Notifiable Data Breaches scheme (Privacy Act, Part IIIC)
Entities covered by the Privacy Act must assess suspected data breaches and, where a breach is likely to result in serious harm, notify affected individuals and the OAIC.
OAIC
General information, not legal advice
Australian Digital Duty of Care obligations are subject to legislation and service applicability; this platform does not certify compliance. Digital Care provides tools and records to support your own risk management. It is not legal advice.
The text below is explanatory guidance, not a reproduction of legislation. The official complete text and commencement information control. These steps support your work; they do not guarantee that an obligation is met.
Does it apply to your business?
Applies to entities and information subject to the NDB provisions, including covered APP entities and certain other Privacy Act regulated information. Not every cyber incident is an eligible data breach.
A response plan is recommended preparedness, not a standalone universal NDB obligation. Digital Care does not assess eligibility conclusively or submit notifications to the OAIC.
Detailed guidance
An eligible breach generally involves unauthorised access or disclosure, or loss likely to lead to such access or disclosure, where a reasonable person would conclude serious harm is likely. Successful remedial action can mean notification is not required.
Separate suspicion, assessment and notification. The assessment period is not permission to delay a required notification for 30 days. Legal advice and technical investigation may be needed to establish affected information and likely harm.
Part IIIC: eligibility and remedial action
Determine whether the breach is eligible
Assess the type and sensitivity of information, security protections, who may have obtained it and the kinds of harm reasonably likely. Record any remedial action and why it does or does not remove the likelihood of serious harm.
Part IIIC: suspected-breach assessment
Assess expeditiously
Conduct a reasonable and expeditious assessment where there are reasonable grounds to suspect an eligible breach. Take all reasonable steps to ensure the assessment is completed within 30 days of becoming aware of the grounds for suspicion.
Sections 26WK–26WL
Notify when the statutory test is met
Prepare the prescribed statement and give it to the OAIC as soon as practicable. Notify affected individuals as required, or use the permitted alternative where individual notification is not practicable. Check any exceptions or Commissioner directions.
Digital Care action checklist
0 of 4 preparation steps checked · This page only; not saved to your assessment or evidence records.
Check whether the NDB scheme covers your entity and information. Identify the incident lead, decision-maker, technical contacts and legal escalation path.
Keep a record: NDB applicability decision and incident contacts.
Include containment, preservation of facts, serious-harm assessment, remedial action and notification decisions. Assessment must be reasonable and expeditious, with reasonable steps to complete it within 30 days.
Keep a record: Response plan and assessment timeline template.
Allocate response tasks and record the incident timeline. Where notification is legally required, contact the OAIC and affected individuals through the prescribed channels, not through Digital Care.
Keep a record: Incident action register, decisions and copies of actual notifications.
Record lessons learned and test the response plan with a realistic scenario. A specialist advisory review may help identify gaps but does not replace notification or legal advice.
Keep a record: Post-incident review or exercise findings.
Where your plan does not include the risk register or file evidence, retain those records securely outside Digital Care and reference them in your self-review. Legal notifications and technical controls must be completed through the appropriate external channels.
Official full text & sources
Read the complete instrument on the official publisher’s website, including amendments, definitions, exemptions and commencement notes. Official sources may change after this guidance was reviewed.