If your business has lost control of personal information and that loss is likely to cause someone serious harm, you’re looking at an eligible data breach under the Privacy Act 1988. You have up to a month to assess it. Start now: contain the incident, preserve logs and evidence, and begin your assessment before you do anything else.
TL;DR:
- Breaches involving small businesses or third-party data controllers still require notification if the breach is likely to cause serious harm.
- The 30-day legal deadline starts from suspicion, not confirmation, emphasizing the need for rapid initial assessment within the first 72 hours.
- Critical technical controls like encryption, multi-factor authentication, and immutability backups significantly reduce the risk of eligible data breaches.
- Accurate vendor contracts must specify breach notification timelines to ensure early detection and compliance, especially for cloud providers and third-party processors.
- Prioritizing a tested incident response plan and vendor notification clauses will better protect businesses than relying solely on legal compliance after an incident occurs.
Table of Contents
- What the notifiable data breaches scheme covers and who must comply
- When to report: the eligible breach test and the serious harm threshold
- Meeting the 30-day assessment deadline
- What a notification must include and how to lodge it
- Preparing and preventing: controls that reduce your NDB risk
- Penalties and enforcement: what follows an eligible breach
- Quick operational checklist: your first 24 to 72 hours
- How Techbug helps Australian businesses prepare and respond
- Who’s responsible when a breach happens: data custodians vs third parties
- Do NDB requirements differ by industry or jurisdiction?
- What individuals should do after receiving a breach notification
- Why compliance-first thinking beats panic-first response
- Sources
What the notifiable data breaches scheme covers and who must comply
The Notifiable Data Breaches (NDB) scheme sits in Part IIIC of the Privacy Act 1988, inserted by the Privacy Amendment (Notifiable Data Breaches) Act 2017. Any organisation covered by the Privacy Act, known as an APP entity, must notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when a breach is likely to cause serious harm.
Coverage generally includes:
- Businesses with annual turnover over $3 million
- Private sector health service providers, regardless of size
- Organisations that handle tax file numbers, including many payroll and bookkeeping firms
- Credit reporting bodies and some small businesses that opted into the Privacy Act voluntarily
In practice, this catches a lot more Queensland small businesses than owners expect, as demonstrated by local partnerships and digital resilience examples. A stolen laptop with a client database, a hacked booking system, or an email sent to the wrong distribution list can all trigger the same legal obligations as a major corporate hack.
When to report: the eligible breach test and the serious harm threshold
An eligible data breach has three elements: unauthorised access to, unauthorised disclosure of, or loss of personal information; that event is likely to result in serious harm; and remedial action hasn’t stopped that harm from being likely. All three need to be true.
The OAIC weighs several factors when judging “likely to result in serious harm”, including:
- How sensitive the information is (health and financial data rank higher than a name and email)
- The volume of records and individuals affected
- Whether the information is already publicly available
- How likely it is that someone will actually misuse the data
Serious harm covers identity theft, financial loss, physical or psychological harm, and reputational damage. It’s a broad standard by design, because a small leak of the wrong data type can hurt someone more than a large leak of low-risk data.
Notification volumes back up how common this has become. The OAIC recorded 1,205 data breach notifications in 2025, the highest figure since the scheme began, with malicious or criminal activity the leading cause and health service providers the most affected sector.
Meeting the 30-day assessment deadline
The 30-day clock starts the moment you have reasonable grounds to suspect an eligible breach may have occurred, not the moment you confirm it. That distinction catches businesses out constantly. A vague tip-off from a staff member or a strange login alert is often enough to start the clock.
A proper assessment typically works through these steps:
- Confirm what data was involved and how many individuals are affected
- Determine whether the access, disclosure, or loss was actually unauthorised
- Assess the likelihood and severity of harm using the factors above
- Document every decision, timestamp, and remedial action taken along the way
- Decide whether remedial action removes the “likely serious harm” trigger
Record keeping matters as much as the analysis itself, since the OAIC can ask to see how you reached your conclusion. TechBug’s cyber risk assessment template gives smaller teams a starting structure for this instead of building one from scratch under pressure.
