When your business must report a data breach to the OAIC

If your business holds personal information about customers and suffers a data breach, you may be legally required to report it. Since 22 February 2018, Part IIIC of the Privacy Act 1988 (Cth) has set up the Notifiable Data Breaches (NDB) scheme, which obliges many businesses to notify both the Office of the Australian Information Commissioner (OAIC) and the affected individuals when a breach is likely to cause serious harm.

The scheme trips up small businesses more often than they expect, largely because the test for when a breach becomes notifiable is not a simple one. You do not have to report every data breach, and you do not have to report an incident your business has already contained. This article walks through who the obligation applies to, what makes a breach notifiable, the timing duties that follow, and what happens if you get it wrong.

Whether the obligation applies to you

The NDB scheme binds APP entities under the Privacy Act, plus a set of businesses that fall outside the general exemptions. As a rule of thumb, if the Privacy Act already applies to you for any reason, the NDB scheme applies to you too.

The most important trigger is turnover. A business that earns more than $3 million in annual turnover for a financial year is generally not a small business operator and must comply with the Privacy Act and the NDB scheme. Annual turnover is defined in s 6DA of the Privacy Act 1988 (Cth) and includes the proceeds of sales of goods and services, commission income, rent, leasing and hiring income, interest, royalties and dividends, and other operating income.

The $3 million threshold catches many operators who do not think of themselves as "big business", particularly once casual, project-based or seasonal revenue is counted. It also does not tell the whole story, because several categories are covered regardless of turnover, including:

Health service providers, which hold and handle health information;
Credit reporting bodies such as the major credit bureaus;
Credit providers that hold credit reporting or credit eligibility information;
File number recipients, which hold tax file number information;
Businesses such as childcare, schooling and some government contractors that hold certain kinds of sensitive information.

If any of these descriptions fits, the NDB scheme obligations attach to you even if your turnover is well under $3 million. The practical point for a director or operator is to work out, before an incident, whether your business is in scope, because the obligation to report arises at the moment you hold an incident and you will not have time to resolve scope questions then.

What makes a data breach notifiable

A breach is notifiable only if it meets the definition of an eligible data breach in s 26WE of the Privacy Act 1988 (Cth). Three elements all have to be present:

Unauthorised access, disclosure or loss: there must be unauthorised access to, unauthorised disclosure of, or loss of personal information that your business holds. This covers the classic scenarios: a hacker accessing a customer database, a staff email sent to the wrong external recipient containing personal information, a lost or stolen laptop or USB drive holding customer records, or a misconfigured server that exposes customer data online. A loss is also an eligible trigger, provided the loss could reasonably lead to unauthorised access or disclosure, for example a device containing unencrypted customer data going missing.
Likely serious harm: a reasonable person must conclude that the access, disclosure or loss would be likely to result in serious harm to any individual. This is the heart of the test and is considered separately below.
No effective remedial action: your business must not have been able to prevent the likely risk of serious harm through remedial action. If you act quickly and the remedial steps mean a reasonable person would conclude the access or disclosure would no longer be likely to cause serious harm, the incident is not an eligible data breach and you do not have to report it.

All three elements must be satisfied. Because the test is objective, it does not matter what your business subjectively believed. The question is what a reasonable person in your position would conclude. That is why the assessment step matters, and why you should not assume an incident is "not serious enough" without working through the factors below.

Judging whether serious harm is likely

"Likely" here means more likely than not, generally taken as a greater than 50 per cent chance, rather than a mere possibility. "Serious harm" is harm that is serious in the nature of psychological, physical, emotional, financial or reputational harm to an individual. A nick of a handful of names may not reach the threshold, while the release of medical records, identity documents or banking details very often does.

Section 26WG of the Privacy Act 1988 (Cth) sets out the matters you must weigh when deciding whether a reasonable person would conclude serious harm is likely. Working through them is exactly what a defensible assessment looks like:

The kind and sensitivity of the information: highly sensitive categories such as health records, government identifiers and financial details point towards serious harm. A release of names and email addresses on their own often does not.
Whether the information was protected by security measures, and how easily they could be overcome: information protected only by a weak, guessable password is more likely to lead to serious harm than information held behind strong, maintained controls.
Who has obtained, or could obtain, the information: a breach that exposes records to the open internet or a widely shared link is far more serious than a device recovered from somewhere contained.
The nature of the harm to individuals: whether the information could be used for identity theft, fraud or financial loss.
Whether security technology such as encryption made the information unintelligible: if encrypted records are compromised and the key was not, that usually reduces the likelihood of serious harm. Under s 26WG(h), the relevant question is whether the person who obtained the information could realistically defeat the protection.

OAIC guidance makes clear that this is a forward-looking, fact-specific judgement made by a reasonable entity in the position of your business, using the information available at the time. It is not a defence to say serious harm did not eventuate later; the test is whether it was likely at the time.

The remedial action exception

Section 26WF of the Privacy Act 1988 (Cth) provides a genuine escape route. If your business takes action in relation to the access or disclosure before it results in serious harm, and as a result a reasonable person would conclude the access or disclosure would no longer be likely to cause serious harm, the incident is taken never to have been an eligible data breach.

