What is a notifiable data breach?

What does the Australian Government classify as a data breach?

A data breach, as defined under the Notifiable Data Breach (NDB) scheme in Australia, occurs when unauthorised access to or disclosure of personal information is made, or when there is a loss of personal information that an entity holds. A breach becomes eligible for notification if it is likely to result in serious harm to the individuals affected, considering factors like the sensitivity of the information, the nature of the harm, the kind of information, and the security measures in place. Serious harm can encompass a broad range of consequences, including physical, psychological, emotional, financial, or reputational harm, and not all data breaches require notification, such as when quick remediation prevents the likelihood of serious harm. Examples include:

1. Unauthorised Access by an Employee: An employee of a financial institution browses sensitive customer records without any legitimate purpose, gaining unauthorised access to information like account numbers and personal details. This can lead to serious financial harm to the individuals whose information was accessed.
   
   
2. Accidental Disclosure Online: An employee of a healthcare provider accidentally publishes a confidential file containing the medical records of patients on the internet. This unauthorised disclosure may expose sensitive health information, leading to potential emotional or reputational harm for those involved.
   
   
3. Loss of Physical Information: An individual working for a corporation leaves a laptop containing unsecured personal information, such as client contact details and contracts, on public transport. If the information is not encrypted or otherwise protected, and it falls into the wrong hands, it could lead to unauthorised access or disclosure, potentially resulting in financial or reputational damage to the clients whose information was lost. If the information is remotely deleted or encrypted to a high standard, making unauthorised access unlikely, then it may not qualify as an eligible data breach under the NDB scheme.