- Who the notifiable data breach scheme applies to
- What makes a breach notifiable
- Duty one: investigate and assess within 30 days
- Duty two: notify the OAIC
- Duty three: notify affected individuals
- The penalties for getting it wrong
- A practical compliance checklist
- When you need a lawyer
- The 30-day clock starts when you first suspect
Cybercrime is not a hypothetical risk for Australian business. The Australian Cyber Security Centre (ACSC) received 76,000 cybercrime reports in the 2021-22 financial year, an average of one every seven minutes. When one of those incidents involves the personal information of your customers, a set of legal duties can switch on almost immediately under the Privacy Act 1988 (Cth) (the Act).
Since 22 February 2018, the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Act has required businesses covered by the Act to assess suspected breaches and, in defined circumstances, notify the Office of the Australian Information Commissioner (OAIC) and the affected individuals. Getting it wrong now costs more than the breach itself. Penalties for serious interferences with privacy were increased in December 2022 to a maximum of $50 million for companies, and the OAIC has new powers to compel information about a breach.
This article sets out who the scheme applies to, what makes a breach notifiable, the three duties that follow, the penalties for non-compliance, and the steps you can take to be ready before a breach happens.
Who the notifiable data breach scheme applies to
The NDB scheme applies to APP entities that hold personal information and are required to secure it under Australian Privacy Principle 11.1 (s 26WE(1) of the Privacy Act 1988 (Cth)). In practical terms, that means most businesses with annual turnover above $3 million, plus a range of smaller operators that fall within the Act.
The Act defines a small business as one whose annual turnover for the previous financial year was $3 million or less (s 6D). A business that started during the current year is tested against the current year's turnover instead. Small businesses are generally exempt from the Act, but s 6D(4) removes the exemption from operators that:
- Health services: provide a health service to individuals and hold health information, such as a physiotherapist or allied health clinic
- Data trading: disclose personal information about other people for a benefit, service or advantage, or collect personal information from others in exchange for a benefit
- Commonwealth contracts: act as a contracted service provider for a Commonwealth contract
- Credit reporting: are a credit reporting body
A body corporate is also not a small business operator if it is related to a larger company (s 6D(9)), so the exemption cannot be avoided by running the same business through several small entities.
Even if the Privacy Act does not apply to you, a breach can still create obligations. Customer and supplier contracts routinely require notification of security incidents, and the general law exposes you to claims for breach of contract, breach of confidence and negligence. If you handle personal information for a client that is covered by the Act, your agreement with that client will usually pass the notification duties down to you and make you liable for failing to meet them.
What makes a breach notifiable
Not every security incident is notifiable. The Act only requires notification of an eligible data breach, which has two elements (s 26WE(2)):
- Access or disclosure: there has been unauthorised access to, or unauthorised disclosure of, the personal information, or the information has been lost in circumstances where unauthorised access or disclosure is likely to occur
- Serious harm: a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the affected individuals
Personal information is defined broadly. It covers information or an opinion about an identified individual, or an individual who is reasonably identifiable (s 6(1)). Customer names, email addresses, phone numbers, dates of birth, payment details and health information all fall within it.
The serious harm test is an objective one, judged through the eyes of a reasonable person. In applying it, s 26WG directs you to consider the kind and sensitivity of the information, whether it was protected by security measures and how easily those measures could be overcome, who obtained or could obtain the information, and the nature of the harm that could follow. A laptop containing unencrypted tax file numbers and Medicare details that is stolen from a car will almost always meet the test. A list of customer names and email addresses that were already public may not. The OAIC's guidance treats harm as capable of being physical, psychological, emotional, reputational or financial.
There is one important escape route. Under s 26WF, if you take action before the access or disclosure results in serious harm, and as a result a reasonable person would conclude that serious harm is no longer likely, the incident is not an eligible data breach at all. Retrieving a misdirected email before it has been opened, remotely wiping a stolen device, or resetting compromised credentials before they can be used can all take an incident out of the scheme, provided the action genuinely removes the risk.
Duty one: investigate and assess within 30 days
The first duty is triggered by suspicion, not certainty. Under s 26WH, as soon as your business is aware that there are reasonable grounds to suspect an eligible data breach, you must carry out a reasonable and expeditious assessment of whether there are reasonable grounds to believe one has occurred. You must take all reasonable steps to complete that assessment within 30 days of becoming aware.
The assessment should establish what happened, what information was involved, how many individuals are affected, whether serious harm is likely, and whether remedial action has changed the picture. The OAIC expects entities to be able to demonstrate that the assessment was reasonable and expeditious, so keep a written record of what you did and when. The 30-day clock starts when your business first has reasonable grounds to suspect, not when the breach is confirmed, so a slow investigation can put you in breach before you have even decided the incident is notifiable.
