No matter your industry, if your business collects or handles personal information in Australia, you’ve probably heard about the importance of managing data responsibly. But did you know that Australia has strict laws around what you need to do if your business experiences a data breach? Whether you’re launching a new startup or growing a well-established company, understanding your notification obligations is critical - and breaches can happen to anyone, no matter how careful you are.
If the thought of navigating privacy compliance seems daunting, you’re not alone! The good news is that with the right knowledge and a proactive approach, you can set up your business to meet the requirements, protect your customers, and steer clear of costly legal risks. In this guide, we’ll break down data breach notification Australia laws in plain English. We’ll also walk you through the legal steps, outline your responsibilities, and answer the key questions small business owners ask the most.
Let’s take a closer look at how you can ensure your business stays compliant with mandatory breach notification rules - and what you need to do if something goes wrong.
What Is a Data Breach and Why Does It Matter?
A data breach occurs when personal information held by your business is lost, accessed, or disclosed without authorisation. This can happen in all sorts of ways - think a lost laptop with client details, a cyber attack, an email sent to the wrong recipient, or even a misconfigured cloud database.
Data breaches are more than just an IT headache. For any business governed by the Privacy Act 1988 (Cth), the consequences can include legal penalties, regulatory investigations, loss of customer trust, and serious reputational harm. That’s why, under Australian law, some breaches must be reported quickly and transparently. These are known as notifiable data breaches.
What Is the Notifiable Data Breaches (NDB) Scheme?
Since February 2018, Australia’s Notifiable Data Breaches (NDB) scheme has made it mandatory for certain businesses and organisations to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) if there’s a data breach that’s likely to result in serious harm.
This is often called the “mandatory breach notification” requirement. The scheme aims to increase transparency around breaches, encourage better security, and give individuals a chance to protect themselves from the risk of harm (like identity theft or financial loss).
But when does a breach become 'notifiable'"And who exactly does the law apply to"
Which Businesses Must Comply With Data Breach Notification Laws?
Not all Australian businesses are covered by the NDB scheme, but the vast majority of small and medium-sized enterprises (SMEs) that collect personal data must pay attention. Under the Privacy Act, the NDB obligations apply to:
- Businesses and not-for-profits with an annual turnover of more than $3 million
- All businesses that provide health services (regardless of turnover)
- Businesses that trade in personal information (e.g. data brokers, marketers)
- Small businesses contracted to provide services to the Australian government
- Other specific types of businesses, like credit reporting agencies and tax file number recipients
If you're unsure whether your business is covered, it's a good idea to review the specific rules or consult a privacy law specialist for personalised advice.
Does the NDB Scheme Cover Small Businesses?
Most businesses with under $3 million turnover are exempt, unless they fall into one of the above categories. However, even small businesses often choose to comply voluntarily - or may find themselves required to by customer contracts or when dealing with larger partners.
What Counts as an “Eligible Data Breach” in Australia?
Not every minor slip-up triggers a notification requirement. For notification to be mandatory, the breach must meet the threshold of an eligible data breach. This means:
-
There is unauthorised access to, disclosure of, or loss of personal information that your business holds; and
-
This is likely to result in serious harm to one or more individuals; and
-
You have not been able to prevent that harm by taking remedial action.
Let’s break that down:
-
Personal information includes a person’s name, address, phone number, health records, or any data that can reasonably identify someone.
-
Serious harm covers things like identity theft, financial loss, physical harm, or threats to someone’s safety, reputation, or privacy.
-
Remedial action means fixing the problem quickly enough that there’s no longer a risk of harm (for example, recalling an email before it’s opened).
If the breach does not meet all of these criteria, you do not have to give formal notification under the NDB scheme. But you should still have processes in place to manage and record all data breaches, whether notifiable or not.
What Are the Steps for Data Breach Notification in Australia?
If you think your business has suffered a data breach, time is of the essence. Here’s what every business owner should know about the NDB process.
1. Investigate Quickly
As soon as you suspect a breach, act swiftly. Assess the breach, work out what personal information is involved, and determine whether serious harm is likely.
If possible, contain the breach and fix any security weaknesses. If you do this fast enough and prevent the likelihood of serious harm, you may not need to notify (but always document your decision-making process).
3. Notify Affected Individuals and the OAIC
If you decide the breach is “notifiable”, you must:
- Alert individuals at risk of serious harm, telling them what happened, what information was involved, and what steps they should take
- Submit a statement to the Office of the Australian Information Commissioner (OAIC) via their required form
You can notify affected people directly (e.g. by email, mail, or phone), or (in some cases) via a public statement on your website.
4. Keep Records and Follow Up
Record all details of the incident, your investigation, and notification. Review your security and privacy practices to reduce the risk of future breaches.
For extra guidance on assembling your plan, see our step-by-step guide to creating a data breach response plan.
