In today’s digitally connected world, cyber security is more critical than ever. One vital aspect of cyber security that has garnered attention in Australia is the Notifiable Data Breach (NDB) scheme. Under the Privacy Act 1988, certain Australian agencies and organisations are required to notify affected individuals and the Australian Information Commissioner if a data breach likely to result in serious harm occurs. This provision aims to bolster cyber security by ensuring individuals are informed and can take protective measures, such as changing passwords or monitoring financial accounts. In this blog, we’ll delve into the nuances of the NDB scheme and explore its vital role in strengthening the cyber security landscape in Australia.
Table of Contents
What does the Australian Government classify as a data breach?
A data breach, as defined under the Notifiable Data Breach (NDB) scheme in Australia, occurs when unauthorised access to or disclosure of personal information is made, or when there is a loss of personal information that an entity holds. A breach becomes eligible for notification if it is likely to result in serious harm to the individuals affected, considering factors like the sensitivity of the information, the nature of the harm, the kind of information, and the security measures in place. Serious harm can encompass a broad range of consequences, including physical, psychological, emotional, financial, or reputational harm, and not all data breaches require notification, such as when quick remediation prevents the likelihood of serious harm. Examples include:
Unauthorised Access by an Employee: An employee of a financial institution browses sensitive customer records without any legitimate purpose, gaining unauthorised access to information like account numbers and personal details. This can lead to serious financial harm to the individuals whose information was accessed.
Accidental Disclosure Online: An employee of a healthcare provider accidentally publishes a confidential file containing the medical records of patients on the internet. This unauthorised disclosure may expose sensitive health information, leading to potential emotional or reputational harm for those involved.
Loss of Physical Information: An individual working for a corporation leaves a laptop containing unsecured personal information, such as client contact details and contracts, on public transport. If the information is not encrypted or otherwise protected, and it falls into the wrong hands, it could lead to unauthorised access or disclosure, potentially resulting in financial or reputational damage to the clients whose information was lost. If the information is remotely deleted or encrypted to a high standard, making unauthorised access unlikely, then it may not qualify as an eligible data breach under the NDB scheme.
Does my business need to legally report a data breach?
Jam Cyber highly recommends business owners seek legal advice to determine their full obligations in the event of a cyber attack.
Under the Notifiable Data Breaches (NDB) scheme, various Australian entities must report eligible data breaches. These entities include:
Government agencies
Businesses and not-for-profit organisations with an annual turnover of more than AU$3 million
Private sector health service providers
Credit reporting bodies
Credit providers
Entities that trade in personal information
Tax file number (TFN) recipients
Accredited data recipients and designated gateways under the CDR system
Small business operators generally don’t have legal obligations unless they meet specific criteria, such as holding health information or trading in personal information. Certain activities can also require smaller businesses to be compliance with the NDB scheme.
Entities with Privacy Act security obligations only must notify breaches affecting the information within their obligations’ scope. APP entities, including businesses over $3 million turnover, and specific smaller businesses, are also subject.
Credit providers, credit reporting bodies, and TFN recipients are also obliged under the scheme. Some private sector employers are exempt, but it’s advised to notify affected individuals if a breach is likely to result in serious harm. Further details and exemptions can be found in Australian Privacy Principles and legal documents governing specific cases.
Even if your business is not legally required to notify of a data breach, you should consider ethical requirements and how the breach may impact your customers or employees.
My business is an ‘eligible entity’ what do I need to do?
It is now vital for all Australian businesses to protect themselves against cyber attacks. This requirement is heightened for entities which have legal obligations under the NDB Act. The best way to protect your business is by implementing a cyber security framework.
A robust defence against cyber attacks necessitates more than just technology; it requires comprehensive policies, procedures, employee training, and a cohesive cyber security framework. These elements work together to create an informed and vigilant environment where potential threats are understood and properly managed, strengthening the overall resilience of the system.
Should your business experience an attack, and you are eligible under the NDB scheme, you will be required to notify the individuals at risk of serious harm as well as the Commissioner. The notification to the Commissioner must include a statement with details of the breach such as identity and contact details of the notifying entity, description of the data breach, the kind of information concerned, and recommendations for individuals to minimise the impact. Voluntary additional information can be provided to the Commissioner to further explain the circumstances of the breach.
When notifying individuals about an eligible data breach, entities have three options depending on what’s practicable:
Option 1 — Notify all individuals: If practicable, notify all individuals whose information was part of the breach, even if not all are at risk of serious harm.
Option 2 — Notify only those individuals at risk of serious harm: Notify only those specifically at risk of serious harm, avoiding unnecessary distress to others.
Option 3 — Publish notification: If neither option 1 nor 2 is practicable, publish the statement on the entity’s website and take reasonable steps to publicise the content, ensuring it’s available for at least 6 months.
Entities must decide which option to follow as soon as practicable after forming the belief that there has been a data breach, and must consider factors like cost, time, effort, and the likelihood of serious harm. The notification must include specific details about the breach and recommendations for individuals to respond.
How do I write a data breach notification?
