Last Updated on 22/08/2025 by Damin Murdock
In the wake of rising cybersecurity threats and data misuse, Australian privacy laws have set strict obligations for how and when organisations must respond to data breaches. One of the most crucial components of this legal framework is the requirement to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) following an eligible data breach.
At Leo Lawyers, we help businesses navigate these legal complexities to remain compliant and reduce liability risk. Here’s what you need to know.
What Is an Eligible Data Breach?
An eligible data breach involves either unauthorised access to or disclosure of personal information, or a loss of information where unauthorised access or disclosure is likely to occur, with the crucial element that the breach is likely to result in serious harm to individuals whose data is involved. Once a business forms a reasonable belief that such a breach has occurred, notification obligations are triggered.
Notification Requirements: What Must Be Shared?
Organisations must provide a statement to both the OAIC and the individuals affected. This statement should include the date of the breach (or estimated time), a description of what happened, the types of information involved, actions taken to contain or mitigate the breach, and recommendations for individuals on protective steps they can take. These requirements are consistent across both Commonwealth and state laws, such as the Privacy and Personal Information Protection Act 1998 (NSW) and emerging legislation in Queensland.
How to Notify
1. Direct Notification
Where reasonably practicable, affected individuals must be directly notified. This can be by email, SMS, mail, or other appropriate communication methods. Direct notices must also include recommendations for protecting personal data and minimising harm.
2. Public Notification
If direct contact is not feasible, organisations must:
- Publish a public notice on an accessible website for at least 12 months; and
- Inform the OAIC of the location and accessibility of the published statement.
Notification Timing: “As Soon As Practicable” But With Exceptions
While the overarching requirement is to notify “as soon as practicable,” certain circumstances call for strict deadlines. For security clearance breaches, notification must be reported within 48 hours. In cases of intelligence-related emergencies, organisations must notify the Attorney-General and ASIO Minister within 8 hours, and the Inspector-General of Intelligence and Security within 3 days.
Key Legal Considerations
1. Reasonableness Standard
What constitutes “as soon as practicable” depends on the situation. The law requires organisations to balance urgency with accuracy, notification should not be delayed unnecessarily, but neither should it be rushed at the expense of correct information.
2. Failure to Notify
Delays or omissions can lead to:
- breach of contractual or regulatory obligations;
- regulatory scrutiny;
- legal complaints.
3. Recordkeeping and Accountability
Organisations must document:
- how and when a breach was discovered;
- who made decisions about notifications and why; and
- evidence of notification efforts and outcomes.
Good records are essential in defending enforcement action or complaints.
Conclusion
Prompt, transparent action after a data breach is both a legal requirement and a trust-building measure. With new legislation across jurisdictions raising the bar for privacy protection, businesses must stay ahead of their obligations. Feel free to contact Damin Murdock at Leo Lawyers via our website, on (02) 8201 0051 or at office@leolawyers.com.au. Further, if you liked this article, please subscribe to our newsletter via our Website, and subscribe to our YouTube , LinkedIn, Facebook and Instagram. If you liked this article or video, please also give us a favourable Google Review.
DISCLAIMER: This is not legal advice and is general information only. You should not rely upon the information contained in this article and if you require specific legal advice, please contact us.
Damin Murdock (J.D | LL.M | BACS - Finance) is a seasoned commercial lawyer with over 17 years of experience, recognised as a trusted legal advisor and courtroom advocate who has built a formidable reputation for delivering strategic legal solutions across corporate, commercial, construction, and technology law. He has held senior leadership positions, including director of a national Australian law firm, principal lawyer of MurdockCheng Legal Practice, and Chief Legal Officer of Lawpath, Australia's largest legal technology platform. Throughout his career, Damin has personally advised more than 2,000 startups and SMEs, earning over 300 five-star reviews from satisfied clients who value his clear communication, commercial pragmatism, and in-depth legal knowledge. As an established legal thought leader, he has hosted over 100 webinars and legal videos that have attracted tens of thousands of views, reinforcing his trusted authority in both legal and business communities."
