Privacy Amendment (Notifiable Data Breaches) Act

Mandatory data breach notification scheme requiring notification to affected individuals and Privacy Commissioner.

Analysis

The Privacy Amendment (Notifiable Data Breaches) Act 2017 amended the Privacy Act 1988 (Cth) to introduce a mandatory Notifiable Data Breaches (NDB) scheme requiring notification to affected individuals and the Office of the Australian Information Commissioner (OAIC) where an eligible data breach is likely to result in serious harm.Privacy Amendment Bill Explanatory Materials – RISOAIC – About the NDB schemePrivacy Amendment (Notifiable Data Breaches) Bill 2016 – Parliament of Australia

Key Requirements

• Scope – who must comply

• The NDB scheme applies to “APP entities” covered by the Privacy Act 1988, including most Australian Government agencies and many private sector organisations.OAIC – About the NDB schemePrivacy Act 1988 – Federal Register of Legislation
• This includes Australian Government agencies, large businesses (annual turnover > AUD 3 million), private health service providers, some small businesses handling sensitive data, credit reporting bodies, credit providers and tax file number recipients.OAIC – About the NDB schemeFindex – Privacy Amendment (NDB) Act 2017 overview

• Definition of an “eligible data breach”

• An eligible data breach occurs when:
• There is unauthorised access to, unauthorised disclosure of, or loss of personal information held by an entity; and
• A reasonable person would conclude that this is likely to result in serious harm to one or more individuals.OAIC – About the NDB schemePrivacy Amendment Bill 2016 (PDF – s 26WE–26WG)
• Serious harm can include serious physical, psychological, emotional, economic, reputational or financial harm.Findex – Privacy Amendment (NDB) Act 2017 overviewOAIC – About the NDB scheme

• Mandatory notification to OAIC and affected individuals

• APP entities must notify both:
• The Australian Information Commissioner (OAIC); and
• Affected individuals when an eligible data breach is likely to result in serious harm.OAIC – About the NDB schemePrivacy Amendment Bill 2016 – Parliament of Australia
• The notification must include:
• A description of the data breach;
• The kinds of information concerned; and
• Recommended steps individuals should take to minimise the impact.Findex – Privacy Amendment (NDB) Act 2017 overviewOAIC – About the NDB scheme

• Assessment obligation – 30‑day period

• Where an entity suspects an eligible data breach may have occurred, it must carry out a reasonable and expeditious assessment of the circumstances.OAIC – About the NDB schemeFindex – Privacy Amendment (NDB) Act 2017 overview
• The Privacy Act requires this assessment be completed within 30 calendar days of becoming aware of the suspected breach.Findex – Privacy Amendment (NDB) Act 2017 overviewFortinet – NDB scheme overview

• Timing – “as soon as practicable” after assessment

• Once an entity reasonably believes an eligible data breach has occurred, it must notify the Commissioner and affected individuals as soon as practicable.OAIC – About the NDB schemePrivacy Amendment Bill 2016 (PDF – s 26WL–26WK)

• Notification content and method

• Entities must prepare a statement for the Commissioner and then:
• Notify affected individuals directly, where practicable; or
• Publish the statement on their website and take reasonable steps to publicise it if direct notification is not practicable.Privacy Amendment Bill 2016 (PDF – s 26WL–26WK)OAIC – About the NDB scheme
• OAIC provides an online Notifiable Data Breach form specifying the required information.OAIC – NDB online formFortinet – NDB overview

• Exceptions – remedial action and other carve‑outs

• If an entity takes remedial action such that the data breach is no longer likely to result in serious harm, it may not be an eligible data breach and notification is not required.OAIC – About the NDB schemeHall & Wilcox – New mandatory data breach legislation
• Other exemptions cover situations involving law enforcement, Commonwealth secrecy obligations, multiple‑entity breaches, or where the Commissioner makes a declaration.Hall & Wilcox – New mandatory data breach legislationPrivacy Amendment Bill 2016 (PDF – s 26WN–26WP)

• Penalties for non‑compliance

• Failure to comply with mandatory notification may be treated as an interference with privacy and can amount to a civil penalty provision under the Privacy Act.Hall & Wilcox – New mandatory data breach legislationPrivacy Act 1988 – Federal Register of Legislation
• Civil penalties can reach up to AUD 1.8 million for organisations and AUD 360,000 for individuals for serious or repeated interferences with privacy.Findex – Privacy Amendment (NDB) Act 2017 overviewFortinet – NDB overview

