The Notifiable Data Breaches scheme and small business: who is covered and what to do

The Notifiable Data Breaches scheme is the part of Australia’s Privacy Act 1988 that requires a covered organisation to tell affected people and the Australian Information Commissioner when personal information is lost, accessed or disclosed without authorisation and serious harm is likely. Most businesses with annual turnover of $3 million or less are outside the Act, but some are covered whatever their size, including health service providers and businesses that trade in personal information.

This article sets out who the scheme covers, what counts as an eligible data breach, and what to do in the first 30 days, using the text of the Act itself. It is general information about Australian law, not legal advice. The Office of the Australian Information Commissioner (OAIC) runs the scheme, so check its guidance at oaic.gov.au for your situation, or ask a lawyer.

What is the Notifiable Data Breaches scheme?

The scheme sits in Part IIIC of the Privacy Act 1988 (we read Compilation No. 104, compiled 4 June 2026). The Act’s own summary in section 26WA says an eligible data breach happens when there is unauthorised access to, unauthorised disclosure of, or loss of personal information held by an entity, and that is likely to result in serious harm to any of the people the information is about.

When an entity has reasonable grounds to believe that has happened, it must give a notification. The Commissioner can also direct an entity to notify.

Is your small business covered by the Notifiable Data Breaches scheme?

The scheme applies to organisations covered by the Privacy Act, so the first question is whether the Act covers you at all. Section 6D says a business is a small business if its annual turnover for the previous financial year was $3,000,000 or less. A small business operator is generally outside the Act.

Section 6D(4) then lists businesses that are not treated as small business operators, whatever their turnover. They include a business that:

• has had annual turnover of more than $3,000,000 in a past financial year (after the later of when it started and when the section began);
• provides a health service to someone and holds any health information, other than in an employee record;
• discloses personal information about someone to anyone else for a benefit, service or advantage;
• provides a benefit, service or advantage to collect personal information about someone from anyone else;
• is a contracted service provider for a Commonwealth contract; or
• is a credit reporting body.

There are limits on the two personal information trading points, for example where the person consented or the disclosure or collection is required or authorised by law. Section 6D(9) also says a company is not a small business operator if it is related to a company that carries on a business that isn’t small.

A few other routes bring a small business in:

• Some regulated activities. Section 6E applies the Act to a small business for certain activities, including those connected with the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.
• Choosing in. Section 6EA lets a small business choose, in writing to the Commissioner, to be treated as an organisation.
• Tax file numbers. Part IIIC also applies to tax file number information held by a file number recipient (section 26WE(1)(d)), and section 11 treats anyone holding a record containing tax file number information as one. Employers hold staff tax file numbers, so check the OAIC’s guidance on how this applies to you.

Clinics, allied health practices and many health and fitness businesses fall into the health service category, so assume you are covered until you have checked.

What counts as an eligible data breach?

Under section 26WE(2), there are two kinds:

• Access or disclosure. There is unauthorised access to, or disclosure of, the information, and a reasonable person would conclude it would be likely to result in serious harm to any of the people it relates to.
• Loss. The information is lost where unauthorised access or disclosure is likely to follow, and if it did, a reasonable person would conclude serious harm would be likely.

Everyday examples a small office might face include a spreadsheet of client details emailed to the wrong person, a staff mailbox taken over by someone who guessed the password, a laptop left in a taxi, or a website form whose submissions became publicly visible. Whether any one of these is an eligible data breach turns on the serious harm test.

How to judge serious harm

Section 26WG lists what to weigh when deciding whether serious harm is likely:

• the kind of information, and how sensitive it is;
• whether it was protected by security measures, and how likely those could be overcome;
• who has obtained it, or could;
• if it was encrypted or otherwise made unreadable, how likely it is that people intending harm could get the key or the means to read it;
• the nature of the harm; and
• any other relevant matters.

Health details, identity documents, bank details and tax file numbers weigh heavily on the kind and sensitivity tests. A list of first names with no contact details sits at the other end.

Acting quickly can change the outcome

Section 26WF covers remedial action. If you act on an unauthorised access or disclosure before it causes serious harm, and as a result a reasonable person would conclude serious harm is no longer likely, it is not an eligible data breach. For lost information, if you act before anyone gets unauthorised access and as a result nobody does, the loss is not an eligible data breach either.

A common case: an email with client details goes to the wrong address, you contact the recipient straight away, and they confirm they deleted it without forwarding it. Act first, and keep a record of what you did and when.

What to do after a data breach: the steps and the 30 days

1. Contain it. Change passwords, revoke access, recall or ask for deletion of the email, and lock the device or account. Our website security checklist covers what to do if your website is hacked.
2. Assess it. If you have reasonable grounds to suspect an eligible data breach, section 26WH requires a reasonable and expeditious assessment, and you must take all reasonable steps to finish it within 30 days of becoming aware.
3. Prepare a statement. If you have reasonable grounds to believe there has been an eligible data breach, section 26WK requires you to prepare a statement and give a copy to the Commissioner as soon as practicable. It must set out your identity and contact details, a description of the breach, the kinds of information involved, and the steps people should take in response.
4. Notify the people affected. Section 26WL requires you, as soon as practicable after preparing the statement, to take reasonable steps to tell either everyone whose information was involved or everyone at risk. If neither is practicable, you publish the statement on your website and take reasonable steps to publicise it. You may use the way you normally communicate with each person, such as email or text.
5. Fix the cause. Work out how it happened and close the gap so it doesn’t repeat.

Check oaic.gov.au for how to lodge the statement with the Commissioner and for its guidance on each step.

Preparing before anything goes wrong

Australian Privacy Principle 11.1 requires an entity covered by the Act to take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. APP 11.3 says those steps include technical and organisational measures. APP 11.2 requires reasonable steps to destroy or de-identify information you no longer need.

For a ten-person business, that usually means:

• A one-page response plan: who decides, who contacts the IT provider, where the OAIC form is, and how you will reach clients.
• Multi-factor authentication on email, the CRM and the website.
• Collecting only what you need on forms, and deleting old records you have no reason to keep.
• Backups you have tested. See our guide to website backups.
• A privacy policy that matches what you actually collect. Our guide to website privacy policies in Australia covers what goes in one.

If you use AI tools with client information, the same rules apply to them. Our guide to AI and the Privacy Act covers that. CentriWeb sets up and looks after websites, CRMs and hosting with access controls, backups and logging in place, which makes a breach easier to contain and to assess.

Outside Australia

The Notifiable Data Breaches scheme is Australian law, and everything above comes from the Australian Privacy Act. If your business also operates in, or holds information about people in, New Zealand, the United States, Canada, the United Kingdom or elsewhere, check each country’s own privacy and breach rules separately.