Pro Tip: Treat 30 days as the legal ceiling, not the target. Aim to complete containment and the core risk assessment within 24 to 72 hours where possible. Every extra day of delay narrows your remedial options and widens the potential harm.
What a notification must include and how to lodge it
Once you’ve decided notification is required, the statement itself needs specific content, not just a general “we had an incident” email. It must include your organisation’s identity and contact details, a description of the breach, the types of information involved, and the recommended steps affected individuals should take.
You lodge the OAIC notification through its online NDB form, and you must also notify affected individuals directly where practical, or publish a notice prominently on your website when direct contact isn’t feasible. The OAIC’s quick reference guide walks through the exact wording expected in each section.
A few related obligations often get missed:
- Breaches involving My Health Record data trigger separate notification duties to the System Operator
- From 4 February 2025, ransomware and cyber extortion payments must be reported to the Australian Signals Directorate within 72 hours via ReportCyber, on top of any NDB notification
- Sector regulators (APRA, ASIC) may have their own overlapping notification timeframes
Preparing and preventing: controls that reduce your NDB risk
The cheapest breach is the one that never happens, and most eligible breaches trace back to a handful of preventable gaps. Technical controls that consistently move the needle include encryption at rest and in transit, multi factor authentication on every remote login, systems that are actually patched on schedule, and backups that are immutable or air gapped so ransomware can’t touch them too.
Operational controls matter just as much. Collect less personal information in the first place, since data you don’t hold can’t be breached. Build breach notification clauses into every vendor contract, because a third party losing your customer data is still your compliance problem. Run regular staff training and phishing simulations, given how many incidents start with one tired employee clicking the wrong link. Legal and compliance specialists point out that businesses commonly fail here by never updating their privacy policy to reference NDB procedures or by skipping vendor notification clauses entirely.
A written, tested data breach response plan changes outcomes more than any single tool. Organisations that rehearse their plan with tabletop exercises tend to contain incidents faster and document remedial action well enough to sometimes avoid the “likely serious harm” trigger altogether. Reviewing business email security settings is a good place to start, since misdirected emails remain one of the most common eligible breaches reported to the OAIC.
Pro Tip: Ask every vendor and cloud provider one question in writing: “How quickly will you tell us if our data is breached, and in what format?” If they can’t answer clearly, that’s a contract clause you need to add before you sign, not after an incident.
Penalties and enforcement: what follows an eligible breach
Getting the NDB obligations wrong carries real financial and legal weight. Serious or repeated interferences with privacy can attract civil penalties under section 13G of the Privacy Act, with maximum penalties reaching into the tens of millions of dollars for corporations, scaled to turnover in the most serious cases.
Short of a penalty, the OAIC can also pursue:
- Formal investigations and enforceable undertakings requiring specific remediation
- Public reporting of the breach and the organisation’s response
- Exposure to private legal action from affected individuals in some circumstances
Enforcement tends to escalate where an organisation has failed repeatedly, taken no remedial action, or where the scale and severity of harm is significant. With 1,205 notifications logged in 2025, regulators have more comparative data than ever to judge whether your response measured up to the sector norm.
Quick operational checklist: your first 24 to 72 hours
Move fast and involve the right people from the start:
- Contain the breach immediately: isolate affected systems, revoke compromised credentials, stop the bleeding first
- Loop in IT, legal, and a communications lead within the first few hours, not days later
- Preserve logs, backups, and evidence before anyone “cleans up” the system
- Begin the formal 30-day assessment and start listing exactly what data types and how many individuals were affected
- Draft your notification statement early, even before you’re certain notification is required, so you’re not writing under deadline pressure
- Plan your communication channels: direct email, letter, or a public website notice, depending on scale
How Techbug helps Australian businesses prepare and respond
Most breaches aren’t sophisticated. They’re a missed patch, a reused password, or an untrained staff member clicking a convincing link. That’s where proactive monitoring and staff training earn their keep long before an incident forces your hand.
Some IT support providers work with Australian small and medium businesses on proactive monitoring, ransomware safe backups, staff training, and have an emergency response team when something has gone wrong. Some use a vendor agnostic approach, focusing on controls that fit specific risks.
