Data breaches: when Australian businesses must notify

Ransomware locks your files, or a laptop goes missing from a car, or an email with client spreadsheets lands in the wrong inbox. What happens next is governed by law, not discretion. Under the Notifiable Data Breaches scheme, businesses caught by the Privacy Act 1988¹ (Cth) must assess suspected breaches on a 30-day clock and notify when serious harm is likely. Silence is now one of the most expensive options available²³.

Does the scheme apply to your business?

The obligations sit on APP entities under the Privacy Act. In broad terms that captures organisations with annual turnover above $3 million, plus some smaller operators in specific categories such as health service providers, and businesses trading in personal information. Queensland government agencies have their own privacy regime with separate breach reporting expectations.

Many small businesses assume they fall outside the net; check rather than guess, because contractors handling personal information for covered entities often carry flow-on obligations through contracts. Medical practices, gyms with health screenings, allied health clinics and childcare services commonly qualify through their activities regardless of turnover, and franchise arrangements can pull both franchisor and franchisees into scope depending on who holds what data. When in doubt, map what personal information you collect, why, and where it flows before concluding the scheme is somebody else’s problem.

What counts as an eligible data breach

Two elements must line up:

1. Unauthorised access, disclosure or loss of personal information
2. A likelihood of serious harm to at least one individual as a result

Real-world examples include credentials stolen in phishing attacks, databases exposed online, misdirected emails containing sensitive details, and unencrypted devices lost in public. Serious harm is assessed from the perspective of the individuals affected: identity theft, financial fraud, family violence risks from address disclosures and profound embarrassment all qualify. Where you cannot rule out serious harm, the default assumption points towards notifying.

Context shapes the harm assessment too. A leaked list of first names means little; the same list joined with dates of birth, tax file numbers and health claims is a different proposition entirely. Sensitive categories such as health information, financial records and anything touching family or domestic violence circumstances push assessments towards notification quickly. Volume matters less than sensitivity; a single counsellor’s client file can outweigh a thousand marketing email addresses.

The 30-day assessment clock

Timing rules are strict:

• The clock starts when the entity becomes aware of circumstances suggesting an eligible breach, including awareness through staff reports
• Reasonable steps must be taken to complete an assessment within 30 days
• If eligible, notify affected individuals and the Office of the Australian Information Commissioner as soon as practicable
• If individuals cannot realistically be identified, publish a statement and discuss it with the regulator

Notifications should tell people plainly: what happened, which information was involved, what the organisation is doing, and what steps recipients should take, such as changing passwords or watching accounts. Keep copies of every notification sent and the reasoning behind timing decisions, because regulators later scrutinise both what was said and how quickly it was said.

Vendors, contractors and shared responsibility

Breaches increasingly arrive through third parties: cloud providers, marketing platforms, bookkeepers and managed IT providers. The Privacy Act’s accountability model means the entity whose customers’ information leaked generally cannot outsource its obligations along with the data processing. Practical steps:

• Contract for prompt breach notification from every vendor holding personal information
• Ask where data is stored and who can access it, and record the answers
• Include audit rights in significant outsourcing arrangements
• Map your data flows so an incident triggers the right calls immediately

A breach at your CRM provider on a Friday night becomes your notification problem by Monday morning; knowing the escalation contacts before that call comes is half the battle.

Penalties and consequences when things go wrong

Regulators have shown they will pursue serious failures. Civil penalties for serious or repeated privacy interference now reach into the tens of millions of dollars for large entities, alongside enforceable undertakings and court orders. Beyond fines, expect:

• Class actions where large groups suffer harm
• Cyber insurance complications if obligations were breached
• Contractual liability to customers who required compliance
• Lasting reputational damage amplified by media coverage of concealment

Building response capability before the breach

Preparation converts panic into process:

1. Maintain a written incident response plan naming decision-makers and external advisers
2. Train staff to escalate suspected incidents immediately, since awareness starts the clock whether management knows or not
3. Reduce blast radius with encryption, multi-factor authentication and minimised data collection
4. Log every assessment decision and its reasoning, even where no notification followed
5. Rehearse scenarios annually so the 30-day window feels generous rather than impossible

Culture completes the system. Staff who fear blame bury incidents; staff who report them early save the business. Make escalation a rewarded behaviour in practice, not just in the policy document, and review near-misses as seriously as full breaches, because they reveal exactly where systems are soft. Businesses that treat privacy compliance as an ongoing discipline rather than a checkbox tend to survive both regulator attention and customer scrutiny when incidents eventually occur.

Handling a breach right now, or tightening compliance beforehand? Contact Bell & Senior Lawyers for a free initial chat, and see our technology and commercial practices plus startup resources .

Notes