Does Notifiable Data Breach (NDB) scheme apply to aged care providers?
A computed answer from the Rules Mate applicability engine, with the exact condition, the outcome for every structure and size, and the primary source.
Short answer: Yes
Yes. This obligation applies to aged care providers whatever their structure or size. The deciding fact: Provides a health service and holds health information — not covered by the small business exemption (Privacy Act s 6D(4)(b)).
The obligation in brief
Notifiable Data Breach (NDB) scheme. Under Part IIIC of the Privacy Act, APP entities must notify the OAIC and affected individuals if there has been an eligible data breach — unauthorised access, disclosure, or loss of personal information that is likely to result in serious harm. The assessment must be completed within 30 days of becoming aware.
Trigger: An eligible data breach — unauthorised access/disclosure of personal information likely to cause serious harm.
Why aged care providers get a different answer
Rules Mate runs its applicability engine across 9 business structures and 6 size bands for each of the 35 industries it maps. For 24 of those industries the answer for "Notifiable Data Breach (NDB) scheme" is it depends on structure or size. Aged care providers is one of the 11 where the answer is different: yes.
The deciding fact for aged care providers: Provides a health service and holds health information — not covered by the small business exemption (Privacy Act s 6D(4)(b))
About the industry: Residential and home-care providers under the new Aged Care Act 2024 (in force 1 November 2025).
Compare a professional services (general) business with 6–19 employees structured as a Pty Ltd company: the obligation does not apply (Requires APP-entity status (turnover > $3M or a s 6D(4) carve-out)).
Answer by business structure and size
Each cell is the engine's outcome for a business in aged care providers with that structure and size, assuming it sells to consumers and small businesses and holds customer contact details. "Check" means the obligation turns on a fact the industry does not settle.
| Structure | No employees | 1–5 employees | 6–19 employees | 20–99 employees | 100–499 employees | 500+ employees |
|---|---|---|---|---|---|---|
| Sole trader | Yes | Yes | Yes | Yes | Yes | Yes |
| Partnership | Yes | Yes | Yes | Yes | Yes | Yes |
| Trust | Yes | Yes | Yes | Yes | Yes | Yes |
| Pty Ltd company | Yes | Yes | Yes | Yes | Yes | Yes |
| Public company | Yes | Yes | Yes | Yes | Yes | Yes |
| Not-for-profit (unregistered) | Yes | Yes | Yes | Yes | Yes | Yes |
| Registered charity | Yes | Yes | Yes | Yes | Yes | Yes |
| Super fund | Yes | Yes | Yes | Yes | Yes | Yes |
| Foreign company | Yes | Yes | Yes | Yes | Yes | Yes |
What the obligation requires
- When due
- Notification 'as soon as practicable' after the entity is aware it is an eligible breach. Assessment within 30 days.
- Evidence to keep
- Breach assessment record, OAIC notification, individual notification, remediation steps log.
- Maximum penalty
- Up to $50M, or 3× benefit, or 30% of adjusted turnover (whichever is greater) for serious or repeated interferences
- Regulator
- OAIC
- Jurisdiction
- Commonwealth (national)
Other obligations where aged care providers differ from the norm
- APP 12 & APP 13 access and correction requests: Yes
- APP 7 direct marketing: consent, opt-out & when you can't message (2026): Yes
- Privacy Act Reform — information controllers regime (proposed Tranche 2): Yes
- Provide an APP 5 collection notice at or before collection: Yes
- Publish a Privacy Policy that meets APP 1: Yes
- APP 2 — anonymity + pseudonymity for individuals: Yes
- All 19 answers for aged care providers
Other industries with a non-default answer
Questions
- Does Notifiable Data Breach (NDB) scheme apply to aged care providers?
- Yes. This obligation applies to aged care providers whatever their structure or size. The deciding fact: Provides a health service and holds health information — not covered by the small business exemption (Privacy Act s 6D(4)(b)).
- Is the answer the same for every industry?
- No. For 24 of the 35 industries Rules Mate maps, the answer is it depends on structure or size. Aged care providers is one of 11 industries with a different answer.
Related
Sources
Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.