Australia’s mandatory data breach response regime under the Notifiable Data Breaches scheme obliges covered organisations to assess a suspected eligible data breach and, where confirmed, notify affected individuals and the OAIC. The assessment clock starts when the organisation becomes aware of grounds to suspect a breach.
Table of Contents
A Step-by-Step Guide Under the NDB Scheme
The mandatory data breach response begins earlier than most organisations expect. The assessment obligation is triggered by grounds to suspect an eligible breach, not by confirming one, which means the clock is often already running while the organisation is still working out what happened.
This guide explains the mandatory data breach response process under the NDB scheme, from initial detection through notification and remediation.
Key Takeaways
Mandatory Data Breach Response: Who the NDB Scheme Applies To
The NDB scheme applies to Australian government agencies and organisations subject to the Privacy Act 1988 that have an annual turnover above $3 million, as well as certain small businesses regardless of turnover, including health service providers, credit reporting bodies, and tax file number recipients. From proposed Privacy Act reform, the turnover threshold may be removed, bringing more businesses into the scheme.
data breach notifications were made to the OAIC across 2024, and 595 of them fell in the July to December half alone — OAIC Notifiable Data Breaches Report, July to December 2024
What Constitutes a Notifiable Data Breach?
An eligible data breach under the NDB scheme occurs where: there has been unauthorised access to or disclosure of personal information, or personal information has been lost in circumstances where unauthorised access or disclosure is likely; and a reasonable person would conclude that the access, disclosure, or loss is likely to result in serious harm to any individual to whom the information relates.
Serious harm is not defined in the Privacy Act but is assessed against factors including the sensitivity of the information involved (financial information, health information, and identity documents typically satisfy the threshold), the number of individuals affected, and the likelihood that the information will be used to harm the individuals concerned.
A cyber attack that exfiltrates customer financial account details, Medicare numbers, or tax file numbers is almost certainly a notifiable data breach. A misaddressed email containing a single customer's name and order reference may not reach the serious harm threshold. The assessment must be made for the specific circumstances.
The 30-Day Assessment Window
The NDB scheme requires organisations to assess a potential eligible data breach within 30 days of becoming aware that there are reasonable grounds to suspect a breach may have occurred. If, after assessment, the organisation concludes that an eligible data breach has occurred, it must notify the OAIC and affected individuals as soon as practicable after that conclusion.
The 30-day window is not a deadline to start the response. It is a deadline to complete the assessment and determine whether notification is required. Organisations that delay initiating the assessment, or that conduct an inadequate assessment, risk breaching the 30-day requirement.
The Step-by-Step Response Process
Step 1: Contain the Breach
The first response to any suspected data breach is containment, preventing further access to or disclosure of personal information. This may involve isolating affected systems, revoking compromised credentials, suspending affected accounts, or securing physical documents. Containment should occur immediately, before the breach’s scope is fully assessed.
Step 2: Assess the Breach
Assess: what personal information was involved; how many individuals are affected; what are the likely consequences of the access or disclosure; and whether those consequences are likely to result in serious harm. Document the assessment, including the information sources consulted and the reasoning for the conclusion reached.
Step 3: Notify the OAIC
Where the assessment concludes that an eligible data breach has occurred, notify the OAIC using the standard data breach notification form available on the OAIC website. The notification must include: a description of the breach; the type of information involved; the steps taken in response; and the contact details of the responsible officer.
Step 4: Notify Affected Individuals
Notify affected individuals as soon as practicable. The notification must include: the identity and contact details of the organisation; a description of the breach; the type of information involved; the steps the organisation recommends individuals take to protect themselves; and the contact details for further enquiries. Where direct notification is not practicable, the OAIC may permit notification through a published statement.
Step 5: Remediate
After notification, the organisation must take reasonable steps to prevent future breaches of the same or similar nature. Document the remediation steps taken and the timeframe for implementation.
Mandatory data breach response: the clock starts on suspicion
DBA Advisory helps businesses prepare a response plan before it is needed, which is the only time it can usefully be written.
The assessment window starts when you become aware there are reasonable grounds to suspect a breach, not when you confirm one. Businesses lose most of that window deciding whether something counts, then attempt containment, assessment, notification and remediation in the days that remain. Start the clock in your own mind at suspicion and the timeline becomes manageable.
The scheme applies to entities covered by the Privacy Act, and a breach is notifiable where unauthorised access or disclosure is likely to result in serious harm. The response runs in order: contain, assess, notify the OAIC, notify affected individuals, remediate. Write the plan now and decide who makes the call, because that decision is difficult to make well under pressure.
Frequently Asked Questions (FAQs)
The NDB scheme applies to Australian government agencies and organisations subject to the Privacy Act 1988 with annual turnover above $3 million, as well as certain small businesses regardless of turnover including health service providers. Proposed Privacy Act reforms may remove the turnover threshold. Businesses that are not currently covered should monitor legislative developments and consider whether voluntary privacy best practice, including breach response procedures, is appropriate regardless of legal obligation.
Organisations must complete their assessment of whether an eligible data breach has occurred within 30 days of forming a reasonable suspicion that a breach may have occurred. If the assessment confirms an eligible data breach, the OAIC and affected individuals must be notified as soon as practicable after that conclusion. There is no specific notification deadline measured from the breach event itself. The clock starts from when the organisation becomes aware that a breach may have occurred.
Failure to notify the OAIC or affected individuals of an eligible data breach is a contravention of the Privacy Act. The OAIC can investigate and take enforcement action, including seeking civil penalty orders in the Federal Court. The maximum civil penalty for serious or repeated breaches of the Privacy Act is $50 million for bodies corporate. The OAIC may also accept enforceable undertakings or make public determinations.
The Privacy Act does not require a written data breach response plan, but the OAIC strongly recommends one. A formal plan documents the roles and responsibilities for responding to a breach, the assessment criteria, the notification procedures, and the contact details for the OAIC. A business with a documented plan is significantly better positioned to meet the 30-day assessment requirement and to demonstrate to the OAIC that it has taken the obligation seriously.
How DBA Advisory Supports You
DBA Advisory is a Sydney-based operational advisory firm specialising in AML/CTF compliance, audit and assurance, tax and financial governance, legal operations, SMSF administration, and outsourced back-office services for Australian businesses and professional services firms.
We help Australian businesses and professional services firms turn compliance obligations into systems that run reliably. No hourly surprises. Fixed-fee certainty. Senior review on every file.
DBA Advisory offers fixed-fee Privacy compliance, data breach response planning, and cyber governance advisory engagements with no hidden costs. Contact our team to discuss your requirements!
The Operational Resilience Framework covers the seven back-office systems every growing business needs (finance, compliance, workforce, IT, process, governance and visibility) with a scored fifteen-minute self-assessment. Download it free or book a meeting today!
Disclaimer
© DBA Advisory 2026. This article is intended as general information only and does not constitute legal, financial, tax or compliance advice. Sseek qualified advice specific to your circumstances and confirm all regulatory references against current guidance before acting on any information contained in this article.
Related Insights
We build the resilient foundations
empowering you
to scale your business
Get in touch
Alquin Dagamina
Business Transformation and Technology Services, Manager
- Alquin.Dagamina@dbaadvisory.com
- 09158918379
