Every Australian business that handles personal information should know whether the Notifiable Data Breaches (NDB) scheme applies to it, because the scheme imposes hard deadlines once customer data is compromised. The NDB scheme sits in Part IIIC of the Privacy Act 1988 (Cth) (the Act) and requires the entities the Act covers to assess suspected data breaches, notify the Office of the Australian Information Commissioner (OAIC), and notify affected individuals when a breach is likely to result in serious harm. The scheme has applied to breaches occurring on or after 22 February 2018, and the numbers show why it matters: in 2024 the OAIC received 1,113 notifications, the highest annual total since the scheme began (OAIC, "OAIC stats show record year for data breaches").
If your business is covered, three duties matter: identify an eligible data breach, assess it within 30 days, and notify the OAIC and affected individuals as soon as practicable. This article explains who the scheme applies to, walks through each duty, sets out the consequences of getting it wrong, and finishes with a compliance checklist you can act on.
Who the NDB scheme applies to
The NDB scheme does not apply to every business in Australia. It applies to APP entities, being the agencies and organisations already bound by the Privacy Act. Most private businesses are bound because they are not "small business operators", and that status turns mainly on annual turnover.
- Turnover test: a business is a small business for a financial year if its annual turnover for the previous financial year was $3 million or less (s 6D(1) of the Act). A business that started during the previous year is tested against the current year's turnover instead.
- Exceptions to the small business exemption: a business is not a small business operator, and is therefore caught by the Act, if it provides a health service and holds health information, discloses personal information for a benefit, service or advantage, provides a benefit, service or advantage in order to collect personal information, is a contracted service provider for a Commonwealth contract, or is a credit reporting body (s 6D(4) of the Act).
- Special information: the NDB obligations also attach to credit reporting bodies for credit reporting information and to file number recipients for tax file number information (s 26WE(1) of the Act).
| Situation | Covered by the NDB scheme? |
|---|---|
| Annual turnover above $3 million | Yes |
| Turnover $3 million or less, and none of the exceptions apply | No |
| Health service provider holding health information | Yes, even below the turnover threshold |
| Business disclosing or collecting personal information for a benefit, service or advantage | Yes, even below the turnover threshold |
| Contracted service provider for a Commonwealth contract | Yes, even below the turnover threshold |
| Credit reporting body | Yes |
Two traps are worth flagging. First, the threshold is tested against the previous financial year, so a business that grew past $3 million last year is covered even if this year has been quiet. Second, size does not save a business that trades in personal information: a lead-generation business, a data broker or any business that discloses customer information for a benefit is caught regardless of turnover.
Duty one: identify an eligible data breach
Not every data breach is notifiable. The scheme only requires notification of an "eligible data breach" as defined in s 26WE(2) of the Act. An eligible data breach occurs in one of two ways:
- unauthorised access to, or unauthorised disclosure of, personal information, where a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any individual the information relates to; or
- loss of personal information in circumstances where unauthorised access or disclosure is likely to occur, and a reasonable person would conclude that such access or disclosure, if it occurred, would be likely to result in serious harm.
Common examples include a hacked customer database, a lost or stolen laptop or phone containing customer information, and an email sent to the wrong recipient.
The definition is deliberately forward-looking. The test is not whether serious harm has actually happened; it is whether a reasonable person would conclude that serious harm would be likely. An entity should not wait for evidence of actual harm before treating an incident as notifiable.
There is an important exception. Under s 26WF of the Act, if the entity takes action before the access or disclosure results in serious harm, and a reasonable person would then conclude that the access or disclosure would not be likely to result in serious harm, the incident is not an eligible data breach. Retrieving a misdirected email before anyone has read it, or recovering a lost device before the information is accessed, can take the incident outside the scheme entirely.
Duty two: assess a suspected breach within 30 days
Where an entity becomes aware that there are reasonable grounds to suspect an eligible data breach may have occurred, but does not yet have reasonable grounds to believe one has occurred, it must carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days of becoming aware (s 26WH of the Act).
The assessment must weigh the matters set out in s 26WG of the Act:
- the kind or kinds of information involved;
- the sensitivity of the information;
- whether the information was protected by security measures, and how likely those measures were to be overcome;
- the persons, or kinds of persons, who obtained or could obtain the information;
- where a security technology such as encryption was used, the likelihood that the people who obtained the information could circumvent it;
- the nature of the harm; and
- any other relevant matters.
