Notifiable data breaches: what your business must do

Notifiable data breaches for small business

An invoice goes to the wrong client. A laptop disappears from a car. Someone gets into the inbox where you keep every customer enquiry. None of this feels like a headline event, and that is exactly the problem, because the notifiable data breaches rules are not written for headline events.

Under the Notifiable Data Breaches (NDB) scheme, if the Privacy Act 1988 (Cth) covers your business, you must tell the affected people and the Office of the Australian Information Commissioner (OAIC) when personal information you hold is accessed, disclosed or lost, that is likely to cause someone serious harm, and you cannot remove that risk yourself.

What counts as a notifiable data breach?

Two things have to line up.

• There has been a data breach. Personal information your business holds is subject to unauthorised access, unauthorised disclosure, or loss.

• It is likely to cause serious harm, and you cannot fix that. The breach is likely to result in serious harm to one or more people, and remedial action has not removed that likelihood.

When both are true, it is an eligible data breach and notification is mandatory. When only the first is true, it is still a breach worth taking seriously, but the notification obligation does not switch on.

The OAIC's own examples are deliberately ordinary. A device holding customer information is lost or stolen. A database is hacked. Personal information is given to the wrong person. A staff member browses sensitive customer records with no legitimate reason. A file with personal details is published online by accident. Paperwork is left on public transport.

Does the NDB scheme apply to your business?

It applies to entities that already have security obligations for personal information under APP 11. That covers Australian Government agencies, businesses and not-for-profits with an annual turnover of more than $3 million, private sector health service providers, credit reporting bodies, credit providers, and some smaller operators under the turnover threshold, such as businesses that handle tax file number information.

The turnover figure is the one most owners latch onto, and it is the one most likely to mislead you, because what your business does can pull you in regardless of what it earns. Worth confirming properly rather than assuming, in the same way you would check whether you need a privacy policy.

If the scheme genuinely does not apply, you may still have obligations under state or international laws, particularly if you deal with customers overseas.

What does "serious harm" actually mean?

Serious harm can be physical, psychological, emotional, financial or reputational. Stolen bank details and a leaked home address sit in very different places to a list of first names.

Two words in the test do the heavy lifting:

• Likely. Serious harm has to be more probable than not, not merely possible. A remote risk is not enough.

• Reasonable person. You assess it from the position of a properly informed person in your business's shoes, not from the position of the customer, and not from your own hope that it will blow over.

Judge the risk as a whole: how sensitive the information is, how many people are affected, whether it was encrypted, who is likely to have it, and what they could do with it.

What to do if you think you have had a breach

The OAIC sets out four steps. Work through them in order, and write down what you did and when, because you will want that record later.

1. Contain it

Stop the bleeding first. Change the password, recall the email, disable the account, get the device back, take the file down. The goal is to prevent any further personal information being compromised.

2. Assess it

Gather the facts: what information was involved, whose, how much, and where it has ended up. Work out whether serious harm is likely, and take any action that could remove the risk. If prompt remedial action means serious harm is no longer likely, the breach is not notifiable, and that is a legitimate outcome rather than a loophole.

You have 30 days. If you suspect an eligible data breach, you must take all reasonable steps to complete the assessment within 30 calendar days of becoming aware of the grounds for that suspicion. Thirty days is the outer limit, not the plan.

3. Notify, if it is notifiable

If you have reasonable grounds to believe there has been an eligible data breach, you must notify the people at risk of serious harm and give a statement to the OAIC as soon as practicable, unless an exception applies. You notify the OAIC through its online Notifiable Data Breach form.

Tell people what happened, what information was involved, and what they should do about it. Write it in plain English. A notification the reader cannot follow has not really notified them.

4. Review it

Work out how it happened and close the gap. This is also the moment to fix the boring causes, which are usually an old export sitting in a shared drive, a former staff member's account still active, or a spreadsheet no one remembers creating.

Reduce the odds before you need this page

• Know what personal information you hold, where it lives, and who can reach it.

• Delete or de-identify what you no longer need. Most breaches involve data a business had stopped using years ago.

• Turn on multi-factor authentication on email, your CRM and anything storing customer records.

• Remove access the day someone leaves.

• Write a one page response plan naming who decides, who contacts customers, and where the log lives.

• Keep clean records of what customers agreed to, so you can identify exactly who was affected. Savira's consent records are built for that.

This is general information, not legal advice. Every business handles information a bit differently, so if you're not sure how this applies to yours, it's worth checking with a lawyer or privacy adviser.

Source: Quick reference guide for responding to data breaches, Office of the Australian Information Commissioner, published 29 June 2026. See also About the Notifiable Data Breaches scheme and When to report a data breach.