Australia’s Privacy Act 1988 and the Notifiable Data Breaches (NDB) scheme impose serious legal obligations on businesses that hold personal information. If your business experiences an eligible data breach, you may be legally required to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) — and face significant penalties if you fail to do so. Cyber insurance plays a critical role in helping businesses meet these obligations and manage the financial consequences.
What Is an Eligible Data Breach Under Australian Law?
Under the NDB scheme, an eligible data breach occurs when personal information held by your organisation is accessed, disclosed, or lost without authorisation, and the breach is likely to result in serious harm to any of the affected individuals. If this threshold is met, you must notify affected individuals and the OAIC as soon as practicable.
Who Does the NDB Scheme Apply To?
The NDB scheme applies to organisations covered by the Privacy Act — primarily those with an annual turnover of more than $3 million, as well as smaller businesses in certain sectors including health services, credit reporting, and those that trade in personal information.
How Cyber Insurance Helps With Data Breach Response
A comprehensive cyber insurance policy provides practical and financial support across the entire data breach response process:
- Forensic investigation — identifying what data was accessed, how the breach occurred, and the extent of the exposure.
- Legal advice — guidance on your notification obligations under the Privacy Act and NDB scheme.
- Notification costs — the cost of notifying affected individuals, which can be substantial for large data sets.
- Regulatory response — assistance managing communications with the OAIC during an investigation.
- Third party liability — cover for compensation claims from affected individuals whose data was compromised.
- Regulatory fines and penalties — where insurable under Australian law.
The Cost of Getting It Wrong
The penalties for serious or repeated breaches of the Privacy Act have increased significantly in recent years. Australian businesses can face fines of up to $50 million, three times the benefit obtained, or 30 percent of adjusted turnover — whichever is greater. Beyond the financial penalties, the reputational damage of a publicised data breach can be long-lasting.
Protect Your Business With HC Insurance
If your business holds personal information about customers, employees, or suppliers, cyber insurance is not optional — it is essential. Contact HC Insurance today to discuss the right level of cyber cover for your business and your obligations under Australian privacy law.