Notifiable data breaches
Thirty days to assess, and what s 26WK requires.
General information about the law in New South Wales. It is not legal advice, it does not take account of your circumstances, and no solicitor–client relationship arises from reading it.
Who this applies to
The Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth) applies to entities covered by the Act. That includes businesses with an annual turnover over $3 million, and, regardless of turnover, health service providers, businesses that trade in personal information, credit reporting bodies, TFN recipients and contracted service providers under a Commonwealth contract.
Since 1 July 2026 the small business exemption has not protected a further group. Section 6E(1A) of the Privacy Act treats a small business operator as an organisation in relation to the activities it carries on for the purposes of, or in connection with, the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) — which, after the tranche 2 reforms, catches law practices, accountants and real estate agents. The exemption still covers the rest of what such a business does, so the question is no longer turnover but which activities the obligation attaches to.
The trigger
An eligible data breach occurs where there is unauthorised access to, unauthorised disclosure of, or loss of personal information, and a reasonable person would conclude the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates.
The 30 days
If you suspect an eligible data breach but are not sure, s 26WH requires you to carry out a reasonable and expeditious assessment within 30 days of becoming aware of the grounds for suspicion. Where you are satisfied there has been an eligible data breach, s 26WK requires you to prepare a statement and give it to the Information Commissioner as soon as practicable, and to notify affected individuals.
What the first hour generally involves
- Containment — revoking the credential, disabling the account, recalling the message, taking the system offline.
- Preservation — logs are the evidence of scope, and are not wiped.
- Record — what was accessed, whose information, when, and how it came to light.
- Assessment — whether serious harm is likely, weighing sensitivity, encryption and who obtained the data.
- Notification — where the scheme requires it, in terms that tell affected people what the risk is.
Penalties
Serious or repeated interferences with privacy attract substantial civil penalties, and the Commissioner has increasingly used them.
If this is your situation
The privacy & data page sets out what the work involves and what it costs, and the fee list gives the figure for every step.
What's happened?
Email me this guide
As a PDF. One click unsubscribes you.