The Jam Cyber Security Framework provides specialised tools for organisations, including a specific template for notifiable data breaches. This template is designed to assist in the clear and compliant notification process, ensuring that both individuals at risk and relevant authorities are informed according to the act’s requirements.
We have been with Jam Cyber for years and we couldn't be happier. Their cyber security is second to none. Each month they also send out training videos to advise what to look out for with cyber threats being everywhere these days. If you want everything fully protected, I strongly suggest signing on with Jam Cyber - Max Sollmer - General Manager - Storm Support Services
Allison B.
1730347316
The team have been assisting us for 10+ years with IT and cybersecurity issues.
Sh D.
1730336351
Easy to communicate with and very professional.
Tom W.
1729147183
Professional, responsive and good to deal with.
Vee B.
1729123903
Always a great experience! Fast and easy fix with Kurt. thank you JamCyber.
Victoria B.
1728951698
Great individualised service.Ferdinand took the time to work through the process with me and customise the prompts to work for our business.
Nathan D.
1726536170
Jasper was very responsive and helpful when it came to setting up my work laptop
Rami F.
1723670821
Michelle R.
1723185702
The team actioned my Citrix issue the same day. They were courteous enough to contact me via call and email to let me know they are about to connect and work on the issue. I watched how Jasper (the tech) sorted and resolved it right away. He even made sure all is good before he jumped off the chat. Thank you.
Marie M.
1722995084
I am grateful for the help that Kurt D. provided to immediately resolve the issues my work laptop was having. He was patient and committed to find the solution. He did a great job.
Katrina De C.
1721340073
Highly recommend Jimmy and Jam Cyber. They have helped our firm for years they go above and beyond and resolve every issue we have in a timely manner, can always count on them to be there to help when needed.
Hannah M.
1721101624
quick communication and friendly staff.
John V.
1720685063
Excellent service from Dianne. She very patient and knowledgeable and resolved the issues. Thank you! Highly recommend using Jam Cyber.
Israel A.
1720499049
I am extremely satisfied with the IT support I received in resloving my internet connection issue. The response was prompt, and Jasper was incredibly knowledgeable and professional. He patiently guided me through each step. My connection is now stable. I highly recommend their services to anyone in need of technical assistance.
Managers M.
1719883966
Jamcyber have been super helpful with our migrations and IT support.very professional and quick responses to our requests for assistance with our cyber security.
Peter T.
1718759377
Jimmy at Jam Cyber Security is absolutely fantastic! He has been helpful and informative and always has a professional and positive attitude in the work that he does.
Manuela G.
1718756108
The team at Jamcyber and Cyber security are absolutely amazing! They have assisted me with all technical, IT and security related matters in an efficient manner. I would highly recommend Jimmy and the team for all IT and security needs.
Mary Ann Dela C.
1718166047
Jam Cyber is very reliable cybersecurity solution. Its clear instruction and skyrocket effectiveness in threat detection and strong customer support, make it an excellent choice for small to medium-sized businesses. Their comprehensive protection and ease of use justify the investment. Highly recommended for businesses seeking a dependable cybersecurity solution.
Joyce N.
1717715588
Ferdie is an extremely friendly, professional person to deal with. It is always a pleasure to have him help me through my issues.
Kate Aubrey B.
1717473111
Jam has been a very helpful for our company's cybersecurity. Very approachable team plus has deep understanding of the latest threats have kept our systems secure and our data protected. The level of service and support we receive is great. Recommend them for any cybersecurity needs! Thanks, Jam Team!
Adellie L.
1717403027
The tech support team was fantastic. They were responsive and knowledgeable. I highly recommend their reliable and efficient support services. Thank you Dianne and Jimmy for the outstanding help!
Sarah Y.
1716863678
Jimmy Gao from Jam Cyber is great - he is very responsive, quick to resolution and knowledgeable. I would higher recommend Jimmy for all your IT and cyber security needs.
Sharon D.
1716532992
Without Jimmy we could not function. He has the answer to all our IT questions and solves every problem we face. And it's all done with a smile!
Owen C.
1716505410
Jimmy from Jam Cyber is extremely helpful and professional. He has been dedicated and attentive in resolving our issues and always carry’s a positive attitude.
Dy-ell H.
1715819414
Jam Cyber have been extremely helpful. A big shout out to Jimmy Gao who is always ready and able to help. He definitely makes our jobs easier and smoother, especially with the new system upgrade we just rolled out. It would not have been possible without him.
Gabriella K.
1715817166
Jimmy at Jam Cyber is amazing! He has put in a lot of time and effort in transitioning our business to a new cloud based platform. He is attentive and resolves issues with minimal fuss. Highly recommend Jimmy for your IT needs.
Ben and Elissa O.
1715816587
Jimmy Gao at Jam Cyber is professional, responsive and incredibly knowledgeable. Our firm is lucky to work with Jimmy who always provides top quality support and has really helped us with our IT projects and cyber security. I highly recommend Jimmy and the Jam Cyber team.
James T.
1712263326
Jamcyber has provided The Dataline Group with specialist IT support for many years. We always receive prompt service and we always obtain the right outcome, thanks to the knowledge and expertise of Ian and Ferdinand. I recommend this business.
Tong T.