Duty two: notify the OAIC
If the assessment gives you reasonable grounds to believe that an eligible data breach has occurred, s 26WK requires you to prepare a statement and give a copy to the Commissioner as soon as practicable. The statement must set out:
- the identity and contact details of your business
- a description of the eligible data breach
- the particular kinds of information concerned
- recommendations about the steps affected individuals should take in response
"As soon as practicable" means what it says. Once the assessment confirms the breach, you should notify promptly rather than waiting out the 30-day assessment period. The OAIC publishes a form you can use to report a data breach, and its guidance on when to report sets out what the Commissioner expects.
Duty three: notify affected individuals
Section 26WL separately requires you to notify the individuals affected by the breach. If it is practicable, you must take reasonable steps to notify the contents of the statement directly to each affected individual, or to each individual who is at risk from the breach. Direct notification usually means email, SMS or letter. If it is not practicable to notify individuals directly, you must publish a copy of the statement on your website.
The notification should be written in plain language. Affected individuals need to understand what happened, what information was involved and what they should do, such as changing passwords or contacting their bank. The statement you give the OAIC and the notice you give individuals should tell the same story, so prepare them together.
The penalties for getting it wrong
The financial exposure for a serious breach is now substantial. Under s 13G, a serious interference with the privacy of an individual is a civil penalty provision, and the maximum penalty is:
- For an individual: $2.5 million
- For a body corporate: the greatest of $50 million, three times the value of any benefit the company and its related bodies corporate obtained from the contravention, or, if the court cannot determine the value of that benefit, 30% of the adjusted turnover of the company during the breach turnover period
The breach turnover period runs for at least 12 months, so the turnover limb can bite mid-size businesses hard where the benefit of a contravention cannot be quantified. Interferences with privacy that are not serious carry a penalty of up to 2,000 penalty units under s 13H.
These figures were introduced by the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (Cth), which commenced on 12 December 2022 following a wave of high-profile breaches. The same Act strengthened the OAIC's hand. Under s 26WU, the Commissioner can compel information and documents about an actual or suspected eligible data breach and about your compliance with the notification requirements. The Commissioner can also direct an entity to notify a breach, investigate on his or her own initiative, and ultimately seek penalties in the Federal Court.
Beyond fines, a notifiable breach that was not reported can cost you customers, damage your reputation and invite civil claims from affected individuals. An eligible data breach can also be an interference with privacy in its own right if it stems from a failure to secure information as required by the Australian Privacy Principles.
A practical compliance checklist
The obligations above are easier to meet if the groundwork is done before a breach occurs. The ACSC's small business cyber security guide recommends three starting measures: turn on multi-factor authentication, update your software, and back up your information. Beyond those:
- Train your staff: phishing and spear phishing remain the most common entry points, and your people need to know how to spot them and how to report a suspected incident
- Use strong passwords: require unique passwords for business accounts and a password manager, and enable multi-factor authentication wherever it is offered
- Back up regularly: keep customer, financial and other critical data backed up, with at least one copy stored separately and offsite so ransomware cannot reach it
- Know your data: map what personal information you hold, where it is stored and who can access it, so an assessment does not stall while you work out what was exposed
- Write an incident response plan: decide who leads the response, who decides whether an incident is notifiable, and who your contacts are at the OAIC, your insurer and your legal advisers, and rehearse the plan
- Review your privacy policy: APP entities must have a privacy policy that accurately describes how they handle personal information, and it should be updated when your practices change
- Cover remote work: set clear rules for devices connecting to your network, including requiring updates before connection and limiting which devices are allowed
If a breach does occur, preserve evidence, contain the incident, and start the assessment immediately. Record every decision, including the reasoning behind a decision not to notify, because the OAIC may ask you to justify it later.
When you need a lawyer
A privacy lawyer's role in a data breach is to make the legal calls while your IT team makes the technical ones. Lawyers typically assist by:
- assessing whether an incident meets the eligible data breach test and the serious harm threshold
- running and documenting the 30-day assessment so it withstands OAIC scrutiny
- drafting the NDB statement and the notifications to affected individuals
- responding to OAIC requests for information and investigations
- reviewing your contracts with customers, suppliers and data processors for breach notification clauses
- advising on remedial action, insurance notification and communications
It is worth engaging a lawyer early in a suspected breach. The assessment period is short, and advice given after the 30-day clock has run cannot undo a missed deadline.
The 30-day clock starts when you first suspect
The most expensive mistake businesses make is waiting for certainty before treating an incident as a breach. The law does not allow that luxury. Your assessment duty starts when there are reasonable grounds to suspect, and the 30-day clock runs from that point, not from confirmation. If a breach later turns out to be notifiable and you did not report it, "we were still assessing" will not help, because the OAIC will simply ask what you did during those 30 days.
The serious harm test is also judged on the information available at the time, which is why documenting your reasoning matters as much as the decision itself. Write your incident response plan this week, name the person who decides on notification, and record every step of the assessment. For most businesses a breach is a matter of when, not if, and the paperwork you produce in those first 30 days is what the regulator will judge.