Do I have to report a data breach? The Notifiable Data Breaches scheme explained

After a cyber incident, one of the first questions a business owner asks is: “Do we have to tell anyone?” In Australia, the answer often turns on the Notifiable Data Breaches (NDB) scheme under the Privacy Act.

This is a general guide, not legal advice. If you’ve had a breach, speak to a lawyer. But understanding the basics helps you ask the right questions early.

Who does it apply to?

According to the Office of the Australian Information Commissioner, the scheme applies to organisations covered by the Privacy Act, including:

• businesses and not-for-profits with annual turnover above $3 million
• private sector health service providers, whatever their size
• credit reporting bodies and credit providers
• some smaller businesses, such as those that handle tax file numbers

So a small business with turnover under $3 million may still be covered, depending on what it does and the data it holds. Check with your lawyer or accountant if you’re unsure.

What is an “eligible data breach”?

A breach is eligible when three things are true:

1. personal information was accessed or disclosed without authorisation, or lost
2. it is likely to result in serious harm to one or more people
3. you haven’t been able to prevent that likely harm with remedial action

Serious harm can be financial, physical, psychological, emotional or reputational. “Likely” means more probable than not.

The 30-day assessment

If you suspect an eligible breach but aren’t sure, you must take reasonable steps to assess it within 30 calendar days of becoming aware of the information that raised the suspicion.

That’s where forensics matters. You can’t assess whether personal information was accessed without knowing what the attacker could see and what they did. “We reset the password” doesn’t answer the question.

If it is an eligible breach

You must notify the affected individuals and lodge a statement with the OAIC as soon as practicable. The OAIC has an online form for this.

What’s changing

The Privacy Act is under review. At the time of writing, proposals in consultation include faster notification timeframes and changes to the small business exemption, but they aren’t law yet. Check the current position with your adviser.

What to do after a suspected breach

1. Contain it. Stop the access without destroying evidence.
2. Find out what was exposed. That needs evidence, not assumptions.
3. Get legal advice early. Your lawyer can guide the assessment and protect privilege.
4. Document your steps. The OAIC may ask what you did and when.

Flare investigates what was accessed and what was taken, so you and your lawyer can make the NDB assessment on facts. Call 1300 027 401, 24/7.