1712193363
Jimmy completed a comprehensive review of our current set up and provided a cost effective solution that met our needs.Very friendly and easy to deal with
Calvin N
1710807031
Professional and reliable service. Resolved all my problems quickly.
jsf
1710803278
We engaged their services for a comprehensive suite of IT solutions, encompassing email hosting, IT support, and office network file sharing. Their responsiveness and professionalism were exemplary, earning our highest recommendation.
LooMate
1707428062
I've been with Jam Cyber for 15 years and love dealing with Markus and Ian and all staff. Best value in Australia.
Jasmine H.
1707373439
Jamcyber has been great with our cyber security roll out and migration to Microsoft 365.Jimmy and the team is very knowledgeable and quick to respond. It is good to have a support that you can actually talk to over the phone. Highly recommended.
Irene W
1701390148
Balance Insurance - Jam cyber has been a big help with my cyber security and voip services. Jimmy and his team is always quick to respond and professional. highly recommended.
Karen R.
1700477039
Excellent IT support & cyber security. Highly recommend - fast response time & professional service.
Tania M.
1699585073
Jam cyber helped me quickly and effortlessly with my IT issue.
Elissa Z.
1698974121
Jam Cyber has provided us with exceptional IT services for years now. Jimmy from Jam Cyber is professional, responsive and very knowledgeable across all things to do with our IT needs. Jam Cyber assists with all aspects of IT at including cyber security and selecting the best hardware for our firm.
Dana S.
1698371121
Awesome quick response always! Jam Cyber help us with Cyber Security and IT for our firm! Very helpful and always available!
Andrew F.
1674511498
We highly recommend the services of Jam Cyber who have been managing all of our IT and Telecommunications plus Cybersecurity for over 12 years. The team at Jam Cyber have been amazing, their systems and procedures have kept our IT operations running smoothly the entire time and their response timing and availability has been excellent.Thanks and regards,Andrew FinlaysonManaging Director Carrington Property Group
christopher K.
1659684395
We have used Jam Cyber for 8 years and been very happy with their service. They have been there when we needed them
Yvonne C
1658959147
Competent, confident, consistent, caring. Markus, Jimmy (and now Ferdi, Blair, May) and the team's level of service has not waned since 2012; they treat their customers, regardless of size, with integrity and professionalism. The picture included here is non IT/techie because although the team "live and breath" IT, they know how to speak to non-IT/techies.
Ronique L.
1657840907
Golden Age has used Jam Cyber for the last 2-3 years to support our cyber security and IT needs. They have always been responsive and solved any problems that came up. Would recommend!
Sharon P.
1655956894
The team are very knowledgeable and are always very helpful. Highly recommended.
Simone H.
1649560212
I can't recommend Markus, Jimmy, John, Ferdie and the team at JamCyber more highly. Cyber security and functioning IT solutions are vital for the day to day operation of my legal practice and JamCyber is across it all. The team is always very responsive, lovely to deal with, efficient and communicate clearly (they don't speak "IT" and expect we'll always follow). They're simply the best.
Samantha H
1647995235
Jimmy and the team at Jam Cyber are so knowledgeable, reliable and quick to respond to any issue, big or small. Jimmy in particular has been great to deal with - I highly recommend him and his team for IT support services.
Vania H.
1646112210
When I first started my legal practice, I had very little idea about cyber security and what is required. Markus and the team and Jamcyber walked me through everything and set it up perfectly. If I have anything done, like I need a new email set up or onboarding of a new staff member, they’re onto it, as soon as possible – it’s seamless. These guys know IT and they know cyber security – they’re also the best I’ve come across. If you want the best, use Jamcyber for everything IT-related.
Uma D.
1640053418
Jimmy from JamCyber is extremely helpful. He is very pleasant, patient and always gets the job fixed quickly. Thank you!
PE Family L.
1640047896
Jam cyber has greatly assisted us with our cyber security and it has been a great pleasure working with them
Kelly D.
1639107821
Jimmy and the team at Jam Cyber are always helpful and easy to deal with.
Carole W.
1639102760
Always great doing business with Jimmy and the team at Jam Cyber.
What is a notifiable data breach?
In today’s digitally connected world, cyber security is more critical than ever. One vital aspect of cyber security that has garnered attention in Australia is the Notifiable Data Breach (NDB) scheme. Under the Privacy Act 1988, certain Australian agencies and organisations are required to notify affected individuals and the Australian Information Commissioner if a data breach likely to result in serious harm occurs. This provision aims to bolster cyber security by ensuring individuals are informed and can take protective measures, such as changing passwords or monitoring financial accounts. In this blog, we’ll delve into the nuances of the NDB scheme and explore its vital role in strengthening the cyber security landscape in Australia.
Table of Contents
What does the Australian Government classify as a data breach?
A data breach, as defined under the Notifiable Data Breach (NDB) scheme in Australia, occurs when unauthorised access to or disclosure of personal information is made, or when there is a loss of personal information that an entity holds. A breach becomes eligible for notification if it is likely to result in serious harm to the individuals affected, considering factors like the sensitivity of the information, the nature of the harm, the kind of information, and the security measures in place. