Data breaches and cyber security law in Australia

By the ITLAW Team · Last reviewed November 2026 · General information, not legal advice

The Notifiable Data Breaches scheme

The NDB scheme sits in Part IIIC of the Privacy Act 1988 (Cth) and applies to every business and agency covered by the Australian Privacy Principles. See our privacy law guide to check whether you are covered.

An eligible data breach happens when three things are true:

• there is unauthorised access to, or unauthorised disclosure of, personal information, or it is lost in circumstances where that is likely to occur
• a reasonable person would conclude this is likely to result in serious harm to any of the individuals involved
• you have not been able to prevent the likely risk of serious harm through remedial action

“Serious harm” can be physical, psychological, emotional, financial or reputational. Breaches involving identity documents, financial details, health information or login credentials will often meet the threshold. Acting quickly matters: if you contain the breach and recover the data before harm is likely, notification may not be required.

Timeframes and what to notify

• Suspected breach: carry out a reasonable and expeditious assessment, and take all reasonable steps to complete it within 30 days.
• Confirmed eligible breach: notify the OAIC with a statement and notify affected individuals as soon as practicable. If notifying each person is not practicable, publish the statement on your website and take reasonable steps to publicise it.
• Content of the statement: your identity and contact details, a description of the breach, the kinds of information involved, and recommended steps individuals should take.

Ransomware and cyber extortion payments

The Cyber Security Act 2024 (Cth) is Australia’s first standalone cyber security statute. Since 30 May 2025, a business carrying on business in Australia with annual turnover above $3 million in the previous financial year must report a ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours of making it, or of becoming aware it was made on its behalf. Critical infrastructure responsible entities are covered regardless of turnover.

The report is about the payment, not a decision to pay. Making the report does not make a payment lawful, and paying a ransom may raise other legal issues, including sanctions laws. Information in a report is subject to limited-use protections, but you should still get advice before lodging.

Critical infrastructure

Entities responsible for critical infrastructure assets under the Security of Critical Infrastructure Act 2018 (Cth) have additional duties, including mandatory cyber incident reporting to the Australian Cyber Security Centre. A critical incident having a significant impact must be reported within 12 hours, and other incidents with a relevant impact within 72 hours.

Your first 72 hours: an incident checklist

• Contain: isolate affected systems, reset credentials and preserve logs and evidence.
• Call your insurer early: many cyber policies have short notification windows and panels of approved responders.
• Get legal advice: engaging lawyers early can help protect privileged communications about the incident.
• Assess: work out what data was involved and whose, and whether serious harm is likely.
• Report: lodge any ransomware payment report within 72 hours and an NDB notification as soon as practicable.
• Communicate: prepare accurate, consistent messages for customers, staff and regulators. Avoid speculation.
• Review contracts: check notification duties to customers, suppliers and banks under your agreements.

Liability after a breach

A breach can lead to OAIC investigations and civil penalties, claims by customers, including under the statutory tort for serious invasions of privacy, disputes with IT suppliers and claims under insurance policies. Directors should also be aware that cyber risk is increasingly treated as part of their duty of care and diligence.

Frequently asked questions

How long do I have to report a data breach in Australia?

There is no fixed number of days for notifying an eligible data breach: it must be done as soon as practicable. If you only suspect a breach, you must take reasonable steps to assess it within 30 days.

Do I have to report a ransomware payment?

Yes, if your business had annual turnover above $3 million in the previous financial year or is a critical infrastructure responsible entity. The report goes to the Australian Signals Directorate within 72 hours.

Is it illegal to pay a ransom in Australia?

Paying a ransom is not generally prohibited, but it must be reported if you are covered, and a payment to a sanctioned person or entity can be an offence. Get advice before paying.

Who enforces the Notifiable Data Breaches scheme?

The Office of the Australian Information Commissioner (OAIC).

Further reading: OAIC: Notifiable Data Breaches · cyber.gov.au: report and recover