Australia's New Mandatory Data Breach Notification Regime: How To Prepare Your Business

In February 2017, the Australian Federal Parliament passed legislation to amend Australia's privacy law to introduce a mandatory data breach notification regime. The new regime, once implemented, will require agencies and organisations subject to Australia's Privacy Act 1988 (Cth) to notify data subjects and regulators in the event of an eligible data breach.

Mandatory notification laws have had significant repercussions in other global jurisdictions, introducing previously unheard of costs and consequences for companies when security events occur. With a more open and transparent approach to laws governing the handling of data comes an increased expectation from consumers and stakeholders as to the handling and security of data. In other jurisdictions, mandatory notification has resulted over time in more regulatory investigations, complaints and litigation brought by consumers and stakeholders.