NDB statement contents

Once you have reasonable grounds to believe an eligible data breach has happened, the Notifiable Data Breaches scheme requires you to prepare a statement and give it to the OAIC as soon as practicable, then notify individuals at risk of serious harm. The serious-harm test and the NDB clock sit upstream of this page. This page is the statement itself and the OAIC filing path.

An eligible data breach (OAIC) has three limbs: unauthorised access to, disclosure of, or loss of personal information you hold (or loss where unauthorised access or disclosure is likely); that is likely to result in serious harm to an individual to whom the information relates; and you have not been able to prevent that likely serious harm with remedial action. If any limb fails, you still document the assessment — you do not invent a statement.

Section 26WK of the Privacy Act 1988 sets the minimum contents. The statement must identify the entity (and any other entity the notifier believes may have been involved), describe the eligible data breach to the extent known, say the kinds of information concerned, and set out recommendations about the steps individuals should take in response. Put a contact point on it. Vague 'systems were accessed' without kinds of information fails the statute.

OAIC’s Report a data breach page (checked this desk pass): notify individuals at risk of serious harm and notify the OAIC. File with the OAIC using the online Notifiable Data Breach form. OAIC publishes a read-only training version of the form so responders can see the fields before an incident. Attach a copy of the template notice you used for individuals. The more you tell OAIC about circumstances, containment, and remedial action, the better they can respond — but do not delay the statement waiting for perfect forensics.

Notify individuals by a direct channel that is reasonably likely to reach them — email to a current address, post, or another method you already use for important notices. If direct notice is not reasonably practicable, publish a copy of the statement (or the required content) in a way that is reasonably likely to reach the people at risk, and keep evidence of why direct notice failed. If someone wants to tell the OAIC about a breach of their own information, that is a privacy complaint — not the entity NDB form.

Do not wait for perfect forensics before the statement. Notify on what you reasonably believe, then update when facts change. A statement that over-claims certainty is as bad as one that hides the kinds of data. Keep the board pack, the assessment record, the statement as sent, the OAIC acknowledgement, the individual-notice log, and the attached template together.

Primary sources: Privacy Act ss 26WK–26WL; OAIC Report a data breach (form + training version); When to report a data breach; About the NDB scheme; quick reference for responding to data breaches. SOCI Part 2B and ransomware-payment reporting can run on the same incident with different clocks and different content — do not assume one statement covers all of them.