Privacy Act Reform Deep Dive: Data Breach Notification

The proposals for reform of Australia’s Privacy Act released for consultation on 31 August 2026 extend to almost all the existing Australian Privacy Principles. There are also some notable changes proposed for the Notifiable Data Breaches (NDB) scheme which are important to examine.

Privacy 108 has produced a series of resources to support an understanding of the proposed changes including:

• A blog post covering the major proposed changes: Australia’s Next Wave of Privacy Reforms: Unexpectedly Bold but also Timid
• A webinar of our team discussing the changes Privacy 108 Webinar on the Privacy Reforms 2026: Consultation on Exposure Draft
• Our submission to the government on the Exposure Draft – Privacy Amendments

Our team is also doing more detailed overviews of different proposed amendments we think will have a major impact on Australian organisations.  This is the second in our series of these deep dives into the various proposed changes.  Our first deep dive covered APP 11 (Security and Destruction / De-identification).

This deep dive looks more closely at the proposed changes to the current data breach notification scheme operating under the Privacy Act.

Proposed Changes to Data Breach Notification

Substantial changes are proposed to the existing NDB scheme addressing some of the issues with the scheme since its introduction but also re-focusing the intent of the provisions being the prevention or minimisation of harm to people affected by a breach.

This should help move thinking about data breaches from compliance to protecting individuals. This is a focus which sometimes seems to be lost in data breach response activities where meeting regulatory requirements often seems to become the main driver.

Proposed changes include:

• Definitional changes including the introduction of the idea of a ‘data breach’, which in turn supports the extension of some obligations to all data breaches (not just notifiable eligible data breaches);
• New accountability requirements including practices to enable effective response;
• Changed notification obligations in terms of timing and content;
• New powers for the Office of the Australian Information Commissioner (OAIC).

Definitions

A new definition of ‘data breach’ will be introduced to include any unauthorised access to or disclosure of personal information or loss of information in circumstances where there is likely to be an unauthorised access to or disclosure of the information.^[1]

This new and separate definition of ‘data breach’ will clarify that obligations under the NDB scheme to manage and contain a data breach apply even if the serious harm threshold for an eligible data breach is not met.

It will also distinguish a data breach from an ‘eligible data breach’ which continues to be a data breach where a reasonable person would conclude that the data breach is likely to result in serious harm to one or more individuals to whom the information relates.^[2] 

The definition of eligible data breach will be amended to clarify when an individual is considered to be ‘at risk’ of an eligible data breach, which will be if:

• Information that relates to the individual is involved in the data breach; and
• A reasonable person would conclude that the data breach would be likely to result in serious harm to the individual.[3]

The Consultation Paper says this will provide a clearer threshold for entities to determine whether an individual is at risk.[4]    Further on-going guidance from the OAIC on what it regards as serious harm would be immensely helpful in this area, particularly in the context of new technologies such as the use of AI

Practices to enable effective responses

Organisations will expressly be required to take reasonable steps to implement practices, procedures and systems that enable them to respond effectively to data breaches and prevent or reduce harm to affected individuals.

This will help ensure entities are prepared to respond to all actual or suspected data breaches, not just eligible data breaches, and can take timely action to prevent or reduce harm.  This will include meeting any notification obligations under the NDB scheme and puts the focus on preventing or reducing harm to affected people.

This is likely to cover not just having a Data Breach Response Plan but also training to support that plan, easy to find and use notification capability, clearly allocated responsibilities and playbooks for different scenarios in addition to systems to identify when data breaches may have occurred.

Obligation to mitigate harm

The new focus on protecting against harm is more specifically called out in the obligation to take reasonable steps to prevent or reduce harm arising from a data breach (not just eligible data breaches).

The proposed amendment will provide that, as soon as practicable after becoming aware of reasonable grounds to believe or suspect that a data breach has occurred, an entity must take reasonable steps to protect affected individuals whose personal information may have been compromised.

This obligation would apply to actual and suspected data breaches, including eligible data breaches but also those data breaches that don’t meet that threshold, and requires entities to take steps to mitigate harm at the earliest opportunity.  This removes the issue of determining whether a data breach is an eligible data breach before determining whether any action should be taken and ensures that harm is mitigated in all cases of unauthorised access, destruction or loss.

