The notifiable data breaches scheme does not give you 72 hours. That number comes from the European GDPR, it has been repeated into Australian folklore, and acting on it will send you down the wrong path at the worst possible moment. The same borrowing happens with HIPAA, which has no force in Australia at all. The Australian clock works differently, and the difference is not a technicality.
What follows is the actual sequence, in the order it happens to a practice manager who has just been told something has gone missing.
Is the notifiable data breaches scheme a 72 hour rule?
No. Under the Privacy Act 1988 you must take all reasonable steps to complete an assessment of a suspected eligible data breach within 30 calendar days of becoming aware of the grounds that caused the suspicion, and notification happens as soon as practicable once you have reasonable grounds to believe one has occurred. There is no 72 hour obligation anywhere in the Australian scheme.
Read the 30 days correctly, though, because this is where the myth gets replaced by a second mistake. It is a ceiling, not an allowance. The OAIC’s guidance on the NDB scheme says the Commissioner expects entities to treat 30 days as a maximum time limit and to finish much sooner, because the risk of serious harm to people usually grows with time.
The statutory wording underneath it is “reasonable and expeditious”. An organisation that waits 29 days because it believed it had 30 has not met that test, and if you cannot finish inside 30 days the Commissioner expects you to document three things: the reasonable steps you took, why it was delayed, and why the assessment was still reasonable and expeditious.
What counts as an eligible data breach?
A data breach is eligible when it is likely to result in serious harm to any of the individuals the information relates to. That judgement is an objective one, made from the viewpoint of a reasonable person in your organisation’s position, not from the viewpoint of whoever would rather it were not notifiable.
Not every breach is eligible. The OAIC is explicit that if you act quickly and your remedial action means serious harm is no longer likely, there is nothing to notify. That is worth sitting with, because it inverts the usual instinct. The fastest way to avoid a notification is to contain the breach properly in the first hour, not to argue about thresholds in the third week.
Health information raises the stakes. A clinic’s appointment list is not the same risk as a hardware store’s mailing list, and the reasonable person assessing likely serious harm is expected to know that.
The clock, in the order it actually runs
There are two separate triggers in the scheme and conflating them is the most common sequencing error. Suspicion starts an assessment. Belief starts a notification.
| Stage | What triggers it | What the Act requires |
|---|---|---|
| Contain | You learn something has gone wrong | Not a notification step. Contain the breach and take remedial action first, because successful remediation can remove the obligation entirely. |
| Assess | Reasonable grounds to suspect an eligible data breach | All reasonable steps to complete the assessment within 30 calendar days, and the assessment must be reasonable and expeditious. |
| Notify | Reasonable grounds to believe an eligible data breach occurred | As soon as practicable: decide who to notify, prepare the statement for the Commissioner, then notify affected individuals. |
Awareness is assessed at the organisation, not at the top of it. The OAIC says an entity should not unreasonably delay an assessment by waiting until the CEO or the board learns of something that already gave reasonable suspicion further down. If your practice manager knows on Monday, the clock started Monday.
Most of the controls that shorten this sequence are ordinary technical ones, and the free Essential Eight Maturity Level 1 assessment scores where yours currently sit.
Are companies liable for breaches at a third party?
Generally yes, and outsourcing the storage does not outsource the obligation. Where an APP entity discloses personal information to an overseas recipient under APP 8.1, the OAIC states the entity is deemed to hold that information for the purposes of the NDB scheme, so it remains responsible for assessing an eligible data breach and for notifying.
Where two Australian organisations are both caught up in one incident, the question becomes who notifies rather than whether anyone does. The OAIC’s position is that the entity with the most direct relationship with the people at risk is often best placed to do it, so they understand the notification when it arrives.
The worked example in the guidance is a medical practice whose archived records were stolen from a storage provider. The storage provider ran the assessment because it knew its own facilities. The practice notified the patients, because the patients had no relationship with the storage provider, and the costs were reimbursed by the provider and its insurer. Both organisations had a role. Neither got to point at the other.
Check your contracts before you need this. A practice management vendor, a cloud backup provider and a transcription service each hold information you are still answerable for, and data security work usually starts with establishing who holds what.
What are the penalties for breaching the Privacy Act?
The Privacy Act carries civil penalty provisions, and the most serious of them sits at section 13G, which covers a serious interference with the privacy of an individual. Section 13H covers interference with the privacy of individuals more generally, section 13J provides for alternative orders, and section 13K sets out the provisions for which infringement notices or compliance notices can be issued.
There is no dollar figure quoted here, on purpose. The maximum penalties have been increased by amendment and the amounts are formula-based rather than a single number, and an out of date figure in a compliance article is worse than no figure at all. Read the current amounts in the Privacy Act itself, which is the only source that is never stale, or ask your adviser to confirm the exposure for your organisation.
The more useful point for a small provider is that a penalty is rarely the first thing that happens. What arrives first is the obligation to notify people whose information you lost, in writing, explaining what happened. Practices that have been through it describe that correspondence as the part that actually changes behaviour.
Does this even apply to a small practice?
If you are a health service provider, yes, whatever your turnover. The OAIC states that regardless of turnover the Privacy Act covers any business that is a health service provider, so the three million dollar small business threshold that exempts many businesses does not reach a two room podiatry clinic.
NDIS providers need to check rather than assume. The exemption list turns on what your organisation actually does, and a provider delivering therapeutic supports or personal care is in a different position from one delivering transport alone. The NDIS Practice Standards information management requirements apply either way, and they overlap with this scheme without replacing it.
What to do in the first hour
Contain it before you classify it. Disable the account, revoke the share link, recall the message, isolate the device. Remediation that removes the likelihood of serious harm can end the obligation altogether, and it is the only step that gets harder the longer you think about it.
Write down the time you became aware and who became aware. That single line decides when your 30 days started and it is the first thing anyone will ask you for later.
Then work out what information was involved and who it relates to, because you cannot assess likely serious harm without both. A list of names is one problem. The same list with diagnoses attached is a different one.
Decide who in your organisation is allowed to make the call that something is a suspected eligible data breach, and do it today rather than during an incident. Most delays in this process are not technical. They are an organisation waiting for permission.
If you would rather know where your controls stand before any of this is real, the free Essential Eight Maturity Level 1 assessment covers the access, backup and patching controls that decide whether a breach stays small.
Last reviewed: 4 October 2026.
This article is general information about the Notifiable Data Breaches scheme and the Privacy Act 1988. It is not legal advice. Confirm your own obligations with the OAIC or your own adviser before acting on it.