After a data breach: the NDB scheme in plain English

If someone gets into your email, a laptop goes missing or a spreadsheet of client details is sent to the wrong person, the Notifiable Data Breaches (NDB) scheme may require you to tell the people affected and the Office of the Australian Information Commissioner (OAIC). This article explains who the scheme applies to and what to do in the first 30 days. It is a plain-English summary, so check the OAIC guidance or speak with your legal adviser about your situation.

Who the scheme covers

The NDB scheme applies to organisations that have security obligations under the Privacy Act. That includes Australian Government agencies, and private sector and not-for-profit organisations with annual turnover of more than $3 million.

Many small businesses are covered regardless of turnover. The OAIC's list includes:

• businesses providing a health service
• businesses that trade in personal information
• contractors delivering services under a Commonwealth contract
• operators of a residential tenancy database
• credit reporting bodies
• reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006
• businesses accredited under the Consumer Data Right
• businesses related to a business the Privacy Act covers
• businesses that have opted in to the Privacy Act.

The health category is wider than most people expect. The OAIC lists GPs, dentists, pharmacists and allied health professionals as health service providers, and says gyms, weight loss clinics, private schools and childcare centres can be too. If you hold health information while providing a health service, assume you are covered even with two staff.

What counts as an eligible data breach

A breach is an eligible data breach when all three of these are true:

1. There is unauthorised access to, or unauthorised disclosure of, personal information, or the information is lost in circumstances where unauthorised access or disclosure is likely.
2. It is likely to result in serious harm to one or more individuals. "Likely" means more probable than not. Serious harm can be physical, psychological, emotional, financial or reputational.
3. You have not been able to prevent the likely risk of serious harm with remedial action.

The third point matters. If you act quickly enough that serious harm is no longer likely, the breach is not an eligible data breach. Remotely wiping a lost laptop before anyone accesses it, or getting a misdirected email deleted by a trusted recipient, are the kinds of steps that can achieve this.

The first 30 days, step by step

The OAIC describes four steps: contain, assess, notify and review. Here is how they play out in practice.

Day one: contain

• Stop the breach. Reset the compromised password, revoke sessions, disable the account or isolate the affected computer.
• Try to recover the information, such as asking a wrong recipient to delete an email.
• Preserve evidence. If shutting a system down would destroy logs, change access privileges instead.
• Start a written record: what happened, when you found out, who knows and what you have done.

Days one to 30: assess

If you suspect an eligible data breach, you must carry out a reasonable and expeditious assessment. You must take all reasonable steps to complete it within 30 calendar days of becoming aware of the grounds for suspicion. The OAIC treats 30 days as a maximum and expects many assessments to be faster.

Work out:

• what personal information was involved: names, contact details, health information, tax file numbers, bank details, identity documents
• how many people are affected
• how the breach happened and whether it is still happening
• whether a reasonable person in your position would conclude serious harm is likely
• whether remedial action can still remove that risk.

For email compromises, this usually means reviewing sign-in and mailbox audit logs in Microsoft 365 to see what the attacker could read or forward. Do this early, because log retention is limited.

As soon as practicable: notify

Once you have reasonable grounds to believe there has been an eligible data breach, you must prepare a statement for the OAIC as soon as practicable. The OAIC takes this through its online Notifiable Data Breach form. The statement must include:

• your organisation's identity and contact details
• a description of the breach
• the kinds of information involved
• recommendations about the steps individuals should take in response.

Then notify individuals as soon as practicable. There are three options:

1. notify everyone whose information was involved
2. notify only those at risk of serious harm
3. if neither is practicable, publish the statement on your website and take reasonable steps to publicise it.

Write the notice in plain English and give practical steps based on the information involved, such as changing passwords, watching for scam calls or contacting their bank.

Afterwards: review

Find the root cause, fix it and update your policies and staff training. Review any supplier involved in the breach.

Exceptions to know about

• If more than one organisation holds the information, only one needs to assess and notify on behalf of the others.
• If a breach is notified under section 75 of the My Health Records Act, it does not also need to be notified under the NDB scheme.
• Narrow exceptions exist for enforcement-related activities, secrecy provisions and declarations by the Commissioner.

Failing to meet the scheme's requirements is treated as an interference with the privacy of an individual under the Privacy Act.

Prepare before it happens

The 30 days go quickly when you are also trying to keep the business running. Most of the work can be prepared in advance. We cover this in a free risk check: whether your logs, backups and contacts would let you answer the assessment questions above in days instead of weeks.

Checklist

• Confirm whether you are covered, including the health service and related business categories.
• Keep a short breach response plan with names, phone numbers and the first containment steps.
• Make sure Microsoft 365 audit logging is on and you know how long logs are kept.
• Know what personal information you hold and where it lives.
• On a suspected breach: contain, record, assess within 30 days.
• If eligible: lodge the OAIC form and notify individuals as soon as practicable.
• Review the cause and update training and policies.