Drag
loader

Contact info

Email
hello@ferressystems.com.au
Based in
Melbourne, Victoria

Follow us

Talk to the team
Talk to the team
All field notes

2026-06-18 // NOTE // 4 MIN READ

Notifiable data breaches: when an Australian business must report

When a data breach must be reported under Australia's Notifiable Data Breaches scheme, who the rules cover, the 30-day assessment window, and the steps to take if it happens to you.

If personal information has gone somewhere it should not, the first question is rarely “how did this happen.” It is “do we have to tell anyone.” This guide answers that for Australian businesses, in plain English.

THE SHORT VERSION
  • Australia's Notifiable Data Breaches (NDB) scheme sits under the Privacy Act 1988 and is administered by the OAIC.
  • You must notify when there is an eligible data breach: personal information is accessed, disclosed or lost in a way likely to cause serious harm, and you cannot prevent that harm.
  • You have 30 days to assess a suspected breach. Health providers are covered regardless of size, which catches many allied health practices by surprise.

Who the scheme covers

The NDB scheme applies to organisations already covered by the Privacy Act, known as APP entities. The common triggers for a business being covered are:

Turnover over $3MMost businesses above this annual threshold are covered.
Any health providerHealth service providers are covered at any size, including sole practitioners.
Handles tax file numbersHolding TFN information brings obligations regardless of turnover.
Trades in personal infoBuying or selling personal information brings you in.
Common ways a business becomes an APP entity. This is a guide, not legal advice; check your specific position.

The one that catches people out is health. A small allied health clinic, a physiotherapist, a psychology practice: all are health service providers, and all are covered no matter how small. If that is you, the scheme applies today.

Is it a notifiable data breach? The decision

Not every incident is notifiable. The test has three parts, and you work through them in order.

1. Was personal information accessed, disclosed or lost?A lost laptop, a misdirected email, a compromised mailbox, a ransomware event. If no personal information was involved, the scheme does not apply.
2. Is serious harm likely?Consider the sensitivity of the information, whether it was protected, and who could access it. Identity theft, financial loss, physical safety and serious distress all count.
THE OUT3. Can you prevent the harm in time?If quick remedial action means serious harm is no longer likely, for example a remote wipe of an encrypted device, it may no longer be an eligible breach.
NOT LIKELYDocument and monitorRecord your assessment and reasoning. You may not need to notify, but keep the evidence.
LIKELYNotify the OAIC and individualsAs soon as practicable, with what happened, what you have done, and what people should do.
The eligible data breach test. Three questions, worked in order. When in doubt, assess formally and write it down.

The 30-day clock

The moment you have reasonable grounds to suspect an eligible data breach, a clock starts. You must complete a reasonable and expeditious assessment within 30 calendar days.

Thirty days sounds generous until you are inside an incident, trying to work out which mailbox was accessed and what was in it. This is exactly why the forensic detail matters, and why an incident that is investigated properly from the first hour is worth so much more than one you piece together later. It is the difference our managed security service is built around.

What to do if it happens

Contain firstStop the exposure. Cut the access, isolate the device, reset the credentials.
Assess what was actually exposedEstablish whose information, what type, and whether serious harm is likely. Preserve the evidence.
Notify if requiredPrepare a clear statement for the OAIC and affected individuals. Plain English beats legalese here.
Fix the causeClose the path in so the same breach cannot recur, and record what changed.
A calm sequence beats a scramble. Deciding notification is far easier when the investigation was clean.

The best notification is one you never send

Most notifiable breaches trace back to a control that was missing: a mailbox without multi-factor authentication, an unpatched system, a backup that could not be restored. The same Essential Eight baseline that keeps insurers happy is what keeps you out of the notification process in the first place.

If you hold personal or health information and you are not certain where you stand, that is worth a plain conversation before anything goes wrong. Get in touch and we will walk through it with you.

This article is general information, not legal advice. For advice on your specific obligations, consult a qualified privacy lawyer or the OAIC.

Frequently asked questions

Does my small business have to report a data breach in Australia?

It depends on whether you are covered by the Privacy Act. Businesses with annual turnover above three million dollars are generally covered, but so are many smaller businesses, including all health service providers regardless of size, and any business that trades in personal information or handles tax file numbers.

What is an eligible data breach?

An eligible data breach is unauthorised access to, unauthorised disclosure of, or loss of personal information that a reasonable person would conclude is likely to result in serious harm to any affected individual, where you have not been able to prevent that harm through remedial action.

How long do I have to report a data breach to the OAIC?

Once you become aware of reasonable grounds to suspect an eligible data breach, you must carry out an assessment within 30 calendar days. If the assessment confirms an eligible breach, you must notify the OAIC and affected individuals as soon as practicable.

What happens if I do not report a notifiable breach?

Failing to comply with the Notifiable Data Breaches scheme can lead to investigation and significant civil penalties under the Privacy Act, alongside the reputational damage of being seen to have concealed a breach. Reporting properly is almost always the better position.

Does notifying customers make the breach look worse?

Handled well, notification builds trust rather than destroying it. A clear, plain-English notice that explains what happened, what you have done and what the person should do reassures people far more than silence, which tends to surface later and worse.

privacycomplianceincident response
Share:
WRITTEN BY George Ferres Founder and Principal

Questions this raised? Ask us.

Get in touch
Shapes Shapes