Lose control of personal information and you may be legally required to tell both the regulator and the people affected. Australia’s Notifiable Data Breaches scheme sets out when and how. Understanding it before an incident is far better than reading it during one.
- The NDB scheme sits within the Privacy Act 1988 and is overseen by the OAIC.
- It applies to entities already covered by the Privacy Act’s security obligations.
- An eligible breach is one likely to result in serious harm that you cannot prevent through remedial action.
- You must assess suspected breaches expeditiously — generally within 30 days.
What the scheme is
The Notifiable Data Breaches (NDB) scheme is part of the Privacy Act 1988 and is administered by the Office of the Australian Information Commissioner (OAIC). It requires covered entities to notify affected individuals and the OAIC when a data breach is likely to cause serious harm. The goal is to let people take protective steps — changing passwords, watching for fraud — and to keep organisations accountable.
Who it applies to
The scheme applies to organisations already bound by the Privacy Act’s security requirements — including many businesses, and entities handling certain types of information such as tax file numbers and health records. If you are obliged to protect personal information, you are likely obliged to report eligible breaches involving it.
What counts as an eligible data breach
An eligible data breach arises when three things hold:
- There is unauthorised access to, disclosure of, or loss of personal information.
- This is likely to result in serious harm to any affected individual.
- You have not been able to prevent that harm through remedial action.
That third point matters: if you can contain the breach so serious harm is no longer likely, notification may not be required.
The timeline
If you suspect an eligible breach, you must carry out a reasonable and expeditious assessment, generally within 30 days. If you confirm it is eligible, you must promptly notify the OAIC and affected individuals with prescribed details, including the nature of the breach and recommended steps.
Where backups come in
Backups will not prevent unauthorised access, but they directly support the "remedial action" and recovery side. If data is destroyed or ransomed, a clean backup lets you restore and demonstrate continuity. Good records also help you assess what was affected — and being able to show tamper-evident, retained copies strengthens your overall privacy posture. Pair this with disciplined access hygiene to reduce the chance of a breach in the first place.