If a cyber incident exposes personal information and could cause serious harm to the people involved, a business covered by the Privacy Act must assess it within 30 days and, if it is an "eligible data breach", notify both the Office of the Australian Information Commissioner (OAIC) and the affected people. Whether the rule applies to you depends on your size and the kind of information you hold, so it is worth knowing before an incident rather than during one. The OAIC received 1,205 breach notifications in 2025, the most since the scheme began in 2018, so this is no longer a rare event.
What the latest figures show
The OAIC's report, released in July 2026, counted 1,205 notifications for 2025, up 8% from 1,112 the year before. Cyber hacking remained the leading cause, and most breaches were linked to malicious or criminal activity.
Health service providers reported the most breaches, followed by financial services and government. Legal, accounting and management services also appear in the list of most-affected sectors, which matters for many Perth professional firms. The OAIC has also flagged third-party providers as a growing source of risk.
Does the scheme apply to you?
The Notifiable Data Breaches (NDB) scheme covers organisations bound by the Privacy Act 1988. In general that means:
- businesses with an annual turnover above $3 million
- health service providers of any size, including many GP, allied health and dental practices
- some other smaller businesses, such as those that trade in personal information or handle tax file numbers
If you are unsure, ask your accountant or lawyer. A small turnover does not automatically put you outside the scheme,. For a sector view, see our IT support for Perth healthcare page.
What counts as an eligible data breach
A breach is notifiable when all three of these are true:
- There is unauthorised access to, or disclosure or loss of, personal information you hold.
- That is likely to result in serious harm to one or more people (financial, physical, psychological, reputational).
- You have not been able to prevent that harm through remedial action.
Typical examples are a hacked Microsoft 365 mailbox full of client records, ransomware that exfiltrates files, a lost unencrypted laptop, or an email with personal details sent to the wrong recipient.
The 30-day clock
If you only suspect a breach, you must carry out a reasonable and expeditious assessment, and complete it within 30 days. If you conclude the breach is eligible, you must prepare a statement for the OAIC and notify affected people as soon as practicable. The statement covers who you are, what happened, what information was involved and what people should do next.
Do not read 30 days as a comfortable deadline. The assessment should start as soon as you suspect something, and the faster you contain the incident, the more likely it is that you can limit harm.
What to have ready before it happens
Most of the pain in a breach comes from not knowing what you hold or where it lives. A short checklist helps:
- Know your data. Which systems hold client, patient or staff personal information, and who has access?
- Turn on logging. Microsoft 365 audit logs and firewall logs are how you work out what was accessed. Check retention is long enough to be useful.
- Encrypt devices. A lost, encrypted laptop is far less likely to be an eligible breach.
- Keep tested backups. See our backup and disaster recovery solutions.
- Write a one-page response plan. Who decides, who calls the IT provider, who talks to clients.
- Check your suppliers. If a vendor holds your data, agree who notifies whom.
Our post on the first hour after ransomware hits a Perth office walks through the response side in more detail.
Where managed IT fits
An IT provider cannot make the legal call on whether a breach is notifiable, but it can give you the facts quickly: which accounts were accessed, what was copied, and whether the attacker is still in. That evidence is what the assessment depends on. It is also why strong IT security solutions such as multi-factor authentication, patching and monitored backups are cheaper than the clean-up.
If you want to check your readiness, call the Perth team at Computer Mechanics on (08) 9325 1196, or contact us for a no-pressure chat. For legal advice about a specific incident, speak to a lawyer or the OAIC directly.