NDB clock

The Notifiable Data Breaches scheme sits in the Privacy Act. APP entities that suspect an eligible data breach must take all reasonable steps to finish a reasonable and expeditious assessment within 30 calendar days of becoming aware of the grounds for that suspicion (s 26WH(2)). That is an assessment deadline, not a licence to sit on a breach you already know is eligible.

An eligible data breach is unauthorised access to, disclosure of, or loss of personal information where serious harm to an individual is likely, and remedial action has not prevented that likelihood. If the test is met, you notify the OAIC and individuals at risk of serious harm as soon as practicable, unless a statutory exception applies. Direct notice is the default; a public statement is the fallback when direct notice is not reasonably practicable.

Do not confuse the clocks. Thirty days is for the assessment of a suspicion. Notification, once you have reasonable grounds to believe the breach is eligible, is as soon as practicable — which may be well inside those thirty days. Containment and remedial action still come first. If remedial action removes the likelihood of serious harm, the notification duty may not arise. Document the reasoning either way.

OAIC published 2025 scheme statistics on 6 July 2026: 1,205 notifications in the 2025 calendar year, up 8% on 1,112 in 2024. Malicious or criminal activity accounted for 716. Health service providers were the most commonly affected sector (225, 19%). Those figures are statistics, not an incident. They belong here, not on the breaches filter.

Practical desk: start the assessment clock in writing the hour you have grounds to suspect. Put legal and privacy in the same channel as containment. Use the OAIC form when you notify. The OAIC quick reference guide and self-assessment checklist are the how-to; this page is the clock.