Under the Notifiable Data Breaches (NDB) scheme, organisations covered by the Privacy Act 1988 must notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to cause serious harm.
Who it applies to
The scheme applies to organisations covered by the Privacy Act. That generally includes businesses and not-for-profits with annual turnover above $3 million, Australian Government agencies, and some smaller businesses, such as health service providers and businesses that trade in personal information.
What is an eligible data breach?
- Personal information is accessed or disclosed without authorisation, or lost in a way that makes this likely.
- The breach is likely to result in serious harm to one or more individuals.
- Your remedial action has not prevented that likely harm.
The 30-day assessment
If you suspect an eligible breach, you must carry out a reasonable and quick assessment within 30 days. The OAIC expects most assessments to be finished much sooner.
How to prepare
- Write a simple data breach response plan and name who does what.
- Know where personal information is stored, and keep less of it.
- Turn on multi-factor authentication and email protection.
- Keep tested backups and logs so you can tell what happened.
- Train staff to report suspicious emails and mistakes quickly.
This article is general information, not legal advice. See the OAIC website for official guidance. Our cybersecurity service can help you reduce the risk of a breach.