New regime for those subject to the Privacy Act 1988 - mandatory data breach notification.

The new regime relating to mandatory notification for data breaches comes into effect from 22 February, 2018. Currently, organisations holding sensitive information have discretion as to whether they disclose data breaches to affected customers and clients and/or the Privacy Commissioner.

Once effective, the new regime will require agencies and organisations that are subject to the Privacy Act 1988 to notify the Office of the Australian Information Commissioner and affected individuals in instances where there has been an "eligible data breach" of personal information held.

Given the extent of sensitive information that accounting firms hold on behalf of their clients, it is essential that your organisation is familiar with the requirements of the new regime and you ensure you are ready to respond quickly should a data breach occur.