Small business security
Does my business have to report a data breach?
If customer or staff information is lost, stolen or exposed, you may have legal obligations to assess the breach and notify the people affected and the regulator. Whether you do depends on the type of business you are and how serious the breach is. Here’s how the rules work in plain terms.
The short version
If you think there’s been a breach
- Contain it straight away.
- Assess quickly whether it’s likely to cause serious harm.
- If it is, notify affected people and the OAIC.
- Keep a record of what happened and what you decided.
Does the scheme apply to my business?
The Notifiable Data Breaches (NDB) scheme is part of the Privacy Act 1988. It applies to organisations covered by the Act, which includes:
- Businesses with annual turnover above $3 million
- Some smaller businesses regardless of turnover, including private health service providers (such as GPs, allied health, pharmacies, gyms and others holding health information), businesses that trade in personal information, credit reporting bodies and contracted service providers to the Australian Government
- Australian Government agencies
Many small businesses under $3 million aren’t covered. But privacy law reform is ongoing, clients may require notification by contract, and handling a breach well is good practice either way. Check the OAIC’s guidance if you’re unsure whether you’re covered.
What counts as an eligible data breach
A breach is notifiable when:
- There’s unauthorised access to, or disclosure or loss of, personal information
- It’s likely to result in serious harm to one or more people
- You haven’t been able to prevent that likely harm by taking action quickly
Serious harm can be financial, physical, psychological, emotional or reputational. Information like ID documents, financial details, health information and passwords usually carries a higher risk.
Examples include an email with customer records sent to the wrong person, a ransomware attack that copies files, a lost unencrypted laptop, or a hacked mailbox containing client documents.
What to do
Contain it
Stop the breach getting worse. Recall emails, reset passwords, disconnect affected systems, or ask the wrong recipient to delete the information and confirm they have.
Assess it
If you suspect an eligible breach, you must take reasonable steps to complete an assessment within 30 days. Work out what information was involved, whose it is, and how likely serious harm is. Most breaches can be assessed much faster than that.
Notify, if it’s eligible
Notify affected individuals and the OAIC as soon as practicable. The notification should describe what happened, what information was involved and what people should do to protect themselves. The OAIC has an online form.
Review and record
Record what happened, how you assessed it and why you made your decision, even if you decide it isn’t notifiable. Then fix the cause.
Good action can prevent serious harm
If you act quickly enough to prevent the likely serious harm, such as getting a mistakenly sent file deleted before it’s opened, the breach may not need to be notified. Record what you did.
Reducing the chance of a breach
- Collect and keep only the personal information you need, and delete what you don’t.
- Turn on MFA for email and systems that hold customer data.
- Encrypt laptops and phones.
- Train staff on emailing documents to the right people and spotting phishing.
- Use secure file sharing rather than email attachments for sensitive documents.
- Have a short incident plan that includes privacy.
Common questions
We’re under $3 million turnover. Can we ignore all this?
If you’re not covered, the scheme doesn’t legally require you to notify. You may still have contractual obligations, and telling customers so they can protect themselves is often the right thing to do.
Do we have to report every lost email?
No. Only breaches likely to cause serious harm, where you couldn’t prevent that harm, are notifiable.
Do we also need to report a cyber attack elsewhere?
Report cybercrime to ReportCyber. If you’re covered by the ransomware payment reporting rule and make a payment, that has its own 72-hour reporting requirement.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.