How the Notifiable Data Breaches scheme works in Australia

What is an eligible data breach

The OAIC says a data breach happens when personal information is lost or subjected to unauthorised access or disclosure ¹. An eligible data breach meets three conditions set out in the guidance ³.

• There is unauthorised access to, unauthorised disclosure of, or loss of personal information the entity holds ³.
• The breach is likely to result in serious harm to one or more individuals ³.
• The entity has not been able to prevent the likely risk of serious harm with remedial action ³.

Assessing a suspected breach within 30 days

An entity that is aware of reasonable grounds to suspect an eligible data breach may have occurred must carry out a reasonable and expeditious assessment under section 26WH of the Privacy Act ³. The OAIC guidance says the entity must take all reasonable steps to complete the assessment within 30 calendar days of becoming aware of the grounds ³.

Serious harm factors

Section 26WG sets out a list of relevant matters for judging whether access or disclosure would be likely to result in serious harm ³. The guidance describes them as a non-exhaustive list ³.

• The kind or kinds of information involved ³.
• The sensitivity of the information ³.
• Whether the information is protected by one or more security measures ³.
• The persons, or kinds of persons, who have obtained or could obtain the information ³.
• The nature of the harm ³.

Notifying the Commissioner and individuals

An entity prepares a statement about the breach and gives a copy to the Commissioner as soon as practicable under section 26WK ³. It notifies affected individuals as soon as practicable after completing that statement under section 26WL ³. The notice to individuals must include recommendations about the steps they should take in response to the breach ¹. Notice to the OAIC is made through the online Notifiable Data Breach form ¹.

Figures for July to December 2024 and for 2025

The OAIC received 595 notifications in the period 1 July to 31 December 2024, with statistics current as of 11 February 2025 ⁴. The report attributed 404 breaches, 69%, to malicious or criminal attack ⁴. The table below shows the top sectors in that half-year report ⁴.

Newer figures cover calendar year 2025. The OAIC's release of 6 July 2026 gave 1,205 notifications for 2025, up 8% from 1,112 in 2024, with health service providers again notifying the most, 225 ⁵. Malicious or criminal attacks caused 716 of the 2025 notifications ⁵.