When Australia’s Notifiable Data Breaches (NDB) scheme commenced in 2018, many organisations saw it as a procedural compliance obligation. Eight years on, it has become something far more significant - a window into how organisations manage (or fail to manage) personal information risk.
The numbers are instructive. In the first full year of the scheme, the OAIC received just under 1,000 notifications. By 2025, that figure had risen to more than 1,200 - the highest annual total on record. While this might indicate a maturing understanding of what constitutes a notifiable breach, it also reflects a sustained exposure to data breach risk across the economy.
The causes are equally telling. Cyber incidents continue to dominate, driven by increasingly sophisticated phishing, ransomware and social engineering attacks. At the same time, human error remains a persistent and material contributor - whether through misdirected emails, poor access controls or failures in process design. In other
