Breach notices
Data breach notification in Australia
Short answer
- Start date
- Breaches from 22 February 2018 2
- Assessment time
- 30 calendar days, s 26WH(2) 3
- Statement to OAIC
- As soon as practicable, s 26WK(2) 3
- Notifications in 2024
- 1,113 (518 in January to June, 595 in July to December) 4
- OAIC phone
- 1300 363 992 1
What counts as an eligible data breach
The OAIC sets out three conditions 2. There is unauthorised access to, unauthorised disclosure of, or loss of personal information. The breach is likely to result in serious harm to one or more individuals. The entity has not been able to prevent the likely risk of serious harm with remedial action 2.
A breach that occurred before 22 February 2018 is not an eligible data breach 2. The OAIC suggests treating a breach that began before that date but continued after it as covered 2.
Steps and deadlines
Failure to meet any of these steps is an interference with privacy under s 13(4A), which opens the Commissioner's enforcement powers 3.
- Contain the breach and take remedial action where possible 3.
- Assess a suspected breach quickly. Take all reasonable steps to finish within 30 calendar days of becoming aware of the grounds for suspicion, under s 26WH(2) 3.
- If the 30 days cannot be met, document the steps taken and the reasons for the delay, as the Commissioner recommends 3.
- Prepare a statement and give a copy to the Commissioner as soon as practicable after becoming aware of an eligible breach, under s 26WK(2) 3.
- Notify individuals of the contents of the statement as soon as practicable after completing it, under s 26WL(3) 3.
Three ways to notify individuals
Any reasonable method can be used for options 1 and 2, such as a phone call, SMS, mail, a social media post or an in-person conversation 3. A published notice under option 3 must not contain personal information 3.
| Option | When it can be used | Legal basis |
|---|---|---|
| 1. Notify all individuals whose data was involved | Where practicable 3 | s 26WL(2)(a) 3 |
| 2. Notify only those at risk of serious harm | Where practicable 3 | s 26WL(2)(b) 3 |
| 3. Publish the statement on the entity's website and publicise it | Only if options 1 and 2 are not practicable 3 | s 26WL(2) 3 |
What the July to December 2024 report shows
The OAIC published its report for July to December 2024 on 13 May 2025 4. Figures are current as of 11 February 2025 and may change as notifications are assessed 4. Notifications under the My Health Records Act 2012 are excluded 4.
| Measure, July to December 2024 | Figure |
|---|---|
| Notifications received | 595 4 |
| Malicious or criminal attacks | 404 notifications 4 |
| Cyber incidents within that group | 247 notifications 4 |
| Ransomware notifications | 60 4 |
| Phishing notifications | 84 4 |
| Human error notifications | 170 4 |
| Health service providers | 121 notifications, 20% of the total 4 |
| Australian Government agencies | 100 notifications, 17% 4 |
| Finance, including superannuation | 54 notifications, 9% 4 |
Where the reports are published
The OAIC lists every scheme report on its publications page, from the first quarterly report for 1 January to 31 March 2018 to the half-yearly reports for 2024 5. Reports were quarterly in 2018 and the first half of 2019 and became half-yearly from July 2019 5. The OAIC phone line is 1300 363 992, Monday to Thursday, 10 am to 4 pm AEST or AEDT 1.
Common questions
How long does an Australian business have to report a data breach?
It must assess a suspected breach within 30 calendar days and give the statement to the OAIC as soon as practicable after it knows an eligible breach occurred 3.
Who must notify under the NDB scheme?
Any organisation or agency the Privacy Act 1988 covers 1.
Can a company post a notice online instead of contacting people?
Only if notifying all individuals, or only those at risk, is not practicable 3.
How many breaches were reported to the OAIC in 2024?
1,113 notifications, with 518 in January to June and 595 in July to December 4.
What was the most common source of breaches in late 2024?
Malicious or criminal attacks, with 404 of the notifications classified by source 4.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@noticeofrecord.com.
Sources
Related
- Data breach notification laws compared
How breach notice rules differ in the EU, UK, US, Australia, Canada and India: who must notify, the deadline and who receives the notice.
- How to check whether a notice was given
Where to look up official notices: state breach lists, the HHS breach portal, SEC EDGAR, FDA warning letters, FCA notices, WARN reports and recall lists.
- Data breach and incident notification in the United Kingdom
UK breach reporting duties under the UK GDPR, the Data Protection Act 2018, PECR and the NIS Regulations, with deadlines and fine caps.
- Data breach notification in Singapore and India
Singapore's PDPA breach rules (3 calendar days, 500 people) and India's CERT-In 6 hour reporting and DPDP Rules 2025, with official sources.