Privacy Act + NDB scheme alignment.

The Privacy Act 1988 (Cth) is the Australian federal law that governs how organisations collect, use, hold, disclose and protect personal information. It applies to APP entities — Australian government agencies and most private-sector organisations with annual turnover above $3 million, plus health service providers and a small set of other categories regardless of turnover. It is administered by the Office of the Australian Information Commissioner (OAIC).

The Australian Privacy Principles (APP 1 to APP 13) are the 13 obligations at the core of the Privacy Act. They cover: open and transparent management of personal information (APP 1), anonymity (APP 2), collection (APP 3 to APP 5), use and disclosure (APP 6 to APP 9), data quality and security (APP 10 to APP 11), and access and correction (APP 12 to APP 13). APP 8 — cross-border disclosure — and APP 11 — security — are the two most-tested in incident response and OAIC determinations.

The NDB scheme, in force since 22 February 2018, requires APP entities to notify both the OAIC and affected individuals of an eligible data breach — defined as unauthorised access, disclosure or loss of personal information likely to result in serious harm. Notification is required as soon as practicable after the entity becomes aware of the breach, and an assessment must be completed within 30 days of suspicion.

You must notify the OAIC and affected individuals as soon as practicable after you become aware of an eligible data breach. If you suspect a breach but are not yet sure whether it qualifies as eligible, you have up to 30 days to complete a reasonable assessment. The 30-day clock starts at the point of suspicion, not confirmation. A documented assessment template is essential because OAIC scrutinises both the assessment timeline and the substance of the "likely to result in serious harm" determination.

Overseas hosting triggers APP 8 (cross-border disclosure). You must take reasonable steps to ensure the overseas recipient does not breach the APPs, or you remain accountable for their handling. In practice this means a documented APP 8 analysis per third-party processor, contractual safeguards, and a published list of overseas locations where personal information is stored. Most cloud platforms (Microsoft, AWS, Google) support AU-region storage; the gap is usually in SaaS analytics, support tooling and email.

Generally no — small business operators with turnover under $3 million are exempt from the Privacy Act. There are exceptions: health service providers (any turnover), credit-reporting bodies, organisations that trade in personal information, contracted Commonwealth service providers, and small businesses related to a larger APP entity. The current Privacy Act review may narrow or remove the small-business exemption — many small firms are preparing on the basis that the exemption may not last.

The Privacy Act is the floor. APRA-regulated entities also meet CPS 234 (which is more prescriptive about information-security capability and incident notification timing — 72 hours to APRA, alongside the NDB scheme). NDIS providers also meet the NDIS Quality & Safeguards Commission's requirements for participant data. Law firms also meet Law Society confidentiality and legal-professional-privilege obligations. In each case, the Privacy Act sits alongside, not instead of, the sector-specific framework.

Yes. We deliver Privacy Impact Assessments as ad-hoc project work — typically scoped at 4 to 8 weeks for a single high-risk project (a new SaaS deployment, a data-sharing arrangement, a marketing-tech rollout). PIAs include APP-by-APP analysis, risk register, mitigation plan and board summary.