The NDB scheme, explained without jargon
The Notifiable Data Breaches (NDB) scheme (OAIC — Notifiable Data Breaches scheme, accessed 16 June 2026) is the Australian law that tells businesses when they must tell the government and their customers about a data breach. It sits inside the Privacy Act 1988 (Cth) (Privacy Act 1988 (OAIC), accessed 16 June 2026) and has been operational since 2018. For small business owners the scheme matters because most small businesses that hold personal information are covered, the assessment clock is shorter than people expect, and the Office of the Australian Information Commissioner (OAIC) has begun publishing determinations that hold small businesses to account.
This guide covers who is in scope, the timing rules, what counts as serious harm, and the practical steps to take when a breach happens. It is written for owners and office managers — there is no jargon to decode.
Who is covered
The default is that any business with annual turnover above AUD 3 million is covered by the Privacy Act and therefore by the NDB scheme. But the small business exemption below that threshold is narrower than most owners realise. You are covered regardless of turnover if any of the following are true:
- You handle health information. This includes allied health, optometry, dental, physiotherapy, psychology, pharmacy, fitness clubs that take health intake forms, and most aged-care related services.
- You provide services under a Commonwealth contract. Many small consultancies and trades fall here without realising.
- You trade in personal information — for example, you sell or buy customer lists.
- You are a credit provider, credit reporting body, or related entity.
- You are a TFN recipient.
- You are a residential tenancy database operator.
The OAIC publishes a self-assessment tool at oaic.gov.au. Complete it once and document the result with the date — it forms part of the evidence pack many cyber insurers now ask for.
What is a notifiable breach
The NDB scheme uses three building blocks: an eligible data breach, serious harm, and as soon as practicable. The OAIC's guidance, current 2026 edition, defines an eligible data breach as one where:
- There is unauthorised access to, unauthorised disclosure of, or loss of personal information; AND
- A reasonable person would conclude that the access, disclosure, or loss is likely to result in serious harm to one or more individuals; AND
- The business has not been able to prevent the likely risk of serious harm with remedial action.
Serious harm is intentionally broad. The OAIC guidance, which sits alongside the Australian Privacy Principles (OAIC — Australian Privacy Principles, accessed 16 June 2026), includes physical, psychological, emotional, financial, and reputational harm. Examples that typically meet the threshold: identity theft after a database leak, exposure of medical history, exposure of family violence safety information, financial fraud after credit card data loss.
The thirty-day clock
This is the part most small businesses get wrong. The thirty-day assessment window starts when you become aware of a suspected eligible data breach — not when you confirm it. The OAIC determinations published in early 2026 reinforced this point. If an employee reports something suspicious on a Monday, the clock starts that Monday.
During those thirty days the obligation is to assess whether the breach is in fact eligible — that is, whether serious harm is likely. If you find it is, you must notify the OAIC and affected individuals as soon as practicable. In practice, the OAIC expects notification within hours or days once serious harm is established, not weeks.
If you can contain the breach and credibly prevent the likely risk of serious harm during the assessment window — for example, by recovering the data, disabling the access, or proving the data was encrypted and the key was not exposed — then notification is not required, but you should retain the evidence of how you reached that conclusion.
What about suppliers
This is the change that caught a lot of Australian small business owners off-guard in 2026. The OAIC's determinations in the first quarter of 2026 made the supplier-chain expectation explicit. If your bookkeeper, accountant, IT provider, CRM vendor, or any other supplier loses your customer data, the obligation to notify the OAIC and affected individuals sits with your business, not the supplier.
The Australian Small Business and Family Enterprise Ombudsman (ASBFEO) 2025 cyber resilience guidance reinforces this — supplier risk is now treated as your risk. The practical control:
- Maintain a list of every supplier holding your customer or staff personal information.
- Include a breach-notification clause in every supplier contract — they must notify you within twenty-four hours of a suspected incident.
- Confirm the list annually and rotate evidence.
A typical small business has between five and fifteen such suppliers. The list usually fits on one page.
What to do when a breach happens
The OAIC publishes a four-step process for businesses responding to a breach. The plain-English version:
Step 1 — Contain. Stop further loss. Disable the compromised account. Take the affected system offline. Recover the lost device. The faster you contain, the more likely you can prevent the risk of serious harm.
Step 2 — Assess. Within thirty days, work out whether the breach is likely to cause serious harm. Document the facts: what data was involved, how many individuals, what could a malicious party do with the data, what mitigations have you already applied. The Australian Cyber Security Hotline (1300 CYBER1) can help you think through this — it is free.
Step 3 — Notify. If serious harm is likely, file the notification on the OAIC website using their online form. The form asks for a description of the breach, the kind of information involved, the steps individuals should take, and the contact for your business. Notify affected individuals at the same time using a clear, plain-English message.
Step 4 — Review. After the immediate incident, document what happened and what controls would have prevented it. Update your incident response plan and your security controls.
The OAIC's published determinations make clear that timely notification is treated as a mitigating factor — and delayed or absent notification is treated as an aggravating factor — in any subsequent enforcement action.
The one-page incident plan
Most Australian small businesses do not need a thirty-page incident response document. They need a one-page plan with the following content:
- Who decides this is an incident (usually the owner or a nominated office manager).
- Who to call: IT provider, insurer, OAIC, Australian Cyber Security Hotline 1300 CYBER1, key external advisers.
- What to write down: time of first awareness, what was observed, who reported it, what data may be affected.
- The thirty-day clock and the trigger for OAIC notification.
- Where the printed copy lives (because if your systems are offline, your digital plan is offline too).
The ACSC publishes a free template at cyber.gov.au and business.gov.au reproduces it in even simpler language. Print it, fill it in, and post it on the office wall.
Where this fits in your broader baseline
The NDB scheme is one piece of the small business cyber baseline. The other pieces — MFA, patching, endpoint protection, backups, awareness training — are described in the companion guide Cyber security for Australian small business — the practical baseline 2026. Your NDB readiness is also a line item on every Australian cyber insurance underwriting form in 2026. Putting the one-page plan and the supplier list in place satisfies both the OAIC's expectations and the typical insurance question.
If you want to confirm where you sit, the free EDUC4TE Small Business Cyber Security Assessment includes an NDB readiness check and produces a printable evidence list aligned to the OAIC's published expectations.
Sources
- Office of the Australian Information Commissioner, Notifiable Data Breaches scheme, current guidance 2026. oaic.gov.au/privacy/notifiable-data-breaches.
- Office of the Australian Information Commissioner, Australian Privacy Principles, APP 11. oaic.gov.au.
- Office of the Australian Information Commissioner, NDB determinations, published Q1 2026. oaic.gov.au.
- Privacy Act 1988 (Cth).
- Australian Cyber Security Centre, Small Business Cyber Security Guide, current edition late 2025. cyber.gov.au.
- business.gov.au, Cyber security for business, current edition 2026. business.gov.au.
- Australian Small Business and Family Enterprise Ombudsman, Cyber security resilience guidance for small business, 2025 refresh. asbfeo.gov.au.
Sources referenced in this article: OAIC — Notifiable Data Breaches scheme, OAIC — Australian Privacy Principles, Privacy Act 1988 (OAIC), business.gov.au, ASBFEO cyber resilience guidance, ACSC Small Business Cyber Security Guide, Australian Cyber Security Hotline 1300 CYBER1.
