Australia. Breach notification. Act (Part)
NDB SchemeNotifiable Data Breaches Scheme (Privacy Act 1988 Part IIIC, inserted by Privacy Amendment (Notifiable Data Breaches) Act 2017)
In force
§1Summary
- Synopsis
Requires APP entities to assess suspected breaches within 30 days and notify the OAIC and affected individuals of eligible breaches likely to cause serious harm.
- Key themes
- Unique features
No fixed hour deadline; notification 'as soon as practicable' after an eligible breach is confirmed.
- SaaS relevance
SaaS holding data covered by the Privacy Act must notify; in shared-custody cases one entity may notify for all.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Assess within 30 days; OAIC and individuals as soon as practicable
§3Dates
- Key dates
- Adopted
- In force
- POLA Act 2024 adds ministerial eligible data breach declarations
§4Text and authority
- Text
- Authoritative text legislation.gov.au
- Authority
- Office of the Australian Information Commissioner (OAIC)
§5Where it applies
- Domestic law of
- Australia
- Also applies in
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Dates from general knowledge. [Link: Privacy Act 1988 compilation; NDB scheme is Part IIIC]