What is the Notifiable Data Breaches scheme
The passage of the Privacy Amendment (Notifiable Data Breaches) Act 2017 established the Notifiable Data Breaches (NDB) scheme in Australia. The NDB scheme applies to all agencies and organisations with existing personal information security obligations under the Australian Privacy Act 1988 (Privacy Act) from 22 February 2018.
The NDB scheme introduced an obligation to notify individuals whose personal information is involved in a data breach that is likely to result in serious harm. This notification must include recommendations about the steps individuals should take in response to the breach. The Australian Information Commissioner (Commissioner) must also be notified of eligible data breaches.
If you have experienced a breach fill in this form Notifiable Data Breach statement — Form.
Who must comply with the NDB scheme
Which data breaches require notification
Assessing suspected data breaches
Assessing a suspected data breach
How to notify
When an agency or organisation is aware of reasonable grounds to believe an eligible data breach has occurred, they are obligated to promptly notify individuals at likely risk of serious harm. The Commissioner must also be notified as soon as practicable through a statement about the eligible data breach.
The notification to affected individuals and the Commissioner must include the following information:
- the identity and contact details of the organisation
- a description of the data breach
- the kinds of information concerned and;
- recommendations about the steps individuals should take in response to the data breach.
The notification to the Commissioner can be made using the OAIC’s Notifiable Data Breach form.
Additional resources
- View Data breach preparation and response
- View Guide to securing personal information
- View the webinar
Assessment Coming Soon.