Mandatory data breach notification has started - are you ready?

Australia's mandatory notifiable data breaches scheme under the Privacy Act 1988 (Cth) is now in effect, with substantial penalties for non-compliance.

Organisations and Federal agencies subject to the Privacy Act must now provide notice as soon as practicable to the Office of the Australian Information Commissioner and affected individuals where there are reasonable grounds to believe that an "eligible data breach" has occurred (unless an exception applies). Relevantly:

• a data breach will arise where there has been unauthorised access to, or unauthorised disclosure of, personal information about one or more individuals, or where such information is lost in circumstances that are likely to give rise to unauthorised access or unauthorised disclosure (for example, leaving the information on the bus);