If you haven’t tested your incident response process, a tabletop exercise is worth doing before you need it for real. Techbug’s managed IT services and cybersecurity services built around the ACSC Essential Eight give Queensland businesses a starting point for both prevention and response, backed by a team that answers the phone when the clock is already running.
Who’s responsible when a breach happens: data custodians vs third parties
The organisation that collected the personal information generally carries the NDB obligation, even when a third party actually caused the breach. If your payroll provider gets hacked and your staff’s TFNs leak, you’re still the APP entity with notification duties, not just the provider.
That’s why vendor contracts need explicit breach notification clauses with tight timeframes, ideally requiring the vendor to tell you within 24 to 48 hours of discovering an incident. Without that clause, you may not find out about a breach involving your customers’ data until well into your own 30-day window, or after it’s closed.
Roles typically split like this in practice:
- Data custodians (the business that collected the information) hold the legal notification obligation and final decision on whether to notify
- Third party processors (cloud hosts, payroll bureaus, marketing platforms) are contractually obliged to report incidents promptly to the custodian, but rarely notify the OAIC themselves
- IT support providers like managed service partners often handle the technical containment and evidence gathering, feeding findings into the custodian’s assessment
Joint ventures and shared databases complicate this further, since multiple entities might independently owe notification duties for the same incident. Reviewing your vendor agreements now, before an incident, is far cheaper than working out liability during one.
Do NDB requirements differ by industry or jurisdiction?
The core NDB scheme is federal and applies uniformly across Australia, so there’s no state-by-state variation in the basic test for an eligible breach. A Queensland retailer and a New South Wales retailer face identical obligations under the Privacy Act.
Industry sits differently. Health service providers are covered by the NDB scheme regardless of their turnover, unlike most other small businesses, which only fall in above the $3 million threshold. That’s a big part of why the health sector has consistently been among the most affected in OAIC’s annual figures: more entities in that sector are legally covered in the first place.
Financial services face additional overlapping obligations through APRA’s prudential standards, and some breaches trigger notification duties to both the OAIC and a sector regulator on different timelines. Telecommunications providers have their own reporting obligations under separate legislation that can run alongside NDB duties. My Health Record breaches carry a distinct notification path to the System Operator, separate from the standard OAIC process.
If your business operates across several of these categories, map out every regime that could apply before an incident forces you to work it out in real time.
What individuals should do after receiving a breach notification
A notification letter or email should tell you what happened, what information was involved, and what steps to take. Read the recommended actions section closely, since it’s tailored to the specific data type exposed rather than generic advice.
For most breaches involving financial or identity information, practical steps include:
- Change passwords immediately, especially if you reuse them across other accounts
- Enable multi factor authentication wherever it isn’t already on
- Monitor bank and credit card statements for unfamiliar transactions over the following months
- Consider a credit ban or alert through a credit reporting body if identity documents like a driver’s licence or passport number were exposed
- Keep the notification itself, since you may need to reference it if you dispute fraudulent charges later
Individuals also have the right to lodge a complaint with the OAIC if they believe an organisation mishandled the breach or failed to notify when it should have. That complaint process is separate from, and doesn’t require, any legal action against the organisation itself.
Why compliance-first thinking beats panic-first response
The conventional advice on data breaches leans heavily on legal process: get a lawyer, draft the notification, tick the boxes. That’s necessary, but it misses what the OAIC’s own figures actually show. Malicious and criminal activity drove most 2025 notifications, yet the controls that prevent the most damage, like MFA and staff phishing training, are operational, not legal.
What’s overrated is the assumption that the 30-day window is breathing room. It’s not. Every practitioner insight in this space points the same way: containment and assessment inside 72 hours protects you far better than a technically compliant notification lodged on day 29 after the damage has spread. What’s underrated is the vendor contract clause nobody reads until it’s too late.
If you take one thing from this, prioritise the pre-incident plan over the post-incident scramble. A tested response plan and clear vendor notification terms will do more for your business than memorising the statutory test ever will. Queensland’s small and medium business sector especially can’t afford the slow, reactive version of this process.
— Ru
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
- About the Notifiable Data Breaches scheme | OAIC
- Privacy Amendment (Notifiable Data Breaches) Act 2017