Who the scheme covers
The scheme applies to any organisation or agency the Privacy Act covers. That includes government agencies and most businesses and not-for-profits with an annual turnover above $3 million. It also reaches private health service providers, credit reporting bodies, credit providers and tax file number recipients.
Smaller firms are not always outside it. A business under $3 million is still covered if it holds health information and provides a health service, trades in personal information, or is related to a covered business. A few other activities also bring a small firm in, such as providing services to the Commonwealth under a contract.
What counts as an eligible data breach
A data breach happens when personal information an organisation holds is lost, or is accessed or disclosed without authorisation. The OAIC gives three plain examples: a device with customer details is lost or stolen, a database is hacked, or personal information is sent to the wrong person.
Not every breach must be reported. A breach is "eligible" when three things are true:
- there was unauthorised access, unauthorised disclosure or loss of personal information the organisation holds;
- it is likely to result in serious harm to one or more people; and
- the organisation has not been able to prevent that likely harm by acting to fix it.
The last point matters. In one OAIC example, a claims firm emailed a file about 200 workers to the wrong client. The client confirmed in writing that it had deleted the file. The firm judged that this stopped the likely harm, so it did not have to notify. Quick, documented repair can change the answer.
The 30-day assessment
If a firm suspects an eligible breach, it must take all reasonable steps to finish its assessment within 30 calendar days of becoming aware of the grounds for that suspicion. The assessment must be reasonable and expeditious.
The OAIC says firms should treat 30 days as the longest allowed time, not the normal one, because the risk of harm often grows with time. If a firm cannot finish in 30 days, the OAIC recommends it write down the reasons for the delay. Containing the breach should start at once, not after the assessment ends.
What the notice must say
Once a firm has reasonable grounds to believe a breach is eligible, it must prepare a statement and give a copy to the OAIC as soon as practicable. It must also tell the people at risk. The statement must include four things:
- the firm's name and contact details;
- a description of the breach;
- the kinds of information involved; and
- the steps the firm recommends people take in response.
The OAIC expects enough detail for people to protect themselves. That can include the date range of the access, how it happened, who may have the data and what the firm has done to contain it. If direct contact is not practicable, the firm must publish the statement on its website and take reasonable steps to publicise it.
When a supplier holds your data
Many breaches happen at a supplier, such as a cloud host, payroll provider or outsourced service. The OAIC says entities often hold personal information jointly, for example when one has the files and another has legal control. A cloud provider that stores your records is taken to hold them, and so are you, because you keep contractual rights over them.
In that case an eligible breach at one is an eligible breach for both. Only one needs to notify the OAIC and the people affected, and the OAIC suggests the one with the closest relationship to those people usually does it. The risk is that each side assumes the other has acted. Your contract should say who assesses, who notifies and how fast.
If a supplier tells you about an incident, ask these questions:
- When did you first become aware, and what is the date range?
- What kinds of information were involved, and how many people?
- Has it been contained, and how do you know?
- Who is assessing serious harm, and by what date?
- Who will notify the OAIC and the people affected?
A vague answer to any of these is useful information about the supplier.
What changed in December 2024
The Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024) received assent on 10 December 2024. It has a part headed "Eligible data breaches". According to the Parliamentary Library's digest of the bill, the changes include a power for the Minister to make eligible data breach declarations, which would allow information to be shared in response to a breach. They also include infringement notices for non-compliant breach statements, which are the statements described above.
For a buyer, the practical point is that regulators have more ways to enforce the rules. The core test and the 30-day assessment are the same. Check current OAIC guidance before relying on any detail here.