Who must comply with Notifiable Data Breach (NDB) scheme?

Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.

Under Part IIIC of the Privacy Act, APP entities must notify the OAIC and affected individuals if there has been an eligible data breach — unauthorised access, disclosure, or loss of personal information that is likely to result in serious harm. The assessment must be completed within 30 days of becoming aware. From the 2024 amendments, statutory tort for serious invasions of privacy is now actionable.

Applies when the business has APP-entity status (turnover > $3M or a s 6D(4) carve-out).

How the regulator frames it: All APP entities (Australian Government agencies and organisations with annual turnover >$3M, plus carved-in entities). Removal of the small business exemption is proposed in a future privacy reform tranche — not yet law.

What triggers it: An eligible data breach — unauthorised access/disclosure of personal information likely to cause serious harm.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (11 of 35: yes; 24 of 35: depends on size or structure).

Structure does not change the answer across all industries: for every structure the answer is "depends on size or structure".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: applies. AML/CTF reporting entity — covered by the Privacy Act for AML/CTF activities (s 6E(1A))
• Pty Ltd company in fintech (non-bank) with 6–19 employees, turnover $1M–$3M: does not apply. Requires APP-entity status (turnover > $3M or a s 6D(4) carve-out)

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business deals in crypto-assets or runs a digital currency exchange: it then applies (AML/CTF reporting entity — covered by the Privacy Act for AML/CTF activities (s 6E(1A))).
• The business is a registered NDIS provider: it then applies (provides a health service and holds health information — not covered by the small business exemption (Privacy Act s 6D(4)(b))).
• The business is an approved aged care provider: it then applies (provides a health service and holds health information — not covered by the small business exemption (Privacy Act s 6D(4)(b))).
• The business supplies government customers: it then applies (government customer — contracted service providers to the Commonwealth are covered (Privacy Act s 6D(4)(e))).

When due

Notification 'as soon as practicable' after the entity is aware it is an eligible breach. Assessment within 30 days.

Frequency

When a triggering event occurs

Evidence to keep

Breach assessment record, OAIC notification, individual notification, remediation steps log.

Status

Current

Priority

Critical

Maximum penalty: Up to $50M, or 3× benefit, or 30% of adjusted turnover (whichever is greater) for serious or repeated interferences.

Self-assessment. Authority: Privacy Act 1988 (Cth) Part IIIC (ss26WE-26WR).

Frequency: Event-driven. Assess a suspected eligible data breach within 30 days; notify the OAIC and affected individuals as soon as practicable.

Who can perform it: The entity itself. No independent audit is required.

• OAIC investigation — Optus 2022 data breach (2025): Telco-scale breaches face $50M+ exposure under new regime; board oversight expectations + cyber spend now backed by penalty.
• OAIC investigation into Australian Clinical Labs (Medlab) (2024): M&A integration of acquired entities must include a complete privacy and security due-diligence sweep; APP 11 obligations don't pause during integration.
• OAIC v Medibank Private Limited (2024): APP 11 reasonable-steps obligation now backed by civil penalties up to $50M / 30% turnover. Boards must understand and oversee information security capability.

If this obligation applies to you, so do these 4: the engine uses the same rule for each.

• Publish a Privacy Policy that meets APP 1
• Provide an APP 5 collection notice at or before collection
• APP 12 & APP 13 access and correction requests
• APP 2 — anonymity + pseudonymity for individuals

• APP 3 collection of sensitive information: APP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.
• Automated decision-making transparency in your privacy policy (APP 1.7–1.9): From 10 December 2026, APP entities that use computer programs to make or substantially assist decisions that significantly affect individuals must say so in their APP privacy policy.
• APP 7 direct marketing: consent, opt-out & when you can't message (2026): APP 7 restricts using or disclosing personal information for direct marketing and requires a simple opt-out — when it applies, the exceptions and penalties.
• APP 8 cross-border disclosure: Before disclosing personal information overseas, APP 8 requires reasonable steps so the recipient meets the APPs — unless an exception applies. Steps and exceptions.
• Children's Online Privacy Code 2026: OAIC developing a mandatory children's online privacy code — must be registered by 10 December 2026 (commencement not yet fixed).

Across the 1,890 business profiles Rules Mate evaluates, these obligations apply to most of the businesses this one applies to, and are far more common among them than among businesses generally:

• APP 7 direct marketing: consent, opt-out & when you can't message (2026): applies to 100% of the same businesses (1.5× the overall rate)
• Privacy Act Reform — information controllers regime (proposed Tranche 2): applies to 100% of the same businesses (1.5× the overall rate)

Rules Mate tracks 20 published obligations tagged "privacy", 3 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 4 of those apply outright. This obligation is rated critical priority, and is triggered by events.

Regulated by Office of the Australian Information Commissioner.

OAIC: Privacy and freedom of information regulator. Administers the Privacy Act 1988, the Notifiable Data Breaches scheme, and the Australian Privacy Principles.

• Office of the Australian Information Commissioner

Privacy Act 1988: Federal privacy Act.

• Privacy Act 1988

Free tools that help with this obligation:

• Privacy Act 2026 readiness
• NDB notification timer
• Marketing compliance check (Spam Act)