AustraliaPrivacy Act 1988 (Cth), Notifiable Data Breaches Scheme
Privacy Act 1988 (Cth), Part IIIC, ss. 26WE, 26WK, 26WL
In force since .
A breach notification rule binding public and private bodies.
- Private right of action
- No
- Enforcement body
- Office of the Australian Information Commissioner (OAIC)
- Audit expectation
- none
What it requires
- Prepare a statement about an eligible data breach and give a copy to the Information Commissioner as soon as practicable after becoming aware of reasonable grounds to believe the breach happened.
- Notify the contents of that statement to each individual to whom the relevant information relates, or to each individual at risk, or, if neither is practicable, publish the statement on the entity's website and take reasonable steps to publicise it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 26WE, 26WK and 26WL define an eligible data breach and require the entity to prepare a statement, give a copy to the Commissioner and notify the affected individuals or publish the statement. That is a duty to notify, and none of the three sections requires a record of the breach to be kept. The assessment duty in section 26WH(2) and the Commissioner's power to obtain information in section 26WU sit in sections this row does not cite.
- Kind
- None
- As of
What this law does
An entity holding personal information that is required to comply with Australian Privacy Principle 11.1 (security of personal information) must notify an eligible data breach, meaning unauthorised access to or disclosure of information that a reasonable person would conclude is likely to result in serious harm.
The entity must give a copy of a statement about the breach to both the Information Commissioner and the affected individuals as soon as practicable after becoming aware of reasonable grounds to believe the breach occurred.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .