Is this data breach notifiable? How the NDB scheme works

Not every data breach has to be reported, but the ones that do have firm rules. This guide explains when a breach is an eligible data breach under the Privacy Act, who the scheme covers, what you must tell the OAIC and affected people, and what to do in the first 72 hours.

General information, not legal advice. If you think you’ve had a breach, get legal advice early.

Who has to comply with the NDB scheme?

The Notifiable Data Breaches (NDB) scheme is Part IIIC of the Privacy Act 1988. It applies to entities that have to protect personal information under the Privacy Act:

• APP entities: Australian Government agencies and organisations (companies, partnerships, trusts, not-for-profits) that aren’t small business operators.
• Credit reporting bodies and credit providers, for credit information they hold.
• Tax file number recipients, for TFN information. This can capture small employers that would otherwise be exempt, for their TFN records.

The small business exemption. A business is generally a "small business" if its annual turnover for the previous financial year was A$3 million or less (section 6D). But an entity is not a small business operator, and so is covered, if it:

• provides a health service and holds health information (other than in employee records);
• discloses personal information for a benefit, service or advantage, or pays to collect it (trading in personal information);
• is a contracted service provider for a Commonwealth contract;
• is a credit reporting body;
• has had turnover above A$3 million in any financial year since it started (or since the section commenced); or
• is a body corporate related to a business that isn’t a small business.

Some small businesses are also brought in by section 6E, for example where they are reporting entities under anti-money laundering law. If you’re a small medical practice, allied health clinic, or a subcontractor on a federal government contract, assume the scheme applies to you.

What makes a breach an "eligible data breach"?

Section 26WE sets three elements. All must be present.

1. Unauthorised access, unauthorised disclosure or loss. Someone accessed or saw information they shouldn’t have (a hacker, a curious staff member), it was given to the wrong person (an email or mail-out to the wrong address, an exposed cloud folder), or it was lost in circumstances where unauthorised access or disclosure is likely (an unencrypted laptop left in a taxi).

2. Likely to result in serious harm. A reasonable person would conclude the access or disclosure would be likely to result in serious harm to any of the individuals the information relates to. The OAIC explains that serious harm can include serious physical, psychological, emotional, financial or reputational harm, and that "likely" means more probable than not, rather than merely possible.

3. No successful remedial action. Under section 26WF, if you act before serious harm occurs and, as a result, a reasonable person would conclude serious harm is no longer likely, it is not (and is taken never to have been) an eligible data breach. For a lost device, if you act before anyone accesses the information and as a result there’s no unauthorised access, it isn’t one either.

A common example of remedial action: a spreadsheet of client details is emailed to the wrong external recipient, who is a known, trusted contact; you reach them quickly, they confirm in writing they’ve deleted it unopened, and you have no reason to doubt them. Contrast that with the same spreadsheet sent to an unknown Gmail address that doesn’t reply.

How do you judge "serious harm"?

Section 26WG lists the matters to weigh:

The combination matters more than any single factor. A small number of records can be serious (health information about a few people); a large number of low-sensitivity records may not be.

Is this breach notifiable? Use the helper

The helper walks you through the same tests in order: whether the scheme covers you, whether personal information is involved, what happened, serious harm, remedial action and the exceptions. Each step appears only when it is needed, and "not sure" is always an option. You get one of three results (likely notifiable, needs assessment, or likely not notifiable) with the reasons, next steps and OAIC links. If you enter the date you became aware, it also shows the end of the 30-day assessment window. It runs in your browser, sends and stores nothing, and is indicative only: general information, not legal advice or a formal assessment.

What if you're not sure yet? The 30-day assessment

Section 26WH applies when you're aware of reasonable grounds to suspect an eligible data breach but not yet to believe one has happened. You must:

• carry out a reasonable and expeditious assessment of whether there are reasonable grounds to believe it's an eligible data breach; and
• take all reasonable steps to complete it within 30 days after becoming aware of the grounds for suspicion.

Thirty days is a ceiling, not a target. The OAIC's quick reference guide says to "quickly assess the situation". If, partway through, you reach reasonable grounds to believe it's eligible, the notification duties start then; you don't wait out the 30 days.

Check: write down the date and time you first became aware of the grounds for suspicion. That is the start of your 30 days, and the OAIC's form will ask about your timeline.

Who do you notify, and what must you say?

Once you're aware of reasonable grounds to believe there has been an eligible data breach, sections 26WK and 26WL require you to:

1. Prepare a statement and give it to the OAIC as soon as practicable, using the OAIC's online Notifiable Data Breach form.
2. Notify individuals as soon as practicable after the statement is prepared.

The statement must set out (section 26WK(3)):

• your identity and contact details;
• a description of the eligible data breach;
• the kinds of information concerned; and
• recommendations about the steps individuals should take in response.

If other organisations were part of the same breach (for example, your outsourced payroll provider), the statement may name them too. Only one of the entities involved needs to notify; agree who will do it.

A statement that doesn't include the four required items contravenes section 13K(2), a civil penalty provision with a maximum of 200 penalty units and one for which the OAIC can issue infringement notices. See the penalties section below for the rest.

Ways to notify individuals (section 26WL):

1. if practicable, notify everyone whose information was involved; or
2. if practicable, notify only the individuals at risk of serious harm; or
3. if neither is practicable, publish the statement on your website and take reasonable steps to bring it to the attention of the people at risk.

You can use the way you normally communicate with each person (email, SMS, letter). The OAIC also asks you to attach your template notification to individuals when you submit its form.

