Not every data breach has to be reported, but the ones that do have firm rules. This guide explains when a breach is an eligible data breach under the Privacy Act, who the scheme covers, what you must tell the OAIC and affected people, and what to do in the first 72 hours.<\/p>\n\n\n\n
Related guides<\/strong><\/p>\n\n\n\n General information, not legal advice. If you think you’ve had a breach, get legal advice early.<\/p>\n\n\n\n The Notifiable Data Breaches (NDB) scheme is Part IIIC of the Privacy Act 1988. It applies to entities that have to protect personal information under the Privacy Act:<\/p>\n\n\n\n The small business exemption.<\/strong> A business is generally a "small business" if its annual turnover for the previous financial year was A$3 million or less (section 6D). But an entity is not<\/em> a small business operator, and so is covered, if it:<\/p>\n\n\n\n Some small businesses are also brought in by section 6E, for example where they are reporting entities under anti-money laundering law. If you’re a small medical practice, allied health clinic, or a subcontractor on a federal government contract, assume the scheme applies to you.<\/p>\n\n\n\n Section 26WE sets three elements. All must be present.<\/p>\n\n\n\n 1. Unauthorised access, unauthorised disclosure or loss.<\/strong> Someone accessed or saw information they shouldn’t have (a hacker, a curious staff member), it was given to the wrong person (an email or mail-out to the wrong address, an exposed cloud folder), or it was lost in circumstances where unauthorised access or disclosure is likely (an unencrypted laptop left in a taxi).<\/p>\n\n\n\n 2. Likely to result in serious harm.<\/strong> A reasonable person would conclude the access or disclosure would be likely to result in serious harm to any of the individuals the information relates to. The OAIC explains that serious harm can include serious physical, psychological, emotional, financial or reputational harm, and that "likely" means more probable than not, rather than merely possible.<\/p>\n\n\n\n 3. No successful remedial action.<\/strong> Under section 26WF, if you act before serious harm occurs and, as a result, a reasonable person would conclude serious harm is no longer likely, it is not (and is taken never to have been) an eligible data breach. For a lost device, if you act before anyone accesses the information and as a result there’s no unauthorised access, it isn’t one either.<\/p>\n\n\n\n A common example of remedial action: a spreadsheet of client details is emailed to the wrong external recipient, who is a known, trusted contact; you reach them quickly, they confirm in writing they’ve deleted it unopened, and you have no reason to doubt them. Contrast that with the same spreadsheet sent to an unknown Gmail address that doesn’t reply.<\/p>\n\n\n\n Section 26WG lists the matters to weigh:<\/p>\n\n\n\n The combination matters more than any single factor. A small number of records can be serious (health information about a few people); a large number of low-sensitivity records may not be.<\/p>\n\n\n\n The helper walks you through the same tests in order: whether the scheme covers you, whether personal information is involved, what happened, serious harm, remedial action and the exceptions. Each step appears only when it is needed, and "not sure" is always an option. You get one of three results (likely notifiable, needs assessment, or likely not notifiable) with the reasons, next steps and OAIC links. If you enter the date you became aware, it also shows the end of the 30-day assessment window. It runs in your browser, sends and stores nothing, and is indicative only: general information, not legal advice or a formal assessment.<\/p>\n\n\n\n\n\n
TL;DR<\/h3>\n\n\n\n
\n\n
In this post<\/h3>\n\n\n\n
\n\n
\n\n\n\nWho has to comply with the NDB scheme?<\/h2>\n\n\n\n
\n\n
\n\n
\n\n\n\nWhat makes a breach an "eligible data breach"?<\/h2>\n\n\n\n
How do you judge "serious harm"?<\/h3>\n\n\n\n
\n\n
\n \nFactor<\/th>\n Questions to ask<\/th>\n<\/tr>\n<\/thead>\n \n Kind of information<\/td>\n Identity documents, financial, health, TFN, passwords, location, children’s information?<\/td>\n<\/tr>\n \n Sensitivity<\/td>\n Would exposure cause distress, discrimination or danger (for example, a person escaping family violence)?<\/td>\n<\/tr>\n \n Security measures<\/td>\n Was the information encrypted or otherwise protected?<\/td>\n<\/tr>\n \n Could those measures be overcome?<\/td>\n Was the encryption key, password or token taken too?<\/td>\n<\/tr>\n \n Who has (or could get) it<\/td>\n A criminal group, the public, a single known recipient, a staff member?<\/td>\n<\/tr>\n \n Their likely intent<\/td>\n Any sign they intend to misuse it, sell it or publish it?<\/td>\n<\/tr>\n \n Nature of the harm<\/td>\n Identity theft, financial loss, fraud, humiliation, physical risk?<\/td>\n<\/tr>\n \n Anything else relevant<\/td>\n Number of people, how long it was exposed, whether it’s already been published<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n
\n\n\n\nIs this breach notifiable? Use the helper<\/h2>\n\n\n\n