If your organisation is covered by the Privacy Act and personal information is lost or accessed without authorisation in a way likely to cause serious harm, it is generally an eligible data breach. You must notify the OAIC and the affected individuals. Many small businesses under $3 million turnover are exempt from the Privacy Act — but not all, and the exemptions are narrower than people assume.
What it depends on
The full answer depends on your specific circumstances. Here’s what matters.
Whether the Privacy Act covers you
Businesses with annual turnover above $3 million are covered, as are some smaller ones — for example health service providers and businesses that trade in personal information.
Likelihood of serious harm
Consider the type of information (financial, identity, health), who may have it, and whether remedial action has removed the risk.
The assessment clock
If you suspect an eligible breach, you must take reasonable steps to complete an assessment within 30 days.
The last 10%
What a qualified professional can add
The answer above covers the general position. Here’s where professional judgement — applied to YOUR specific situation — makes the difference.
- Confirming whether the Privacy Act and NDB scheme apply to you
- Containing the breach and establishing what data was exposed
- Preparing OAIC and customer notifications that are accurate
Questions to ask before you engage one
If you decide to engage a professional, these questions help you evaluate whether they’re right for your situation.
Are we covered by the Privacy Act, or does an exemption apply?
Do we have a data breach response plan, and who owns it?
What personal information do we hold that we no longer need?
Would our insurance cover breach response costs?
Did this answer your question?
General Advice Warning
The information on this page is general in nature and does not take into account your personal objectives, financial situation or needs. It is provided by Global Mutual Funds Pty Ltd (ABN 20 090 555 436, AFSL 222640) and should not be relied upon as a substitute for professional advice. Consider whether the information is appropriate before acting on it. Read our Financial Services Guide.