The much anticipated Notifiable Data Breaches Scheme ("the
Scheme") is now in effect across Australia having commenced on
22 February 2018. The providing legislation for the Scheme is the
Privacy Amendment (Notifiable Data Breaches) Act 2017
(Cth) which amends the Privacy Act 1988 (Cth). The Scheme
is implemented by the Office of the Australian Information
Commission ("OAIC").
Who does the scheme apply to?
The Scheme applies to all agencies and organisations
("relevant entities") with existing personal
information security obligations under the Privacy
Act. These entities include business and not-for-profit
organisations with a yearly turnover of $3 million or more, health
care and health service providers, Australian Government bodies,
credit reporting bodies, and TFN recipients. We recommend all
organisations should review their privacy policies to cover the
scheme obligations.
