The first 30 days after a data breach under the NDB scheme

Last checked 12 Nov 2026 against the sources listed below. By oowl. General information for Australian small businesses, not legal advice or advice for any particular organisation. Related service: Privacy Act and data breaches.

First, does the scheme apply to you?

The Notifiable Data Breaches (NDB) scheme is part of the Privacy Act (Part IIIC), so it applies to organisations covered by the Act. If you are a small business under the $3 million threshold, check whether an exception applies: see Does the Privacy Act apply to my small business?. An eligible data breach is, in short, unauthorised access to or disclosure of personal information (or its loss, where access or disclosure is likely), that is likely to result in serious harm to one or more people, where remedial action has not removed that likelihood. The OAIC explains the test in its guidance on the scheme.

The 30-day clock

If you have reasonable grounds to suspect an eligible data breach, the Act (section 26WH) requires you to carry out a reasonable and expeditious assessment, and to take all reasonable steps to complete it within 30 days after you became aware of those grounds. The clock starts when you suspect, not when you finish investigating. The OAIC's expectation is that 30 days is a maximum. If you conclude it is an eligible data breach, you must prepare a statement for the OAIC (section 26WK) and notify it and the affected individuals as soon as practicable (section 26WL).

A practical plan for the 30 days

The legal requirements are the assessment and the notification. The steps below are our suggested order of work, not a statutory checklist.

Day 0 to 2: contain and record

• Stop the problem getting worse: change passwords and sign out sessions on affected accounts, turn on MFA, disconnect affected devices, and remove access you do not recognise. ASD's recover from a data breach page covers the account-level steps.
• Write down when and how you found out. That is the start of your 30 days.
• Keep evidence: do not wipe affected machines until someone has captured what is needed. Save suspicious emails and logs.
• Name one person to lead and one to decide.
• Report the incident to ASD at cyber.gov.au/submit-a-report (or call 1300 CYBER1, 1300 292 371). If money has moved, call your bank straight away.
• Check your cyber insurance policy: many require prompt notice, and some provide an incident response line.

Day 2 to 14: assess

• Work out what happened, what personal information was involved (names, contact details, identity documents, financial, health) and whose.
• Work out who could have had access and whether the information was exposed, taken or just lost.
• Judge the likelihood of serious harm: the kind of information, how sensitive it is, whether it was protected (encrypted, for example), who may have it and what they could do with it. Write the reasoning down.
• Consider whether remedial action, taken quickly, has made serious harm unlikely.
• If you cannot finish in time, document why and what you did to move it along.

By day 30 at the latest: decide and notify

• If it is an eligible data breach, give the OAIC the statement the Act requires: your identity and contact details, a description of the breach, the kinds of information involved and the steps you recommend people take. The OAIC's Notifiable Data Breaches page has the current notification form and guidance.
• Tell affected individuals, directly where practicable, in plain language, with what they can do to protect themselves.
• If it is not an eligible data breach, record why.
• Do not wait for day 30 if you already know the answer: notification is required as soon as practicable once you have concluded it is an eligible data breach.

After the 30 days

• Fix the cause, and check the same fault is not elsewhere.
• Keep the assessment record and the evidence of what you decided and why.
• Review your privacy policy, access, backups and monitoring. Email is a frequent entry point; our free email spoofing check shows whether your domain can be faked.

What to prepare before it happens

The hard part is usually the start: finding out something happened, and knowing who decides. A map of the personal information you hold, named roles and a one-page plan make the 30 days manageable. Our Privacy Act and data breaches service helps businesses prepare. This is general information, not legal advice; whether a specific incident is notifiable is a question for a privacy lawyer.

Sources

• Part 4: Notifiable Data Breach scheme, Office of the Australian Information Commissioner
• Notifiable Data Breaches, Office of the Australian Information Commissioner
• Privacy Act 1988 Part IIIC (sections 26WH, 26WK, 26WL), Federal Register of Legislation
• Recover from a data breach, Australian Signals Directorate
• Submit a report, Australian Signals Directorate

oowl writes each guide in its own words from these public sources and rechecks them before changing the date above. Guidance changes, so check the sources for the latest detail. Related guides: Does the Privacy Act apply to my small business?; What should a certificate of destruction list, and why isn't a factory reset enough?. All guides: oowl guides.