The Notifiable Data Breaches (NDB) scheme is part of the Privacy Act 1988. It requires organisations covered by the Act to tell affected individuals and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to result in serious harm to the people whose personal information is involved.
A data breach is personal information being lost or subjected to unauthorised access or disclosure. Examples include a hacked customer database, a stolen laptop with unencrypted files, or an email with customer details sent to the wrong person. If a breach is suspected, the organisation must assess it quickly; OAIC guidance sets a 30-day limit for the assessment, and the organisation should act straight away to contain the damage.
Retailers and hospitality venues hold more personal information than they often realise: loyalty members, online orders, booking details, staff records and sometimes identity documents. A breach in an ecommerce platform, POS back office or reservation system can trigger the scheme.
Not every business is covered. Many small businesses with annual turnover under $3 million are exempt from the Privacy Act, but there are exceptions, so check the current rules and the OAIC website rather than assuming. Many businesses follow the scheme as good practice anyway.
Having an incident response plan, access controls, logging and backups makes the assessment far faster. A managed IT or cyber security provider such as RetailCare can help with preparation, though legal advice is wise for any real breach.