Compliance Challenges

• Determining “serious harm” and eligibility

• Many organisations struggle to assess whether a breach is likely to result in serious harm, particularly for complex datasets or indirect harms.OAIC – About the NDB schemePrivacy Amendment Bill 2016 – RIS
• OAIC has noted in guidance that entities need to consider factors such as the sensitivity of information, security measures, and likely impacts, which can be difficult to evaluate consistently.OAIC – About the NDB schemeOAIC – NDB resources

• Meeting the 30‑day assessment timeline

• Organisations commonly face challenges completing investigations and risk assessments within 30 days, especially for large or multi‑system incidents.Findex – Privacy Amendment (NDB) Act 2017 overviewFortinet – NDB overview
• Industry commentary highlights that complex breaches may require forensic work, making the “expeditious” assessment standard demanding for entities with limited resources.Hall & Wilcox – New mandatory data breach legislationVizstone NDB eBook

• Building incident response capability

• Smaller organisations and non‑profits subject to the Act often lack mature incident response and privacy risk management processes.Findex – Privacy Amendment (NDB) Act 2017 overviewPrivacy Amendment Bill 2016 – RIS
• The Regulatory Impact Statement acknowledges that many entities previously had no legal obligation to notify individuals of breaches, and therefore lacked established notification processes.Privacy Amendment Bill 2016 – RISOAIC – Data breach guidance (pre‑NDB background)

• Coordination in multi‑party breaches

• Breaches involving outsourced service providers, cloud services, or joint ventures can create uncertainty about which party must notify, and how communications should be coordinated.Hall & Wilcox – New mandatory data breach legislationVizstone NDB eBook
• The legislation includes special rules for data breaches affecting multiple entities, but applying these in practice requires clear contractual and governance arrangements.Privacy Amendment Bill 2016 (PDF – s 26WK–26WP)Hall & Wilcox – New mandatory data breach legislation

• Real examples / case‑based challenges

• OAIC publishes NDB reports and case examples showing common issues, such as misdirected emails, credential compromise, and system misconfiguration leading to unauthorised disclosure.OAIC – NDB statistics and reportsOAIC – Data breach preparation and response
• Industry analyses highlight sectors like health and finance experiencing frequent reportable breaches, illustrating the operational burden of investigation and notification.OAIC – NDB statistics – sector breakdownsThales CPL – Privacy Amendment overview

Implementation Best Practices

• Establish and test a formal data breach response plan

• Develop a documented data breach response plan aligned with OAIC guidance, setting out roles, escalation paths, assessment steps, and communication protocols.OAIC – Data breach preparation and responseOAIC – About the NDB scheme
• OAIC recommends entities test their plans through exercises and update them regularly based on lessons learned.OAIC – Data breach preparation and responseOAIC – Privacy management framework

• Integrate NDB obligations into a privacy management framework

• Implement a privacy management program that embeds NDB requirements into governance, risk assessment, training, incident management, and vendor oversight.OAIC – Privacy management frameworkOAIC – Notifiable Data Breaches resources
• Align breach response with the Australian Privacy Principles (APPs), especially APP 1 (open and transparent management) and APP 11 (security of personal information).Privacy Act 1988 – APPsOAIC – APP Guidelines

• Risk‑based assessment methodology

• Use a structured risk assessment method to evaluate whether serious harm is likely, considering:
• The type and sensitivity of data;
• Security measures (e.g. encryption);
• Context of the breach; and
• The likelihood and nature of potential harm.OAIC – About the NDB schemeVizstone NDB eBook
• OAIC guidance provides factors to consider and recommends documenting the assessment process to demonstrate compliance.OAIC – About the NDB schemeOAIC – NDB resources

• Training and awareness

• Provide regular training for staff on:
• Identifying potential data breaches;
• Escalating incidents promptly; and
• Understanding notification obligations.OAIC – Privacy management frameworkOAIC – Data breach preparation and response
• OAIC emphasises organisational culture and leadership in supporting proactive privacy and breach management.OAIC – Privacy management frameworkPrivacy Amendment Bill 2016 – RIS

