Since the Notifiable Data Breaches (NDB) scheme came into effect in February 2018, the Office of the Australian Information Commissioner (OAIC) has produced regular reports on the type of notifiable breaches. The most recent OAIC report (spanning July 2018 to September 2018) has found human error is responsible for one-third of data breaches. While criminal attacks still cause many data breaches, businesses must ensure they can take practical steps to secure their data. This article will explain how your business can avoid preventable data breaches caused by human error or criminal attacks.

Background: How Does the NDB Scheme Work?

The NDB scheme only applies to businesses who must meet obligations under the Privacy Act. These usually include businesses who have an annual turnover of $3 million or more. If your business is a subsidiary of a holding company that has $3 million or more in turnover, your business will have to comply with the NDB scheme.

Some businesses with a lower turnover may also qualify if they are:

  • private health sector providers;
  • businesses running a residential tenancy database;
  • businesses that opt into Privacy Act; or
  • credit providers. 

If your business does not have to comply with the NDB scheme, you do not have to report data breaches to the OAIC. However, you should still minimise the risk of any data breaches as customers may lose confidence in your business for failing to secure their data. 

You only have to report data breaches if they can be classified as notifiable data breaches (NDBs). A NDB is a breach of personal data that leads to a likely risk of serious harm to an affected individual.

For example, a breach of personal data includes a hacker attacking your business’ computer systems and stealing the personal contact details of your customers.

If a breach occurs and you find there is a likely risk of serious harm to the affected individual, you need to notify the OAIC as well as anyone who is affected by the breach.

What Did the Notifiable Data Breaches Report Find?


From July 2018 to September 2018:

  • there were 245 notifications;
  • 63% of data breaches affected the personal information of 100 individuals or fewer; and 
  • there were two data breaches that affected 100-250,000 people.

Note: These numbers only cover notifiable breaches. They do not include breaches that may have occurred but do not require reporting or have not been reported to the OAIC. 

Data Breach Cause

NDBs were generally caused by:

  • human error (37%); and
  • malicious or criminal attacks (57%). 

Human error includes activities such as:

  • sending emails to the wrong recipient;
  • accidental use of the Carbon Copy (CC) function instead of the Blind Carbon Copy (BCC) function when sending group emails;
  • accidental publication of personal information;
  • insecure disposal of personal information such as in a public bin; and
  • losing a laptop with accessible customer personal information on it.  

Malicious or criminal attacks include:

  • ransomware;
  • hacking;
  • malware;
  • staff members opening phishing emails; and
  • theft of documents or storage devices such as USBs containing personal details. 

Personal Data

Personal data lost to data breaches include:

  • contact information, such as personal address, mobile phone or email (85%);
  • financial information, such as credit card details and bank card information (45%); and
  • identity information, which covers documents such as a driver’s licence, passport number, health information and tax file numbers (35%).

Top Five Industries Affected

The top five industries affected by notifiable data breaches include:

  1. health services providers;
  2. finance industry;
  3. legal accounting and management services;
  4. education sector; and
  5. personal services industry.

Practical Tips to Avoid Data Breaches

The data shows that many data breaches that occur are preventable. Therefore, as a business, you can:

  1. come up with technological measures to minimise the risk of a data breach; and
  2. find ways to minimise human error breaches.

Examples of technological measures include:

  • updating your cybersecurity software;
  • storing documents within secured files or using reputable hosting providers;
  • using encrypted passwords through a service like Password Manager or LastPass; and
  • implementing email delay add-ons so you can recall emails for a set time.

Examples of ways to minimise human error breaches include:

  • providing shredders and secure document disposal bins;
  • running training for staff on how to handle personal information;
  • creating a privacy manual that sets out how to handle personal information; and
  • assessing privacy risks of a new project that deals with personal data and designing the project to minimise any risks.

Why You Need a Data Breach Plan

Taking preventative measures will help minimise the chance of data breaches. Nonetheless, human error still happens and hackers always come up with creative ways to circumvent security systems.  

Therefore, you must have a comprehensive data breach response plan if a data breach does occur. Your data breach plan will outline how your business will contain and handle the breach according to privacy law.

If your business complies with the Privacy Act, your plan must include an assessment as to whether the breach is notifiable. Time is critical when a data breach occurs, so your plan must help you act quickly to notify the OAIC and affected individuals. If your business does not have to comply with the Privacy Act, you should still have a data breach plan. The plan will help you handle the problem in a professional and timely manner.

Key Takeaways

The most recent OAIC report shows that many data breaches are caused by human error or criminal attacks. Therefore, businesses need to take measures that minimise human error or better protect their data against criminal attacks.

However, preventative measures are not enough. A comprehensive data breach will ensure you know how to respond to data breaches in a hurry and maintain customer confidence in your business. If you have any questions, get in touch with LegalVision’s IT lawyers on 1300 544 755 or fill out the form on this page.

About LegalVision: LegalVision is a tech-driven, full-service commercial law firm that uses technology to deliver a faster, better quality and more cost-effective client experience.
Jacqueline Gibson

Get a Free Quote Now

If you would like to receive a free fixed-fee quote or get in touch with our team, fill out the form below.

  • We will be in touch shortly with a quote. By submitting this form, you agree to receive emails from LegalVision and can unsubscribe at any time. See our full Privacy Policy.
  • This field is for validation purposes and should be left unchanged.

Privacy Policy Snapshot

We collect and store information about you. Let us explain why we do this.

What information do you collect?

We collect a range of data about you, including your contact details, legal issues and data on how you use our website.

How do you collect information?

We collect information over the phone, by email and through our website.

What do you do with this information?

We store and use your information to deliver you better legal services. This mostly involves communicating with you, marketing to you and occasionally sharing your information with our partners.

How do I contact you?

You can always see what data you’ve stored with us.

Questions, comments or complaints? Reach out on 1300 544 755 or email us at

View Privacy Policy