Notifiable Data Breaches scheme
The scheme binds entities that must protect personal information under APP 11. It does not automatically cover every small practice.
Part IIIC of the Privacy Act requires notification of eligible data breaches that are likely to cause serious harm, including changes made in 2024.
MaintainedLast reviewed
Key facts
- Issued by
- Office of the Australian Information Commissioner
- Sources listed
- 2
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
The OAIC’s guide, updated February 2025, says the Privacy Act requires certain entities to notify individuals and the Commissioner about data breaches that are likely to cause serious harm. The requirements are in Part IIIC and apply to breaches on or after 22 February 2018.
A data breach is eligible if it is likely to result in serious harm to any of the individuals to whom the information relates. The scheme covers unauthorised access, unauthorised disclosure, and loss of information in circumstances where unauthorised access or disclosure is likely. The OAIC says that once an entity is aware of reasonable grounds to believe there has been an eligible data breach, notification follows. A suspected breach is assessed.
Who it applies to
The scheme applies to entities that have an APP 11 obligation to protect the personal information they hold. That includes Australian Government agencies and organisations with annual turnover of more than $3 million, and the smaller entities the OAIC lists because they are APP entities for another reason, such as providing a health service or trading in personal information.
It also applies to credit reporting bodies, credit providers, and tax file number recipients, in relation to the information those regimes cover. The OAIC says an entity that only has to secure a particular kind of information, such as a small business that must secure tax file numbers, does not notify about other information outside that obligation. The employee-record exemption and other Privacy Act exemptions can also take holdings outside the scheme. Read Part IIIC against the firm’s own status. Do not assume every practice must notify the OAIC about every incident.
What it asks of a law firm using AI
- If there are reasonable grounds to suspect an eligible breach, assess it. The OAIC’s guide sets out the assessment and the notification steps. This page does not restate the form.
- If the breach is eligible, notify the individuals at risk of serious harm and give a statement to the Commissioner. The statement has contents the Act prescribes.
- If personal information was disclosed overseas under APP 8.1, the OAIC says the APP entity is taken to hold it for the scheme. A breach at that overseas recipient can still be the firm’s to assess and, if eligible, to notify. APP 8.2 exceptions are different: the OAIC says the entity is not taken to hold information disclosed under those exceptions for this purpose.
- The Privacy and Other Legislation Amendment Act 2024, Schedule 1 Parts 1 to 7, commenced on 11 December 2024. Part 7 lets the Minister make an eligible data breach declaration so that specified entities may collect, use or disclose specified personal information for permitted purposes directed at preventing or reducing a risk of harm. That is a ministerial instrument for a particular breach. It is not a standing permission to share client files.
- The same Act’s penalty provisions, which commenced on 11 December 2024, include a civil penalty where an entity prepares an eligible data breach statement that does not comply with the content requirement in section 26WK. The Act states the maximum in penalty units. This page does not convert that to dollars.
- APP 11.3, also commenced on 11 December 2024, ties security and destruction to technical and organisational measures. It does not change the definition of an eligible data breach.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | Not set here. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | Not set here. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | Ask the vendor who detects an incident, who tells the firm, and how quickly. The firm’s own assessment clock does not wait on a vendor’s marketing page. The contract’s incident clause is part of the reading. |
| Confidentiality Whether client and other confidential information can go into the tool. | A breach of personal information can also be a breach of client confidentiality. The notification duty and the professional duty are separate. Notifying under Part IIIC does not, by itself, satisfy the client. Staying silent toward the OAIC is not a way to keep a confidence. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | The scheme is a compulsory disclosure to affected individuals and the Commissioner when a breach is eligible. It is not the rule about telling a client that a lawyer used AI. Both can arise from the same incident. They are not the same notice. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | An ISO certificate or an IRAP report is not a defence that turns an eligible breach into something else. It may be evidence of steps taken under APP 11. The notification duty still turns on the breach. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | Information disclosed overseas under APP 8.1 can still be information the firm holds for this scheme. A vendor region outside Australia does not move the notification duty offshore. |
Sources
- OAIC, Part 4: Notifiable Data Breach (NDB) scheme (updated February 2025)
- Privacy and Other Legislation Amendment Act 2024, Schedule 1 Part 7
Checked 2026-10-10. Issued by Office of the Australian Information Commissioner.