On 13 February 2017 the Privacy Amendment (Notifiable Data
Breaches) Bill 2016 (Bill) was passed by the
Federal Parliament. The Bill received Royal Assent on 22 February
2017 and will take effect from 22 February 2018, unless an earlier
commencement date is proclaimed. The Bill amends the Privacy
Act 1988 (Cth) (Privacy Act) to introduce a
new obligation for the occurrence of an "eligible data
breach" to be notified to the Australian Privacy Commissioner
and to affected individuals.
Mandatory data breach notification obligations
Once the provisions of the Bill come into effect, entities that
are required to comply with the Privacy Act will become subject to
mandatory data breach notification obligations. Entities that must
comply with the Privacy Act include private sector organisations
with an annual turnover of more than $3 million, so many
franchisors will be required to comply with the new data breach
notification obligations. If one company in a corporate
