Does Notifiable Data Breach (NDB) scheme apply to accountants and bookkeepers?

Notifiable Data Breach (NDB) scheme. Under Part IIIC of the Privacy Act, APP entities must notify the OAIC and affected individuals if there has been an eligible data breach — unauthorised access, disclosure, or loss of personal information that is likely to result in serious harm. The assessment must be completed within 30 days of becoming aware.

Trigger: An eligible data breach — unauthorised access/disclosure of personal information likely to cause serious harm.

Rules Mate runs its applicability engine across 9 business structures and 6 size bands for each of the 35 industries it maps. For 24 of those industries the answer for "Notifiable Data Breach (NDB) scheme" is it depends on structure or size. Accountants & bookkeepers is one of the 11 where the answer is different: yes.

The deciding fact for accountants and bookkeepers: AML/CTF reporting entity — covered by the Privacy Act for AML/CTF activities (s 6E(1A))

About the industry: Professional accounting and bookkeeping firms. Captured by Tranche 2 when providing designated services such as managing client money or company formation.

Compare a professional services (general) business with 6–19 employees structured as a Pty Ltd company: the obligation does not apply (Requires APP-entity status (turnover > $3M or a s 6D(4) carve-out)).

Each cell is the engine's outcome for a business in accountants & bookkeepers with that structure and size, assuming it sells to consumers and small businesses and holds customer contact details. "Check" means the obligation turns on a fact the industry does not settle.

When due

Notification 'as soon as practicable' after the entity is aware it is an eligible breach. Assessment within 30 days.

Evidence to keep

Breach assessment record, OAIC notification, individual notification, remediation steps log.

Maximum penalty

Up to $50M, or 3× benefit, or 30% of adjusted turnover (whichever is greater) for serious or repeated interferences

Regulator

OAIC

Jurisdiction

Commonwealth (national)

• APP 12 & APP 13 access and correction requests: Yes
• APP 7 direct marketing: consent, opt-out & when you can't message (2026): Yes
• Prepare for the proposed removal of the small business exemption: No
• Privacy Act Reform — information controllers regime (proposed Tranche 2): Yes
• Provide an APP 5 collection notice at or before collection: Yes
• Publish a Privacy Policy that meets APP 1: Yes
• All 23 answers for accountants & bookkeepers

• Real estate agents: Yes
• Trust & company service providers: Yes
• Precious metals & stones dealers: Yes
• Aged care providers: Yes