The Privacy Act & Notifiable Data Breaches Scheme

The Privacy Act 1988 is Australia’s primary law governing how organisations handle personal information. It is built around the 13 Australian Privacy Principles (APPs), which cover everything from how you collect and use data to how you secure it and allow people to access it.

Who it applies to

The Act applies to Australian Government agencies and to businesses with an annual turnover of more than $3 million, as well as some smaller organisations regardless of size — including health service providers, businesses that trade in personal information, and contractors handling government data. Even where it doesn’t strictly apply, following the APPs is good practice and a growing customer expectation.

The Notifiable Data Breaches scheme

Under the Notifiable Data Breaches (NDB) scheme, organisations covered by the Act must notify both the Office of the Australian Information Commissioner (OAIC) and affected individuals when an eligible data breach occurs — that is, unauthorised access to or loss of personal information that is likely to result in serious harm. You need a process to assess suspected breaches quickly and notify within the required timeframe.

What you should have in place

• A clear, up-to-date privacy policy and collection notices.
• Knowledge of where personal and sensitive data is stored, and access limited to those who need it.
• Encryption of sensitive data in transit and at rest.
• A documented data-breach response plan, including OAIC notification steps.
• Secure deletion of personal data you no longer need.

Penalties for serious or repeated privacy breaches have increased significantly in recent years, making readiness more important than ever. CyberSafeCheck’s assessment includes Privacy Act and NDB readiness so you can spot gaps early. See also the Essential Eight and ISO 27001.