Businesses that experience a breach may have specific obligations depending on whether the Privacy Act applies to them, the type of personal data involved, and the risk of serious harm resulting from the breach. Serious harm does not have to be explicitly financial, it can be psychological, physical or reputational harm.

Current requirements

A small business is defined under the Privacy Act 1988 (Cth) as one which has an annual turnover of less than 3 million Australian dollars (Section 6D(1)). This value is inclusive of income from all sources and does not include assets held, capital gains or the proceeds of capital gains (Office of the Australian Information Commissioner OAIC).

If your small business falls under the Privacy Act and experiences a breach, there are obligations under the Notifiable Data Breach scheme. However, some small businesses that are not covered by the Privacy Act still must report a data breach event irrespective of their turnover, these include businesses:

That provide a health service, or hold any health information, except an employee record; or
That disclose personal information about another individual to anyone else for a benefit, service or advantage; or
Provide a benefit, service or advantage to collect personal information about another individual from anyone else; or
That are contracted service providers for a Commonwealth contract; or
That are credit reporting bodies (Section 6D(4); OAIC).

What constitutes an eligible data breach?

Unauthorised access or disclosure to personal information, or a loss of personal information, held by an agency; or
That is likely to result in “serious harm” to one or more individuals; or
The organisation or agency has not been able to prevent the likely risk of serious harm with remedial action. (OAIC)

How to report a data breach?

You should report a data breach to the OAIC as soon as practicable. However, the maximum amount of time before making a report is 30 days after you believe that you experienced a data breach event. This timeframe is provided for the business to assess the risk of “serious harm” to the individual as a result of the data breach. (Section 26WH (2)(b)); OAIC)
You may also wish to contact the OAIC enquiries line: 1300 363 992