The serious harm threshold is not confined to financial loss. The statutory factors direct attention to the nature of the harm and any other relevant matters, which in practice can include identity theft, reputational damage and significant distress to the individuals affected. An assessment that stops at "no money was stolen" will often miss the point, because the reasonable person test looks at what could flow from exposure of the information, not just what has flowed so far.
Keep a written record of the assessment. If the OAIC later investigates, an entity that can show a timely, considered assessment against the s 26WG factors is in a much stronger position than one that can only explain its reasoning from memory.
Duty three: notify the OAIC and affected individuals
Two notifications are required once an entity is aware of reasonable grounds to believe that an eligible data breach has occurred.
Statement to the OAIC
The entity must prepare a statement and give a copy to the Commissioner as soon as practicable after becoming aware (s 26WK of the Act). The statement must set out:
- the identity and contact details of the entity;
- a description of the eligible data breach;
- the particular kind or kinds of personal information concerned; and
- recommendations about the steps individuals should take in response to the breach.
Notification to affected individuals
The entity must also take such steps as are reasonable in the circumstances to notify the contents of the statement to the affected individuals, and must do so as soon as practicable after the statement is prepared (s 26WL of the Act). Where it is impracticable to notify every affected individual, the entity must notify the individuals who are at risk from the breach. Where it is impracticable to notify individuals at all, the entity must publish the statement on its website and take reasonable steps to publicise its contents.
"as soon as practicable" is a demanding standard. The Act sets no outer deadline for notification, but notification is expected to follow promptly once the assessment supports a reasonable belief that an eligible data breach has occurred. An entity that delays notification while it waits for certainty, or while it weighs reputational concerns, risks the delay itself being treated as a failure to comply with the scheme.
Consequences of non-compliance
The NDB scheme is backed by a real enforcement regime. Contravening the assessment duty, the duty to notify the Commissioner, or the duty to notify affected individuals is taken to be an interference with the privacy of an individual under s 13(4A) of the Act. That classification opens the door to:
- complaints from affected individuals, which the OAIC can investigate;
- determinations by the OAIC requiring the entity to take specified action, including notification;
- enforceable undertakings accepted by the Commissioner; and
- proceedings in the Federal Court seeking civil penalties.
The penalty exposure is significant. For a serious or repeated interference with privacy, the maximum civil penalty for a body corporate is the greatest of $50 million, three times the value of any benefit obtained that is reasonably attributable to the conduct, or 30 per cent of the entity's adjusted turnover during the breach turnover period (s 13G(3) of the Act). For entities other than bodies corporate the maximum is $2.5 million (s 13G(2) of the Act). These penalty levels were introduced by the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (Cth), which took effect on 12 December 2022.
A compliance checklist
Work through this checklist with the person responsible for privacy in your business:
- Confirm whether the scheme applies, and review that position each year, because the turnover test looks at the previous financial year.
- Prepare a data breach response plan before an incident occurs, so that roles, assessment steps and notification paths are already decided.
- Document the s 26WG factors your assessment will weigh, and keep records of assessments you actually run.
- Review contracts with IT suppliers and other third parties that hold your customer data. Decide who assesses breaches, who notifies the OAIC and affected individuals, and who bears the cost of the assessment.
- Train staff to recognise and immediately report suspected breaches, including lost devices, misdirected emails and suspicious access to systems.
- Keep the OAIC's notifiable data breach reporting channel accessible to the person responsible for privacy.
When to get legal help
A lawyer is most useful at the judgment points the scheme creates. Threshold questions, such as whether your business is an APP entity or whether a particular data set counts as personal information, can be genuinely difficult for smaller businesses. The serious harm assessment on complex facts, and the wording of the statement to the OAIC and affected individuals, are also places where a careful review adds real value, particularly when a breach is large or involves sensitive information. A practitioner can review your data breach response plan and IT contracts before an incident occurs, and can manage the OAIC relationship if an investigation or an enforceable undertaking follows.
The duty most businesses miss: the 30-day clock
If there is one part of the scheme that catches businesses out, it is timing. The Act does not let you wait until you are certain. Once you have reasonable grounds to suspect an eligible data breach, the 30-day assessment clock starts running, and once the assessment gives you reasonable grounds to believe, notification must follow as soon as practicable. The practical first step this week is to work out whether the scheme applies to your business and, if it does, to name the person who owns the response. Everything else in the scheme is far easier to manage if that decision is made before a breach happens.