manage personal information openly and transparently. In practical terms that means two things.

First, you must implement practices, procedures and systems that ensure you comply with the APPs and can deal with inquiries and complaints. Second, you must have a clearly expressed, up-to-date APP privacy policy that sets out what you collect, how you collect and hold it, how people can access and correct it, and how they can complain.

APP 1 is the principle that comes closest to requiring a data breach policy. A documented incident response process is a practice or system that supports compliance, and the Office of the Australian Information Commissioner (OAIC) treats preparation and response planning as the expected standard for organisations that hold personal information.

Duty 3: respond to eligible data breaches under the NDB scheme

Since 22 February 2018, the NDB scheme in Part IIIC of the Act has required notification when an eligible data breach occurs. An eligible data breach is unauthorised access to, unauthorised disclosure of, or loss of personal information, where a reasonable person would conclude that the access, disclosure or loss is likely to result in serious harm to any individual (s 26WE). If you take remedial action before the access or disclosure results in serious harm, the event is not an eligible data breach (s 26WF).

The scheme imposes a sequence you need to be able to run:

Assess within 30 days: if you become aware of reasonable grounds to suspect an eligible data breach, you must carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days (s 26WH).
Notify the OAIC as soon as practicable: if the assessment gives you reasonable grounds to believe an eligible data breach has occurred, you must prepare a statement setting out your identity and contact details, a description of the breach, the kinds of information involved and recommended steps for affected individuals, and give it to the OAIC as soon as practicable (s 26WK).
Notify affected individuals: you must take reasonable steps to notify the contents of the statement to each affected individual, or publish it on your website if individual notification is not practicable (s 26WL).
Expect the regulator to follow up: the Commissioner can direct an entity to notify if it has not done so (s 26WR).

What happens if you get it wrong

Failing to secure personal information, or any other breach of an APP, is an interference with privacy under the Act and can attract a civil penalty. For a body corporate, the maximum penalty for a serious or repeated interference with privacy is the greatest of $50 million, three times the value of any benefit obtained from the conduct, or 30% of adjusted turnover (s 13G(3) of the Act). For other entities the maximum is $2.5 million (s 13G(2)). Any other interference with privacy carries a maximum of 2,000 penalty units (s 13H).

These are not theoretical numbers. In June 2024 the OAIC filed civil penalty proceedings in the Federal Court against Medibank over its October 2022 cyberattack, alleging that from March 2021 to October 2022 the company seriously interfered with the privacy of 9.7 million Australians by failing to take reasonable steps to protect their personal and health information (OAIC media release).

There is also a growing private exposure. The Act now creates a statutory tort for serious invasions of privacy (s 7), which lets an individual sue for intrusion upon seclusion or misuse of information where the invasion was intentional or reckless and serious, and it is actionable without proof of damage. A breach that exposes sensitive information can therefore produce regulator action, penalty proceedings and individual claims at the same time.

Do you need a written data breach policy?

No provision of the Act says you must have a data breach policy. But in practice the obligation to have one follows from the duties above:

APP 1 requires practices and systems: a documented incident response process is a practice or system that supports compliance with the APPs, and the OAIC's guidance for responding to data breaches sets out a preparation and response framework that a documented plan satisfies.
APP 11 is easier to demonstrate: the reasonable steps test is far easier to meet with a written policy and a tested response plan than without one.
The 30-day clock demands preparation: the NDB scheme's assessment deadline is effectively impossible to meet if your team has to work out roles, evidence capture and notification steps from scratch in the middle of a crisis.
Contracts and insurers require it: customers, enterprise partners and cyber insurers routinely require a documented breach response capability as a condition of contracts, tenders and insurance cover.

The question is not whether to have a policy but how good it is. A useful policy is short, written in plain English and usable under pressure. It names the people who make decisions, sets a single reporting channel, describes the containment steps, explains how the 30-day assessment will run, includes templates for notifications to individuals and the OAIC, and requires a record of the timeline, decisions and remediation for every incident.

A practical compliance checklist

Work through these steps in order, from confirming coverage to keeping the plan current:

Confirm coverage: check whether the Act applies to you, including any exception that removes the small business exemption.
Publish a privacy policy: clearly expressed, up to date, and reflecting what you actually do.
Map your personal information: what you hold, where it lives, who has access and why.
Secure it proportionately: multi-factor authentication, encryption, access controls, patching, tested backups and staff training.
Draft a response plan: named roles, a single reporting channel, containment steps, an assessment process and notification templates.
Test the plan: run a tabletop exercise and update the plan after every incident or near miss.
Review it annually: and after any change to your systems, data or staff.

When a privacy lawyer helps

Most businesses can draft a workable first version of a policy and plan themselves. The value of a lawyer increases in three situations:

After a suspected breach: whether an event is notifiable turns on a serious harm assessment that has to be right under pressure. A lawyer can help you run that assessment, decide whether and when to notify, and draft the required statements to the OAIC and affected individuals.
Before a breach: a lawyer can review your incident response plan, check vendor and cloud contracts for breach notification and cooperation clauses, and advise on whether your business falls within an exception to the small business exemption.
If the OAIC investigates or commences proceedings: you need advice quickly. Early advice can limit exposure and shape how you communicate with customers, insurers and the regulator.

The 30-day clock starts the moment you suspect

The obligation most businesses miss is not the policy itself, it is the clock. The NDB scheme does not give you 30 days from the day you confirm a breach; it gives you 30 days from the day you first suspect one, and notification must follow as soon as practicable after that. Whether you meet that test depends on decisions made now, before any incident: who triages a report, who runs the serious harm assessment, who approves notification, and whether your templates and evidence capture are ready.

If your team could not answer those questions within a few hours of a suspected breach, the document to write this week is the response plan, not the privacy policy. A short, tested plan that your team actually knows about is worth more than a long policy that sits unused, and it is the difference between a managed incident and a penalty, a class action or a regulator's investigation.