Australia's Notifiable Data Breaches Scheme: A Practical Overview
Understand the NDB response process, the assessment period and why Australian notification is not a blanket 72-hour rule.
Know who will make the decisions
A data incident can require technical investigation and privacy decisions at the same time. Name an incident lead and identify who can obtain legal advice. This overview helps organise the response; it does not determine whether your particular organisation or incident is covered.
Check whether the scheme applies
The NDB scheme concerns entities covered by relevant Privacy Act obligations. Turnover alone is not a safe test because exceptions and other circumstances can matter. Ask an appropriately qualified adviser if the business's position is unclear.
Understand the Australian timing
There is no general 72-hour notification deadline under the NDB scheme. Where there are reasonable grounds to suspect an eligible breach, the OAIC guidance calls for a reasonable and expeditious assessment, with all reasonable steps to complete it within 30 calendar days. That is not permission to wait until day 30.
Once the applicable notification obligation is established, notification is required as soon as practicable. Eligibility depends on factors including likely serious harm and whether remedial action prevents that harm. A blog cannot make that judgement from the type of file alone.
Keep a decision record
- Record what happened and when it became known.
- Identify the information, people and systems potentially affected.
- Document containment and remedial actions.
- Preserve the assessment, advice and reasoning behind decisions.
- Prepare clear communication and practical recommendations where required.
Give the technical team a defined role
The IT responder can help establish access, exposure, containment and recovery facts. Management and advisers should use those facts to assess the obligations. Avoid assuming a restored system means there was no data exposure.
Our cybersecurity services can support technical preparation and response planning. For the legal process, use the OAIC guidance linked below.
Official reference: OAIC quick reference guide.