Notifiable Data Breaches scheme: a practical guide for Australian businesses

The most common questions are whether a breach is actually notifiable, when the 30-day clock starts and who must be told. Exceptions, penalty tiers and overlapping ransomware-reporting duties create fewer public questions but carry high compliance risk.

• Business or not-for-profit with annual turnover above $3 million — The entity is generally covered by the Privacy Act and must comply with Part IIIC for personal information it holds.
• Small business with annual turnover of $3 million or less — Check the statutory exceptions before assuming exemption, including health services, tax file numbers, credit reporting, trading in personal information and opting in.
• Entity already subject to APP 11 — If the entity has an APP 11 obligation to secure personal information, it must also comply with the NDB scheme.

The organisation must immediately escalate every suspected loss, unauthorised access or unauthorised disclosure of personal information to the Privacy Officer. The Privacy Officer must determine whether the organisation and the affected information are covered by Part IIIC of the Privacy Act 1988 and, where covered, must commence and document the required NDB assessment without waiting for proof that serious harm has occurred.

• Covered entity with confirmed unauthorised access or disclosure — Assess likely serious harm and the effect of remedial action; confirmation of access alone does not finish the legal test.
• Covered entity that has lost information or a device — The loss limb is engaged where unauthorised access to or disclosure of the information is likely to occur.
• Incident below the eligible-breach threshold — Contain, record and review it even if Part IIIC notification is not required, and check other legal or contractual reporting duties.

An incident is an eligible data breach only if: (1) personal information held by the organisation was accessed or disclosed without authority, or was lost in circumstances where unauthorised access or disclosure is likely; (2) a reasonable person would conclude that serious harm to one or more individuals is likely; and (3) remedial action has not prevented the likely risk of serious harm. The assessment must address and document each element separately.

• Breach involving identity, health, financial or government-identifier information — The sensitivity and misuse potential generally increase the likelihood or consequence of serious harm.
• Breach affecting a person experiencing vulnerability — Consider circumstances such as family violence, physical safety, financial hardship and whether the information could expose or locate the individual.
• Encrypted or otherwise protected information — Assess the strength of the protection, whether the key or credential was also compromised, and whether the recipient can or intends to overcome it.

The serious-harm assessment must be made objectively from the position of a properly informed reasonable person in the organisation's circumstances. The assessor must consider whether serious harm is more probable than not, the sensitivity and combination of information involved, existing security protections and the likelihood they can be overcome, the identity and likely intentions of recipients, the circumstances of affected individuals, the possible physical, psychological, emotional, financial and reputational consequences, and all other relevant matters under section 26WG.

• Covered entity with reasonable grounds to suspect an eligible breach — Record the date and time of awareness, appoint an assessor and begin reasonable inquiries immediately.
• Assessment reaches reasonable belief before day 30 — Move to the notification duties immediately; the remaining assessment period is not available as extra notification time.
• Assessment cannot be completed within 30 calendar days — Continue urgently and document the steps taken, reasons for delay and why those steps were reasonable; the statutory maximum has still been missed.

When any responsible employee or officer becomes aware of information creating reasonable grounds to suspect an eligible data breach, the Privacy Officer must record the awareness date and time and commence a reasonable and expeditious assessment. All reasonable steps must be taken to finish the assessment within 30 calendar days. The organisation must aim to conclude earlier and must not wait for day 30, complete forensics, executive confirmation or proof of actual harm before progressing the assessment or notification decision.

• Entity able to identify every person whose information was involved — It may notify all of those individuals using reasonable steps and a communication method suited to the circumstances.
• Entity able to identify only people at likely risk of serious harm — It may notify that at-risk group rather than every person whose information appeared in the incident.
• Direct notification is impracticable — Publish the statement on the entity's website, if any, and take reasonable steps to publicise its contents.

As soon as the organisation has reasonable grounds to believe an eligible data breach occurred, it must prepare and submit the section 26WK statement to the OAIC as soon as practicable and notify affected individuals as soon as practicable after the statement is prepared. The notification method must follow section 26WL: notify all relevant individuals, notify only those at likely risk of serious harm, or, where neither direct option is practicable, publish the statement and take reasonable steps to publicise it.

• Single entity responsible for the breach — Identify the entity and a monitored contact point that affected individuals and the OAIC can use.
• Breach involving jointly held information or multiple entities — The statement may identify the other entities, and the parties should coordinate a single accurate account and practical recommendations.
• Facts are still developing — State what is known, distinguish estimates from confirmed facts and update communications where material information changes.

Every statement submitted under section 26WK must contain: (1) the organisation's legal identity and current contact details; (2) a plain-English description of the eligible data breach; (3) the particular kind or kinds of personal information involved; and (4) practical recommendations about steps individuals should take. The statement must be accurate, must distinguish confirmed facts from estimates and must provide enough detail for individuals to understand and reduce the risk of harm.

• Successful remedial action — Notification is not required for individuals whose likely serious harm was actually prevented; retain evidence showing why the action was effective.
• Multiple entities jointly hold the affected information — One entity may assess and notify for the group, but responsibilities and information sharing should be agreed immediately and recorded.
• Enforcement, secrecy, Commissioner declaration or My Health Record issue — Apply the precise statutory provision and obtain specialist advice because each exception has limited scope and conditions.

No person may rely on an NDB exception without a documented decision approved by the Privacy Officer and, where appropriate, legal advice. The decision record must identify the statutory exception, affected individuals and information, supporting evidence, the effectiveness and timing of remedial action, any other entity undertaking assessment or notification, and any residual duties. An attempted recall, deletion request, confidentiality assurance or small number of affected people is not by itself sufficient.

• Serious interference with privacy — The highest corporate maximum is the greater-of formula in section 13G, with seriousness assessed from statutory factors and the circumstances.
• Interference not established as serious — Section 13H creates a lower civil penalty tier capped at 2,000 penalty units.
• NDB statement missing mandatory content — Section 13K creates a specific 200-penalty-unit tier and permits infringement or compliance notices.

The organisation must preserve a complete decision record for every suspected or eligible data breach, including awareness times, assessment steps, evidence, legal advice, remedial action, notification decisions, statement versions and communications. Delaying, concealing, providing incomplete mandatory information or failing to comply with an OAIC requirement may constitute an interference with privacy and expose the organisation to investigation, directions, determinations, enforceable undertakings, injunctions and civil penalty proceedings.

• Covered business that makes a ransomware or cyber-extortion payment — Start the 72-hour Cyber Security Act clock at payment, or when the entity becomes aware a payment was made on its behalf.
• Ransomware incident involving personal-information theft — Run the NDB serious-harm assessment and the separate payment-reporting analysis in parallel; the clocks have different triggers.
• Cyber extortion demand with no payment — The mandatory Cyber Security Act payment report is not triggered, but NDB and other incident-reporting duties may still apply.

For every cyber incident, the Incident Lead must maintain a reporting matrix that separately records the trigger, awareness time, decision-maker, deadline, recipient and submission status for the Privacy Act NDB scheme, the Cyber Security Act ransomware-payment regime, the Security of Critical Infrastructure Act, sector regulators, contracts, insurance and any other applicable requirement. A covered ransomware or cyber-extortion payment must be reported within 72 hours even while the NDB assessment continues. No report is treated as satisfying another obligation unless the relevant law expressly provides that result.

This guide and its templates are a professionally drafted starting point, not legal advice. Your obligations depend on your industry, your contracts and your data. Have a qualified adviser review anything high stakes before you rely on it.