Examples of mitigation measures include disabling compromised accounts, containing unauthorised access to systems, notifying relevant third parties to assist in preventing harm, and providing individuals with information on how they can protect themselves.

Exception for remedial action

The proposed amendments would simplify and clarify the existing remedial action exception to reflect the new definition of a data breach, without changing how the exception operates. The exception will continue to apply where a breach would likely cause serious harm, but remedial action prevents that harm from eventuating, in which case the breach is treated as if it was never an eligible data breach.

Timing of the remedial action is linked to the type of breach.  The exception covers two scenarios with different timing for the remedial action:

1. unauthorised access or disclosure where remedial action is taken before serious harm occurs, and
2. loss of personal information where remedial action is taken before or after any unauthorised access or disclosure (for example, recovering lost hard-copy records before anyone reads them, or locking down a compromised database before any information is copied, downloaded, altered or further disclosed).

Eligible Data Breaches and Notification obligations

Timing of notification

The notification requirements to the OAIC would be strengthened through a clearer 72-hour timeframe (aligning with frameworks like the Security of Critical Infrastructure Act 2018 and Cyber Security Act 2024). The 72 hours starts on the organisation becoming aware of reasonable grounds to believe that an eligible data breach has occurred.

The current provisions around assessing suspected eligible data breaches will remain.

Notice to affected individuals will be required at the same time as notification to the OAIC if practicable and otherwise as soon as practicable thereafter.

Incomplete Notification Statements

A new provision for incomplete statements will be included where a complete one isn’t practicable within 72 hours.

Incomplete statements can be submitted within the 72-hour period with outstanding information provided later.  Where submitting an incomplete statement, the organisation must also provide written notice stating that the statement is incomplete, identifying the matters that are missing, and explaining why it was impossible or impracticable to provide that information within the 72-hour period.

Written notice of the missing matters must be provided as soon as practicable.

Organisations must also give notice of any material error or change in the information in any notice as soon as practicable. This recognises that information provided during a data breach investigation may change as further information becomes available.

Failure to provide any statement within 72 hours may result in an infringement notice or compliance notice and constitutes an interference with the privacy of an individual.

Notification Statement

There is an expanded list of required content including the entity’s response and mitigation steps.

 The information to be included in the notice has been updated to include information about the entity’s response to the breach, including steps taken or proposed to reduce harm to affected individuals.

Commissioner may direct entity to notify eligible data breach

The proposed amendments would align the Commissioner’s direction power with the updated notification framework, allowing the Commissioner to direct an entity to provide a statement (within 72 hours or a longer allowed period) and notify affected individuals, with the same core content requirements as a non-directed statement, and preserving remedial action as a basis for not requiring individual notification.[5]

How Does this Compare with the Previous Proposals?

These amendments are aligned with those previously proposed.  They are consistent with fine-tuning the notification process, recognising that data breach investigations can be complex and reveal significant new information as they progress.

It may have been worth setting up a different notification regime for processors (which are now recognised under the new Schedule 6 Exception for information processors). One of the issues with Australia’s current NDB scheme is that every organisation impacted by a data breach must notify, even where that organisation is a processor acting on another entity’s instructions.  A clarification of the notification obligations of processors and controllers similar to that in the GDPR would have helped with this complex notification web.

Concluding Thoughts

Overall, the proposed reforms are timely and should help drive more mature security, data minimisation and breach response practices. The stronger focus on preventing and reducing harm to individuals is particularly welcome. It should help re-centre the NDB scheme on protecting people rather than simply completing a compliance exercise.

However the reforms miss an opportunity to clarify notification obligations as between processors and controllers. As drafted, the reforms represent a useful and practical uplift, but leave some important questions for guidance, regulatory practice and future reform.

---

[1] See new Section 26WA (2)

[2] See new Section 26WE

[3] See new Section 26WE (2).

[4] Privacy Reform – Consultation Paper, page 24.

[5] See new section 26WR.