Notifiable Data Breaches Scheme

The scheme sits inside the Privacy Act 1988 and has run since February 2018. It applies to organisations the Privacy Act covers — generally businesses with annual turnover over $3 million, plus some smaller ones regardless of size, such as health service providers and businesses that trade in personal information.

A breach is notifiable when personal information is lost, accessed or disclosed without permission, it’s likely to cause someone serious harm, and you haven’t been able to prevent that harm. If you suspect one, you have 30 days to assess it. If it’s notifiable, you must tell the people affected and the OAIC as soon as practicable.

Why it matters: breaches aren’t rare, and they aren’t only a big-company problem. The OAIC received 667 notifications between January and June 2026, and malicious or criminal attacks — phishing, ransomware, stolen logins — were the leading cause. Removing the small business exemption has also been part of Privacy Act reform discussions since 2023, so the threshold is worth watching.

This is signposting, not legal advice — the OAIC’s guidance at oaic.gov.au is the place to check whether the scheme applies to you and what to do.