Check: your notice tells people specifically what to do: change a particular password, watch for phishing that quotes their details, contact IDCARE, ask their bank to monitor the account, or replace an identity document. "Remain vigilant" on its own isn't a recommendation.

What are the penalties?

Getting the NDB steps wrong is more than a paperwork problem. Under section 13(4A), failing to assess a suspected breach (section 26WH(2)), to give the OAIC a statement (section 26WK(2)) or to notify individuals (section 26WL(3)) is treated as an interference with the privacy of an individual. Since the 2024 amendments, the Privacy Act has three tiers of civil penalty:

A Commonwealth penalty unit is A$364 for contraventions from 1 July 2026. Under the Regulatory Powers Act, the maximum for a body corporate is generally five times the listed number of units (section 13G sets its own corporate figures instead). Courts set the actual penalty, and the OAIC can also use other tools, such as compliance notices and enforceable undertakings.

The first 72 hours: a response checklist

This checklist follows the OAIC's four steps (contain, assess, notify, review). It is a practical planning aid, not legal advice, and 72 hours is not a legal deadline under the NDB scheme. If a ransom has been paid, a separate 72-hour legal deadline may apply; see ransomware payment reporting.

Hours 0 to 4: Contain

• Start an incident log: what happened, when you found out, who knows, every action taken, with times.
• Stop the leak: disable compromised accounts, reset passwords and revoke sessions and tokens, close the public link, recall the email, remotely wipe the lost device.
• Preserve evidence: don't rebuild servers or delete mailboxes until logs are copied.
• Notify your insurer if you have cyber cover, following the notification terms in your policy.
• Brief the decision-maker: owner, CEO or board chair.

Hours 4 to 24: Assess

• Identify what information was involved, about whom, and roughly how many people.
• Work through the serious harm factors in the table above, and record your reasoning.
• Check whether encryption keys or passwords were also exposed.
• Check whether other organisations hold or share the same data (vendors, partners, a parent company).
• Consider remedial action that could make serious harm unlikely, and do it now.
• Get legal advice on whether you have reasonable grounds to believe it's an eligible data breach.

Hours 24 to 72: Prepare to notify

• If you believe it's eligible: draft the OAIC statement (the four items) and the notice to individuals.
• Decide which notification option applies: everyone, those at risk, or publish.
• Prepare a short script and FAQ for staff who answer phones and emails.
• Check other obligations: ransomware payment report, sector regulators, contracts with government or corporate clients, and reporting the incident to ASD at cyber.gov.au.
• If you still only suspect a breach, set the date by which the assessment will be finished (inside 30 days) and who owns it.

After notification: Review

• Run a post-incident review: root cause, what slowed you down, which controls would have prevented it.
• Delete personal information you no longer need. You can't lose what you don't hold.
• Update your data breach response plan and test it with a short tabletop exercise.

What do the latest NDB statistics show?

The OAIC publishes statistics every six months. Its release of 26 October 2026, covering January to June 2026, reported:

• 667 notifications, up slightly from 662 in the previous six months.
• Breaches affecting more than 1,000,000 people worldwide rose from 4 to 11. Those affecting 100,000 to 250,000 doubled from 3 to 6, and those affecting 500,000 to 1,000,000 went from none to 3.
• Malicious or criminal attacks remained the most common cause.
• Health service providers notified the most (149), followed by education (85), business and professional associations (79), and financial services and personal services (51 each).
• More than half of notified breaches were identified within 10 days, and the proportion taking more than 30 days to identify fell.

For the 2025 calendar year the OAIC received 1,205 notifications, an 8% increase on 2024 (1,112) and the highest annual number since the scheme began; 716 of them were attributed to malicious or criminal activity.

The most useful line in the release for small organisations comes from Privacy Commissioner Carly Kind: "Organisations can't lose personal information they don't hold." Deleting what you no longer need is one of the cheapest breach controls there is.

Key takeaways

• A breach is notifiable when there's unauthorised access, disclosure or likely-exposing loss, serious harm is likely, and remedial action hasn't removed that likelihood.
• Suspected breaches must be assessed quickly and within 30 days; confirmed eligible breaches must be notified as soon as practicable.
• The OAIC statement and notices to individuals must cover four things: who you are, what happened, what information was involved, and what people should do.
• The small business exemption has wide exceptions, including health service providers, Commonwealth contractors and TFN information.
• Write your timeline and reasoning down from the first hour; it's what the OAIC, insurers and lawyers will ask for.
• Hold less data. Notifications hit a record in 2025 and large breaches climbed sharply in early 2026.

Sources

• Privacy Act 1988, Part IIIC (sections 26WE to 26WL), sections 6D, 13(4A), 13G, 13H and 13K, Federal Register of Legislation
• Crimes (Amount of a Penalty Unit) Instrument 2026 and Regulatory Powers (Standard Provisions) Act 2014, section 82, Federal Register of Legislation
• About the Notifiable Data Breaches scheme, OAIC
• When to report a data breach, OAIC
• Report a data breach, OAIC
• Quick reference guide for responding to data breaches, OAIC
• Data breach preparation and response, OAIC
• Large scale data breaches on the rise, latest OAIC statistics reveal, OAIC, 26 October 2026 (January to June 2026)
• Data breach notifications increase to all-time high in 2025, new NDB stats show, OAIC (calendar year 2025)
• Notifiable data breach statistics dashboard, OAIC