If the Privacy Act covers your business and you have a data breach that's likely to cause serious harm, you must notify the OAIC and the people affected. Many privacy policies don't mention this at all, including some from Australia's largest companies.
NDB scheme included • 5 minutes • No subscription required
The Notifiable Data Breaches scheme has been mandatory for Australian Privacy Act-covered entities since 1 February 2018.
An "eligible data breach" occurs when personal information is accessed or disclosed without authorisation, and the breach is likely to result in serious harm to one or more individuals. This includes cyberattacks, accidental disclosures, and lost devices containing personal data.
If you suspect an eligible data breach, you have 30 days to assess it. Once you believe one has happened, you must notify the OAIC and the people affected as soon as practicable, and take steps to reduce the risk of harm. Failing to notify when required is itself a breach of the Privacy Act.
Since December 2022, the maximum penalty for a serious interference with privacy is $50 million for companies, or more if based on the benefit gained or turnover. Since December 2024, the OAIC can also issue infringement notices without going to court, and it began its first sweep of privacy policies in 2026.
0 of 8
Australian company privacy policies we reviewed in October 2025, from ASX-listed companies to small online brands, explained how they'd handle a data breach under the NDB scheme.
Many privacy policy generators are built for the US market and adapted for other countries. The US has no single federal breach notification law, only separate state laws, so US-built templates follow US frameworks that don't map onto Australia's NDB scheme.
The NDB scheme has applied since February 2018. Eight years on, it's still one of the sections most often missing from Australian privacy policies, even at large companies with legal teams.
What's Covered
The Privacy Act doesn't strictly require your privacy policy to mention the NDB scheme. But APP 1 asks you to be open about how you manage personal information, and telling customers what happens after a breach shows them you have a plan.
A good NDB section covers what counts as an eligible data breach, how you assess and respond to one, how affected people can contact you, and where they can get more information from the OAIC.
Every ComplianceKit policy includes a full NDB scheme section, written in plain English
Clear explanation of breach notification obligations for both the OAIC and affected individuals
With Managed Compliance, your NDB section updates automatically when requirements change