Forty-one thousand dollars a year. That’s roughly the annual turnover threshold under the Privacy Act that decides whether your local accounting firm, physio clinic or online shop even falls under Australia’s federal privacy law at all, let alone the Notifiable Data Breaches scheme sitting inside it. Most small business owners we talk to have never heard the figure, and more than a few assume the scheme covers them when it doesn’t, or assume it doesn’t when it does.
That confusion matters more than it used to. Ransomware crews increasingly target small operators precisely because they’re softer targets than banks, and the fallout from a breach, financial, reputational, sometimes legal, lands on a business owner who may never have read the Privacy Act in their life. We think it’s worth sorting out what the scheme actually requires, because the gap between what people assume and what the law says is where businesses get caught out twice: once by the breach, and again by getting the response wrong.
Who the scheme actually covers
The Notifiable Data Breaches scheme is administered by the Office of the Australian Information Commissioner (OAIC), and it sits on top of the Privacy Act 1988. Here’s the bit that trips people up: most small businesses with annual turnover under $3 million are exempt from the Privacy Act entirely, and therefore exempt from the NDB scheme too.
But there are carve-outs, and they catch more businesses than you’d think. Health service providers of any size are covered, which means solo physiotherapists and small dental practices are in scope regardless of revenue. Businesses that trade in personal information, say a marketing list broker or a recruitment agency, are covered. So are businesses that are related to a larger entity that’s already covered, and businesses that have opted in voluntarily (some do this for contractual reasons, because a bigger client demands it).
So the honest answer to “does this apply to me” is: check your turnover, check your industry, and check who you’re contracting with. A $500,000-turnover cafe is probably exempt. A $500,000-turnover allied health clinic almost certainly isn’t.
Verdict: assume you’re covered until you’ve actually checked, not the other way around.
What actually counts as a notifiable breach
Not every security incident triggers the scheme. The threshold is an “eligible data breach”, which the OAIC defines as unauthorised access to, or disclosure of, personal information that is likely to result in serious harm to the people it’s about, and that the business hasn’t been able to prevent with remedial action.
That second clause does a lot of work. If a staff member’s laptop with customer records is stolen but the drive is encrypted and the password never compromised, you may be able to argue no serious harm is likely. If an email with a handful of customer addresses goes to the wrong recipient but you get it recalled and deleted before anyone opens it, that’s a near-miss, not a notifiable breach. The scheme isn’t a zero-tolerance regime for every stuff-up; it’s calibrated to genuine risk.
Where it does bite: a ransomware attack that exfiltrates a customer database, a hacked point-of-sale system leaking card details, a misconfigured cloud storage bucket left open to the internet. These are the patterns the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) sees repeatedly in incident reports from small operators, and they’re the scenarios where notification almost always applies.
The 30-day clock, and why it’s tighter than it sounds
Once a business becomes aware there are reasonable grounds to suspect an eligible breach, it has 30 days to assess and, if confirmed, notify. Thirty days sounds generous until you’ve actually lived through an incident. Working out what was accessed, by whom, and how many people are affected takes longer than most owners expect, especially if the business doesn’t already know exactly what data it holds and where.
This is the bit we’d flag as the real failure point, more than the legal technicalities. A café POS breach where the owner can say with confidence “we only ever store the last four digits, nothing else” closes out fast. A business that’s never audited its own systems can burn two of its 30 days just figuring out what it’s even looking for.
Notification itself has two parts: telling affected individuals, and telling the OAIC. The statement needs to describe the breach, the kind of information involved, and the steps people should take, things like changing passwords or watching their bank statements. There’s no fixed penalty amount we’d quote here because it scales with the breach and the entity, but the OAIC does have enforcement powers under the Act, and ignoring a clear obligation is a materially worse position than notifying late with a good explanation.
Why this matters more than it did five years ago
Small business data has become more valuable to attackers, not less, largely because small operators tend to hold a disproportionate amount of sensitive information, Medicare numbers, driver’s licence scans, payment details, relative to the security resourcing they can afford. We’ve watched ransomware reporting from the ACSC shift over the past couple of years toward smaller targets, and that tracks with what IT contractors tell us anecdotally: the easy marks moved down-market once the big end of town hardened up.
There’s an echo here of what happened with email security in the early 2000s, when spam filtering was something only big corporates bothered with until small businesses started getting hammered too and had to catch up fast. Security obligations tend to trickle down to smaller operators a few years after they become standard for large ones. The NDB scheme has been active since February 2018; what’s changed is that the attacks it was built for are now hitting businesses that assumed they were too small to notice.
If you’re working out how exposed your business actually is day to day, our guide on IoT privacy in Australia covers some of the same ground from a consumer angle, and it’s a useful mental model for small business owners thinking about their own customer data.
Our mildly contrarian take
Here’s where we’ll push back on the conventional small-business-advice line a bit. A lot of compliance consultants spruik the NDB scheme as the reason small businesses need serious cyber security spend. We reckon that’s backwards. The scheme is a notification obligation, not a security standard; it tells you what to do after a breach, not how to prevent one. Plenty of businesses have spent money on compliance paperwork, breach response plans, template letters, while leaving the actual attack surface, old software, shared logins, no multi-factor authentication, completely untouched.
If you’re a business owner trying to decide where the first dollar goes, we’d put it into basics like two-factor authentication options and decent backups before a glossy breach-response binder. The binder matters on day 31. The basics are what stop you needing it at all.
What this actually looks like week to week
For most small businesses, preparing sensibly for this scheme isn’t complicated, even if it sounds like a compliance project when a consultant explains it.
- Know what personal information you actually hold, and where. Most owners are surprised how much is scattered across point-of-sale systems, email inboxes, spreadsheets and old customer databases nobody’s deleted.
- Have someone, even an outsourced IT contractor, who can tell you within a day or two what happened in an incident, not a month later.
- Keep a plain-English breach response note, three or four paragraphs, not a 40-page policy, covering who you call first and what you tell customers.
If ransomware is the scenario keeping you up at night, we’ve written a longer piece specifically on ransomware attacks on Australian small businesses and the practical steps for the 72 hours after it happens, which pairs well with this one. And if your backup strategy is still “it’s on the one laptop in the office,” our guide to how small businesses should back up their data is the next thing to fix, arguably before anything else on this list.
The exemption question deserves a second look
We’d gently suggest that business owners who’ve decided they’re exempt should check again, particularly if they’ve grown, added a health or allied service, or started handling data for a bigger client under contract. Thresholds and exemptions don’t move with you automatically; you have to notice the shift yourself. A sole trader bookkeeper who picks up a few new clients in the health sector, for instance, might cross into coverage without realising it, because the exemption test looks at the kind of information handled, not just revenue.
This is also worth raising with whoever manages your cyber insurance, if you have it, since insurers increasingly ask about NDB compliance as part of underwriting, and a mismatch between what you’ve told your insurer and what the law actually requires of you is its own headache.
The practical verdict on compliance
Our take, plainly: the Notifiable Data Breaches scheme is a reasonable piece of regulation that most small businesses either overestimate or underestimate, rarely get exactly right without checking, and almost never think about until something’s gone wrong. Check your coverage now, while nothing’s on fire. It’s a half-hour job with the OAIC’s own guidance open in another tab, and it’s considerably cheaper than working it out for the first time on day one of an actual breach.
— Dale Whitfield, Founding Editor, Tech Geek
Featured image: AI-generated illustration.
