Data breach help for Australian businesses
If you think you have had a data breach, act now: contain it, assess the risk of harm, notify the OAIC and affected people if it is an eligible breach, then review what happened. The OAIC sets out these four steps. You must take all reasonable steps to finish your assessment within 30 days. (OAIC)
Last reviewed 2026-11-03. General information only, not legal advice.
- Cyber incident or cybercrime: Australian Cyber Security Centre, 1300 CYBER1 (1300 292 371), or report online at cyber.gov.au.
- Notifiable data breach: OAIC (online NDB form), enquiries 1300 363 992.
- Danger to life or a crime in progress: 000.
- Your lawyer and your cyber insurer, if you have one.
What are the first steps after a data breach?
The OAIC describes four key steps. They often overlap, and the first ones should start straight away.
- Contain. Stop the breach getting worse: for example, revoke compromised access, change passwords, isolate affected systems or try to recover lost information.
- Assess. Work out what personal information was involved, the circumstances and cause, and the likely harm to the people affected, and whether remedial action can reduce that harm.
- Notify. If it is an eligible data breach, notify affected individuals and the OAIC. The notice to individuals must recommend steps they should take.
- Review. Look at what caused the breach and what would stop it happening again.
Source: OAIC, Responding to data breaches: four key steps. Keep notes of what you find and decide as you go.
If you are in Melbourne or work with the Victorian public sector, see Melbourne and Victorian breach contacts. If the breach came through your website, see our website stack security guides (for example WooCommerce store security). For help reviewing your systems afterwards, book a review with our team.
What is an eligible data breach?
A data breach happens when personal information is lost or subjected to unauthorised access or disclosure, such as a stolen device, a hacked database, or information sent to the wrong person. It becomes notifiable under the NDB scheme when it is likely to result in serious harm to an individual whose information is involved. (OAIC)
Frequently asked questions
Do I have to report a data breach in Australia?
If your organisation is covered by the Privacy Act 1988 and the breach is likely to result in serious harm to someone whose personal information is involved, you must notify the affected individuals and the OAIC under the Notifiable Data Breaches (NDB) scheme. The notice to individuals must recommend steps they should take. Source
How long do I have to assess a suspected data breach?
If you suspect an eligible data breach, you must carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days of becoming aware of the grounds for suspicion. The OAIC expects 30 days to be treated as a maximum, not a target. Source
Does the Privacy Act apply to my small business?
Most businesses with an annual turnover of $3 million or less are not covered, but some are regardless of turnover. These include health service providers, businesses that trade in personal information, and Commonwealth contracted service providers. Check the OAIC small business guidance to confirm. Source
Who do I call about a cyber attack?
Report cybercrime, cyber incidents, vulnerabilities and ransomware payments to the Australian Cyber Security Centre through cyber.gov.au or on 1300 CYBER1 (1300 292 371). If a crime is in progress or someone is in danger, call 000. Source
Sources
- OAIC: About the Notifiable Data Breaches scheme
- OAIC: Part 3, four key steps
- OAIC: Part 4, the NDB scheme
- OAIC: Small business
- cyber.gov.au: Submit a report
Get breach alerts
A short email when there is a sourced Australian breach or vulnerability update worth knowing about. No spam; unsubscribe any time.