• Tools and resources

• OAIC Notifiable Data Breach form – official online form for reporting eligible data breaches to the Commissioner.OAIC – Notify us about a data breachFortinet – NDB overview
• OAIC guidance documents – including the NDB scheme overview, FAQs, and sector‑specific resources.OAIC – About the NDB schemeOAIC – NDB resources
• Industry guides such as the **Vizstone N

Recent developments

• 2026-06-10 — Attorney-General’s Department highlights that the Privacy Amendment (Notifiable Data Breaches) Act’s mandatory breach notification regime continues to operate alongside newer reforms in the Privacy and Other Legislation Amendment Act 2024, reinforcing a broader tightening of Australia’s privacy framework and enforcement environment.[7] (source)
• 2026-05-22 — OAIC publishes updated Notifiable Data Breaches statistics and regulatory commentary, noting continuing high volumes of notifications under the Privacy Amendment (Notifiable Data Breaches) Act and warning entities that poor security and delayed detection regularly trigger investigations and enforcement action.[7] (source)
• 2026-04-30 — Parliamentary analysis of the Privacy Legislation Amendment (Enforcement and Other Measures) Act details changes that directly affect the notifiable data breach regime, including more prescriptive content requirements for breach notices and replacement of certain criminal penalties with strengthened civil penalties, increasing compliance risk for organisations.[6] (source)
• 2026-04-15 — Policy update clarifies that reporting entities must include more specific information about the *particular kinds* of personal information involved in an eligible data breach, meaning organisations must improve incident forensics and documentation to meet the amended notification obligations under the Privacy Act framework.[6] (source)
• 2026-03-28 — Federal government commentary on the implementation of the Privacy and Other Legislation Amendment Act 2024 reiterates that the notifiable data breach scheme introduced by the Privacy Amendment (Notifiable Data Breaches) Act remains a central enforcement tool, now complemented by higher penalties and new rights that heighten the consequences of serious or repeated breaches.[7] (source)
• 2026-03-10 — OAIC guidance update urges entities subject to the Privacy Amendment (Notifiable Data Breaches) Act to review incident response plans in light of recent legislative enforcement changes, emphasising timely assessment (within 30 days) and clear communication with affected individuals as key expectations for regulatory compliance.[3][6] (source)
• 2026-02-27 — Industry legal commentary revisits the definition of “eligible data breach” under the Privacy Amendment (Notifiable Data Breaches) Act, advising businesses to tighten risk assessments and breach classification processes due to heightened OAIC scrutiny and the potential for significant civil penalties for non-compliance.[3] (source)
• 2026-02-14 — Law firm update notes that recent enforcement trends and legislative changes have increased the practical impact of the Privacy Amendment (Notifiable Data Breaches) Act on Australian organisations, with boards treating mandatory notification obligations as a core governance and cyber‑risk issue rather than a purely legal formality.[2][6] (source)
• 2026-01-30 — Media analysis reflects on several years of operation of the mandatory data breach notification scheme created by the Privacy Amendment (Notifiable Data Breaches) Act, reporting that frequent large‑scale breaches have made notification practices and OAIC engagement a routine operational concern for major Australian organisations.[5] (source)
• 2026-01-18 — Policy commentary from the Attorney-General’s Department links ongoing privacy law reform to experience under the Privacy Amendment (Notifiable Data Breaches) Act, noting that the volume and severity of reported breaches have driven government proposals for stronger remedies, higher penalties, and additional sector‑specific privacy codes.[7] (source)

Related regulations

• Australia Cyber Security Act 2024 (Ransomware Payment Reporting) — Australia, Active, effective 2026-01-01
• Australia Online Safety Amendment (Social Media Minimum Age) Act 2024 — Australia, Active, effective 2025-12-10
• Australia Children's Online Privacy Code — Australia, Upcoming, effective 2026-12-10
• Australia Privacy Amendment (Personal Data Protection) Bill 2026 (Tranche 2 exposure draft) — Australia, Proposed
• UK Data Protection Act 2018 — United Kingdom, Active
• Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
• General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
• COPPA (Children's Online Privacy Protection Act) — United States, Active

Put it into practice

• Generate the policy: Australian Privacy Act policy generator (generatepolicy.com)
• Buy the policy pack: Australia Privacy Act Compliance Policy (cyberpolicy.shop)
• Build it yourself: GDPR & DPIA Compliance Workbook (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates