The Notifiable Data Breaches scheme: assessing and notifying a breach

By the ITLAW Team · Last reviewed November 2026 · General information, not legal advice

Guides › Data Breaches & Cyber › Notifiable Data Breaches

The Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act 1988 (Cth) has applied since February 2018. It requires businesses and agencies covered by the Privacy Act to notify the OAIC and affected individuals of “eligible data breaches”. The OAIC receives hundreds of notifications every reporting period, and malicious or criminal attacks are consistently the leading cause.

Step 1: Is it a data breach?

A data breach is unauthorised access to, or unauthorised disclosure of, personal information, or loss of it in circumstances where unauthorised access or disclosure is likely. Examples include a hacked database, an email sent to the wrong person, a lost laptop or a misconfigured cloud storage bucket.

Step 2: Is serious harm likely?

Ask whether a reasonable person would conclude that the breach is likely, meaning more probable than not, to result in serious harm to any affected individual. Relevant factors include:

• the kind and sensitivity of the information, such as identity documents, financial details, health information or passwords
• whether it is protected, for example by strong encryption whose keys were not compromised
• who has or may obtain the information, such as a criminal group versus a trusted recipient
• the nature of the harm that could follow, including identity theft, financial loss, embarrassment or threats to safety

Step 3: Can remedial action prevent the harm?

If you act quickly enough to prevent serious harm, for example by recovering a misdirected email before it is opened or remotely wiping a lost device, the breach may not be notifiable. Document what you did and why you concluded harm was no longer likely.

The 30-day assessment rule

If you have reasonable grounds to suspect an eligible breach but are not sure, you must carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days.

What to notify, and to whom

• The OAIC: a statement using the OAIC’s online form, including your contact details, a description of the breach, the kinds of information involved and recommended steps for individuals.
• Individuals: notify all affected individuals, or only those at risk of serious harm, directly. If neither is practicable, publish the statement on your website and take reasonable steps to publicise it.

Where more than one entity holds the information, for example a business and its cloud provider, one notification can satisfy both entities’ obligations. Limited exceptions apply, including for some enforcement-related activities and where the Commissioner grants an exemption.

Penalties and recent reforms

Failing to notify can be an interference with privacy. The 2024 reforms gave the Minister power to issue eligible data breach declarations allowing information sharing to reduce harm after major breaches, and increased the OAIC’s enforcement tools. For response steps, see our data breach response plan.

Frequently asked questions

What makes a data breach notifiable in Australia?

A breach of personal information that is likely to result in serious harm to any affected individual, where you have not been able to prevent that harm through remedial action.

How long do I have to assess a suspected breach?

You must take all reasonable steps to complete the assessment within 30 days.

Do I have to notify every affected person?

You can notify everyone, or only those at risk of serious harm. If direct notification is not practicable, you must publish a statement and publicise it.

← Back to the Data Breaches & Cyber guide