Demystifying Australia's Notifiable Data Breach Laws

Who does it apply to?

The Notifiable Data Breach scheme applies to organisations covered by the Privacy Act 1988, which includes:

1. Australian Government Agencies: All Australian government agencies are subject to the NDB scheme, regardless of their size or annual turnover.
2. Businesses with Annual Turnover above AUD 3 million: Private sector organisations, including businesses, non-profit organisations, and some small businesses with an annual turnover of more than AUD 3 million, fall under the scope of the NDB scheme.
3. Credit Reporting Bodies: Credit reporting bodies that handle personal information as part of their credit reporting activities are bound by the NDB scheme.
4. Health Service Providers: Organisations that provide a health service and hold health information are also covered by the NDB scheme.

If you're not sure if this applies to you, it is recommended to consult the Privacy Act 1988 or seek legal advice to determine the specific obligations based on the nature and size of your organisation.

What are 'Eligible Data Breaches'?

Eligible data breaches refer to incidents where there has been unauthorised access to or disclosure of personal information, or when personal information is lost in circumstances likely to result in unauthorised access or disclosure.

For an incident to be considered an eligible data breach under the Australian Notifiable Data Breach (NDB) scheme, it must be reasonably likely to result in serious harm to the affected individuals.

This harm can include physical, psychological, financial, or reputational harm. Determining whether a breach is eligible requires careful assessment of the potential impact on an individual's privacy and the likelihood of harm.

Identifying eligible data breaches is crucial as it triggers the notification obligations outlined in the NDB scheme, ensuring affected individuals are promptly informed and appropriate actions are taken to mitigate harm and protect personal information.

What are my notification obligations?

Notification obligations are a critical aspect of the Notifiable Data Breach (NDB) scheme in Australia. When an eligible data breach occurs, organisations are required to notify the affected individuals as soon as practicable.

The notification should provide clear and concise information about the breach, including details about the type of personal information involved, the circumstances of the breach, and any potential risks or harm that may result.

Organisations must also provide guidance on steps individuals can take to mitigate the impact of the breach. Timely and transparent notification is essential for affected individuals to take appropriate measures to protect themselves and their personal information.

It demonstrates a commitment to accountability, fosters trust, and empowers individuals to make informed decisions regarding their privacy and security.

Do I need to notify the OAIC?

As part of the Notifiable Data Breach (NDB) scheme in Australia, organisations are obligated to notify the Office of the Australian Information Commissioner (OAIC) about eligible data breaches.

The notification to the OAIC should be made as soon as practicable after becoming aware of the breach. The purpose of this requirement is to enable the OAIC to monitor and assess the impact of data breaches, provide guidance to affected organisations, and ensure compliance with the NDB scheme.

Organisations need to provide relevant details about the breach, including the nature and extent of the incident, the types of personal information involved, and the steps taken to address the breach.

By notifying the OAIC, organisations contribute to a collective effort to protect individuals' privacy and strengthen data protection practices across Australia.

What are the consequences of non-compliance?

Non-compliance with the Notifiable Data Breach (NDB) scheme in Australia can result in significant consequences for organisations.

The Office of the Australian Information Commissioner (OAIC) has the authority to impose penalties and fines for serious or repeated interferences with privacy.

The maximum penalty for organisations can reach up to AUD 2.1 million, while individuals may face fines up to AUD 420,000. These penalties serve as a deterrent to encourage organisations to prioritise data security, privacy protection, and timely reporting of eligible data breaches.

Additionally, non-compliance can also lead to reputational damage, loss of customer trust, and potential legal action from affected individuals.

It is crucial for organisations to understand and fulfil their obligations under the NDB scheme to mitigate these consequences and demonstrate a commitment to safeguarding personal information.