Privacy Act and OAIC

Privacy Act 1988, APPs, and the OAIC. Who is an APP entity, the NDB three-limb test, what the notice must say, and which desk pages hold the clocks.

The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) set how APP entities collect, use, disclose, and secure personal information. The Office of the Australian Information Commissioner (OAIC) is the regulator. This page is the map. The clocks and the harm test live on their own pages so IR can open them under pressure.

APP entities include Australian government agencies, businesses and not-for-profits with annual turnover above $3 million, and smaller entities that are still in — private-sector health service providers, credit reporting bodies, credit providers, TFN recipients, and other carve-ins the Act names. OAIC’s quick-reference guide (published 29 June 2026) is blunt: if you have APP 11 security duties, you have NDB duties. If you are not sure you are in, get legal advice before an incident — state privacy regimes and contracts may still bite even when the Commonwealth NDB scheme does not.

Notifiable Data Breaches (Part IIIC): an eligible data breach has three limbs — (1) unauthorised access to, disclosure of, or loss of personal information the entity holds; (2) that is likely to result in serious harm to an individual; and (3) the entity has not removed that likelihood with remedial action. When you have reasonable grounds to suspect an eligible breach, take all reasonable steps to finish a reasonable and expeditious assessment within 30 calendar days (s 26WH). Once you have reasonable grounds to believe it is eligible, notify the OAIC and individuals at risk as soon as practicable. Detail: ndb-clock, serious-harm-test, ndb-statement.

OAIC’s response shape is four steps: contain; assess (facts, harm, remedial action, eligible-breach test); notify individuals and the OAIC if required; review to stop the next one. When you notify, the statement must include your organisation’s name and contact details, a description of the breach, the kinds of information involved, and recommendations about the steps individuals should take. File with the OAIC via the online Notifiable Data Breach form, and attach a copy of the template notice you used for individuals. A privacy complaint is the path if someone wants to tell the OAIC about a breach of their own information — that is not the entity NDB form.

APP 11 (security of personal information) is the cousin of your technical program: take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, and to destroy or de-identify it when you no longer need it (subject to Commonwealth-record and legal retention rules). A missing MFA on the mailbox that holds ID documents is an APP 11 fact, not just an IT ticket. Pair it with a written data breach response plan so containment, assessment, and notice are not invented at 2am.

Do not confuse regimes. SOCI Part 2B and the Cyber Security Act ransomware-payment report are separate clocks for critical infrastructure and reporting business entities. Paying a ransom does not pause NDB. Vendor breaches (email providers, shippers, RMM) still need your assessment if personal information you hold is involved — their incident is often your NDB suspicion. Primary sources: Privacy Act 1988; OAIC About the NDB scheme, When to report, Report a data breach, and Quick reference guide (29 June 2026). Cross-links: ndb-clock, serious-harm-test, ndb-statement, data-breach-response-plan, app-11, soci-clock, ransomware-payment-reporting.