Australia · Office of the Australian Information Commissioner (OAIC) · OAIC NDB

Notifiable Data Breaches Scheme

Mandatory notification of eligible data breaches likely to cause serious harm to individuals.

What it is

The NDB scheme is part of the Privacy Act 1988 and covers all APP entities. An eligible data breach means unauthorised access, disclosure or loss of personal information likely to cause serious harm. If an entity has reasonable grounds to believe one occurred, it must promptly notify affected individuals and the OAIC. If it only suspects a breach, it has 30 days to assess whether notification is required. Security programs should fit detection, containment and decision-making inside that window.

Who it applies to

Any entity covered by the Privacy Act 1988, including APP entities, credit reporting bodies, credit providers, TFN recipients and health service providers.

Notifiable Data Breaches Scheme

Smaller businesses can be covered too.

The scheme was set up by the Privacy Amendment (Notifiable Data Breaches) Bill 2016. It applies to all government agencies and to every body the Privacy Act covers. That takes in many firms and not-for-profits that turn over more than $3 million a year.

The Privacy Act also reaches some smaller businesses.

  • Firms that handle personal data for a living

    Such as those that hold credit reports, tax file numbers and health records.

  • Firms that buy or sell personal data

    Along with credit reporting bodies.

  • Related businesses

    A business linked to one the Act already covers.

  • Private health services

    Such as doctors, pharmacists, alternative medicine, gyms and weight loss clinics.

  • Childcare and private schools

    Childcare centres, private schools and private tertiary colleges.

Failing to notify has a real cost.

Sanctions include public apologies and compensation payments of up to $360,000 for individuals and $1.8 million for organisations. There is also the risk of damage to your reputation and your business. The law aims to protect businesses that act early and deal with breaches well.

Requirements

Preventative controls

Reasonable security under APP 11 to prevent eligible data breaches.

Assessment within 30 days

Assess whether a suspected breach is likely to cause serious harm.

Remedial action

Containing the breach and mitigating harm in time may mean notification isn't required.

Notification

Notify affected individuals promptly, and give the OAIC a statement covering the breach, the information involved and the steps taken.

Sources

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.