A data breach is not only a hack. A staff member emailing a customer list to the wrong person, a lost laptop or a misconfigured cloud folder can all count. If your business is covered by the Privacy Act, there is a scheme that tells you what to do next.
When the scheme applies
The Notifiable Data Breaches scheme applies when there is unauthorised access to, or unauthorised disclosure or loss of, personal information, and the incident is likely to result in serious harm to the people affected. If you can prevent that likely harm with quick action, notification may not be required.
The basic steps
- Contain it. Stop the exposure first: change passwords, remove access, recall the email.
- Assess it. If you suspect an eligible breach, you are expected to assess it quickly, and the assessment should be completed within 30 days.
- Notify. If it is an eligible breach, notify the Office of the Australian Information Commissioner (OAIC) and the affected individuals.
- Review. Work out what failed and fix it so it does not happen again.
Why preparation matters
Businesses that have a short written plan, know who decides, and keep a simple register of what personal information they hold, move faster and make fewer mistakes under pressure. Not knowing what data you hold is one of the most common reasons an assessment drags out.
What to do this week
- List where customer information lives, including email, spreadsheets, cloud tools and paper
- Decide who in the business makes the call if something goes wrong
- Turn on two-step login for email and key systems
- Check that your privacy policy tells people how to contact you
This is general information, not legal advice. If you think you have had a breach, speak with a qualified privacy lawyer and see the OAIC guidance.