For a loss of information, the remedial action must be taken before there is unauthorised access to or disclosure of the information, with the result that no unauthorised access or disclosure occurs. A lost but recovered, unread device that was quickly secured may fall within this exception.

This is why the fastest, most effective response to any suspected breach is usually containment. Resetting passwords, recalling or deleting a misdirected email, disabling a compromised account or recovering hardware quickly can remove the serious-harm element altogether and take you out of the NDB scheme. But the exception is not automatic. You need to be able to show the action was taken in time and that it genuinely changed the risk assessment.

The duties once a breach is notifiable

If your business is in scope and an eligible data breach has occurred, or you have reasonable grounds to suspect one has, a chain of duties under Part IIIC is triggered. Knowing which one applies depends on whether you are still assessing or already believe a breach occurred:

Assess suspected breaches within 30 days: under s 26WH of the Privacy Act 1988 (Cth), if you are aware of reasonable grounds to suspect an eligible data breach may have occurred but you are not yet sure, you must carry out a reasonable and expeditious assessment of whether there are reasonable grounds to believe an eligible data breach has happened. The assessment must be completed within 30 days of you becoming aware of the suspected breach. The 30 days is an outer limit, not a target, and a reasonable and expeditious assessment for a serious incident should usually take days, not weeks.
Prepare a statement and give it to the OAIC: under s 26WK, once you are aware of reasonable grounds to believe an eligible data breach has occurred, you must prepare a statement and give a copy to the Commissioner as soon as practicable. The statement must set out:
The identity and contact details of your business;
A description of the eligible data breach;
The particular kinds of personal information involved; and
Recommendations about the steps individuals should take in response.
Notify the affected individuals: under s 26WL, you must then notify the contents of the statement to each affected individual, or each individual at risk, as soon as practicable, using reasonable steps and, where practical, the method you normally use to communicate with them. If it is not practicable to notify individuals directly, you must publish the statement on your website (if you have one) and take reasonable steps to publicise its contents.

The reporting obligation is not a one-off form. It runs to both the OAIC and the people affected, and the content requirements are fixed by the Act. This is a recurring area where businesses trip up, because the notification must be both timely and substantively complete.

Consequences of getting it wrong

The NDB scheme sits inside a Privacy Act that now carries substantial penalties, so the cost of a missed or late notification can be significant even for a small business.

A failure to comply with the notification obligations is a contravention that the OAIC can investigate, and the Commissioner has the power under s 26WR to direct an entity to prepare a statement and notify where it appears an eligible data breach has occurred. Beyond that, a serious or repeated interference with privacy can draw the maximum civil penalties in s 13G of the Privacy Act 1988 (Cth): for a body corporate, the greater of $50 million, three times the value of any benefit reasonably attributable to the conduct, or 30 per cent of the body's turnover during the breach period. An interference with privacy that is not serious carries a maximum penalty of 2,000 penalty units under s 13H.

Enforcement is not confined to penalties. The OAIC can accept enforceable undertakings, issue infringement notices or compliance notices, and seek compensation orders in favour of affected individuals. A public data-breach notification, and the regulator attention that follows, also carries reputational and customer-trust costs that are harder to price but very real for an SME.

A practical compliance checklist

You cannot build a defensible response in the middle of an incident, so the work happens beforehand. A sensible start is to:

Confirm whether you are in scope, including checking your annual turnover and whether any category such as health services, credit or tax file number handling applies.
Decide who owns a breach response in your business, and how they can be reached quickly, including outside normal hours.
Have a documented incident response plan with steps to contain, assess and escalate.
Know what personal information you hold and where, including whether any of it is sensitive, so a breach can be scoped fast.
Keep security measures current, and know whether sensitive records are encrypted in a way that would reduce the likelihood of serious harm.
Keep a contemporaneous record of your assessment, because if a decision not to notify is later questioned, the reasoning you recorded at the time is your best evidence.

Where a lawyer makes a difference

The judgement that sits at the centre of the scheme, whether a reasonable person would conclude serious harm is likely, is exactly the kind of forward-looking assessment a privacy lawyer can help you run, and run defensibly. A lawyer can help you work out whether an incident meets the eligible data breach definition, sequence a 30-day assessment so it stays within the limit, draft the statement and notifications to comply with s 26WK and s 26WL, and engage with the OAIC where the regulator has questions or issues a direction.

When the stakes involve financial penalties of the size in s 13G, the cost of external advice on a genuinely serious breach is usually small against the cost of getting the judgement wrong.

The decision you should make now

The single most common mistake under the NDB scheme is treating a suspected breach as internal bad news and working through it informally, only to find the 30-day assessment clock has run and the OAIC is asking why there is no record of a timely assessment. Before an incident happens, confirm whether your business is in scope and write down who will own the response and what the assessment process looks like. If a breach does occur, the first action is to contain it and start the clock-conscious assessment, not to decide quietly that it was not serious enough. That one choice, made early, is what separates a manageable notification from a regulator investigation.