What Should Businesses Consider When Preparing For Australia's Mandatory Breach Notification Laws?

Australia's mandatory data breach notification laws will come into effect by 28 February 2018. To best manage the new regime, businesses are encouraged to review their existing information security and privacy policies and procedures.

A key focus of any organisation's review of procedures and policies should be to consider the pre-existing obligations already imposed on them by the in-force Privacy Act and the Australian Privacy Principles (APPs), which provide the foundation for Australia's breach notification laws.

An incident that triggers the need for a notification under the incoming breach notification laws will not necessarily amount to a breach of other existing obligations under the Privacy Act and the APPs. However any regulatory or third party investigations following a notified breach will almost certainly examine the extent to which a business has complied with the privacy framework as a whole – that is to say, the Privacy Act and the APPs.