What Counts as a Notifiable Data Breach in Australia?

The NDB scheme uses the term "eligible data breach." Three conditions must all be satisfied:

1. There has been unauthorised access to, or unauthorised disclosure of, personal information — or personal information has been lost in circumstances where unauthorised access or disclosure is likely
2. The breach involves personal information held by an APP entity
3. The breach is likely to result in serious harm to one or more of the individuals whose information is involved

If any one of those three conditions is not met, the breach is not eligible and formal notification to the OAIC is not required — though internal documentation of the assessment is still good practice.

Incidents that often qualify as eligible data breaches:

• Ransomware or cyberattack — exfiltration of customer or employee data is almost always eligible; encryption-only incidents may still qualify depending on the sensitivity of the data
• Accidental email disclosure — sending a customer file to the wrong recipient, or using CC instead of BCC for a group mailing
• Lost or stolen devices — an unencrypted laptop or phone containing customer records
• Insider access — an employee accessing files they are not authorised to see and potentially copying or disclosing them
• Third-party breach — a SaaS vendor is compromised and your customers' data is exposed; you have obligations as the APP entity that originally collected and held the data

Incidents that typically do not meet the threshold: accidentally deleted data with no sensitive content and no confirmed unauthorised access; a staff member who briefly views the wrong record and immediately corrects the error with no onward disclosure.

"Likely" means more probable than not — a greater than 50% chance. "Serious harm" under Part IIIC includes:

• Serious physical, psychological, emotional, financial, or reputational harm
• Identity theft or fraud
• Discrimination
• Exposure of sensitive information (health, sexual orientation, biometric data, etc.)
• Physical danger arising from disclosure (e.g., location data of a person in a domestic violence situation)

The higher the sensitivity of the information, the lower the bar for concluding serious harm is likely. Health information, financial account credentials, and government identifiers (Tax File Numbers, Medicare numbers) are almost always treated as sensitive.

When your business becomes aware of a suspected breach, 30 days begins. During that window:

1. Contain the breach — stop ongoing access, isolate affected systems, revoke credentials where possible
2. Identify the information involved — type, sensitivity, volume
3. Identify how many individuals are affected — or estimate if exact numbers are unavailable
4. Assess the realistic risk of serious harm — considering the nature of the information and plausible ways it could be misused
5. Document the assessment in writing — retain this regardless of whether the breach is ultimately notifiable

If after 30 days you conclude the breach is eligible, notify the OAIC and take reasonable steps to notify affected individuals — directly where practicable.

A notification to the OAIC must contain:

• Your organisation's identity and contact details
• A description of the breach — what happened, how, and when
• The kinds of personal information involved
• The number or estimate of individuals affected
• The steps you recommend individuals take to protect themselves
• Your response actions

There is an online notification form at oaic.gov.au.