A company suffered a data breach exposing my personal details. Are they required to notify me?

What the Law Says

Australia’s privacy laws require organisations to notify individuals and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to result in serious harm.

The requirement comes from the Notifiable Data Breaches (NDB) scheme, introduced in 2018 as an amendment to the Privacy Act 1988. It applies to all entities bound by the Australian Privacy Principles (APPs), including most businesses with an annual turnover over $3 million, health service providers, and credit reporting bodies.

An 'eligible data breach' occurs when there is unauthorised access to, or unauthorised disclosure of, personal information — or loss of personal information — that a reasonable person would conclude is likely to result in serious harm to any of the individuals affected.

Once an organisation becomes aware that an eligible data breach has occurred, it must prepare a statement and notify both the affected individuals and the OAIC as soon as practicable — and no later than 30 days after becoming aware.

Statutory Text

An entity must notify the Commissioner and affected individuals about an eligible data breach as soon as practicable after the entity becomes aware that the breach has occurred.

— Privacy Act 1988, s. 26WE — Notification of eligible data breaches

Statutory Text

An eligible data breach occurs if: (a) there is unauthorised access to, or unauthorised disclosure of, personal information; or (b) personal information is lost in circumstances where unauthorised access to, or unauthorised disclosure of, the information is likely to occur; and a reasonable person would conclude that the access, disclosure or loss would be likely to result in serious harm to any of the individuals to whom the information relates.

— Privacy Act 1988, s. 26WE(2) — Definition of eligible data breach

What to Do

Sources