How Can My Business Prepare for a Data Breach Notification?
The best time to prepare for a breach is before one happens. Here are a few actionable steps you can take:
-
Implement a data breach response plan: A written plan outlines exactly how your team should react, who’s responsible for what, and how notifications will take place. Get started with our Data Breach Notification services.
-
Review your Privacy Policy and practices: Make sure your Privacy Policy is up-to-date, and that employees know how to handle personal information safely.
-
Keep staff trained: Regular training helps everyone spot security risks and respond appropriately - minimising the chance of a breach occurring in the first place.
-
Maintain good records: Log data breaches (including ‘near-misses’) and your responses. Good records demonstrate your commitment to compliance if you’re ever investigated.
-
Engage legal help early: If you’re not sure whether you need to notify, or want help with your response, our privacy legal experts can guide you.
What Are the Consequences of Breaching Data Notification Laws in Australia?
Failing to properly notify can come with serious downsides. Under the Privacy Act, if your business does not comply with the NDB scheme, you risk:
- Regulator investigations: The OAIC can launch an inquiry, require you to hand over documents, and make recommendations for your business.
- Enforceable undertakings or directions: You may be required to implement new privacy measures, change your processes, or provide remedies to affected people.
- Financial penalties: For serious or repeated interferences with privacy, including failure to notify, the OAIC can seek civil penalties - from 2023, these were increased to up to $50 million, or three times the value of any benefit obtained through the contravention.
- Reputational damage: Perhaps even more important, your customers may lose trust if they feel you failed to notify them quickly, or handled the process poorly.
In some cases, individuals affected by your breach could pursue their own claims, seek compensation, or join together for class actions. Even if penalties aren’t applied, defending an investigation or court case can be expensive and disruptive. Ultimately, proactive compliance is always safer (and cheaper) in the long run. You can read more about the consequences of breaching legislation in Australia here.
What Legal Documents and Policies Will I Need?
To build a strong foundation for privacy and data compliance, every Australian business collecting personal information should have a set of tailored legal documents and policies in place. Here are the essentials:
-
Privacy Policy: Explains how you collect, use, store, and disclose personal information. Legally required for any business bound by the Privacy Act. Learn more about Privacy Policies here.
-
Data Breach Response Plan: Lays out step-by-step procedures for responding to and managing data breaches - including how and when to notify. This is strongly recommended even for very small businesses.
-
Employee Data Handling Procedures: Internal policies and training resources for staff to understand their obligations around data handling, security, and breach reporting.
-
Website Terms & Conditions: Sets out rules for users and helps protect you if your website is involved in a data breach incident. See our guide to writing Website Terms & Conditions.
-
Third-Party Contracts: Agreements with suppliers or contractors should include data protection clauses, ensuring everyone in your supply chain is on the same page.
Not every business will need all of these documents, but many will require several. It's best practice to get legal advice so you know which documents suit your operations and risk profile.
Are There Any Other Privacy and Cybersecurity Laws I Should Know About?
The data breach notification rules exist alongside a broader network of privacy and cybersecurity laws in Australia, including:
- Australian Privacy Principles (APPs): A set of national standards enforceable under the Privacy Act. Learn more in our guide to the 13 Australian Privacy Principles.
- Australian Consumer Law (ACL): If you make misleading claims about your data security, you could be in breach of consumer protection laws too. Get the full rundown in our Australian Consumer Law (ACL) guide for businesses.
- Industry-specific regulations: Some sectors (such as health, finance, and telecommunications) have extra rules you’ll need to follow.
- State/territory laws: Certain jurisdictions have their own privacy laws for public sector agencies, and these may overlap for some businesses.
Keeping up with all the requirements can feel overwhelming, but breaking it down into bite-sized steps (and working with a legal advisor) keeps it manageable.
Key Takeaways
-
Data breaches can happen to any business - being prepared and knowing your notification obligations is critical for legal compliance and customer trust.
-
The Notifiable Data Breaches (NDB) scheme applies to most businesses covered by the Privacy Act, including those with over $3 million turnover and those handling sensitive or health information.
-
A breach is notifiable if it involves unauthorised access to (or loss/disclosure of) personal information and is likely to result in serious harm that cannot be prevented.
-
If you suffer an eligible data breach, you must notify affected individuals and the OAIC as soon as practicable - and keep thorough records of what was done.
-
Failing to comply with these laws can lead to regulator action, significant fines, reputational damage, and loss of business opportunities.
-
Having the right policies, contracts, and training in place before a breach occurs is the best way to stay compliant and protect your business.
-
Working with legal experts can give you peace of mind - ensuring you meet your obligations and avoid costly mistakes.
If you want a confidential consultation about complying with data breach notification requirements for your Australian business, or need help reviewing your Privacy Policy, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.
