The Notifiable Data Breaches Scheme: What It Means for Your Website

If your website collects personal information, it is worth knowing about Australia's Notifiable Data Breaches scheme. It sits under the Privacy Act and requires certain organisations to report serious breaches to the regulator and to the people affected. This is a plain-English overview, not legal advice.

Who the scheme covers

The NDB scheme applies to organisations already covered by the Privacy Act, which includes businesses above the 3 million dollar turnover threshold and certain others such as health service providers. If the Act applies to you, so does the breach scheme.

Even if you are exempt today, treating a breach seriously protects your customers and your reputation.

What counts as notifiable

A breach is notifiable when there is unauthorised access, disclosure or loss of personal information that is likely to result in serious harm to the people involved, and you cannot prevent that harm through remedial action. Think leaked customer records, exposed passwords, or a hacked database.

If those conditions are met, you must notify the Office of the Australian Information Commissioner and the affected individuals as soon as practicable.

Reducing the risk on your site

• Keep SSL active across the whole site.
• Use strong, unique admin passwords and enable two-factor authentication.
• Keep your platform, plugins and themes updated.
• Limit how much personal data you collect and store.
• Use hosting with daily backups so you can recover quickly.

Have a simple plan ready

You do not need a thick policy document. Keep a short record of what personal data you hold, where it lives, and who you would contact if there were a breach. A little preparation turns a stressful incident into a clear set of steps.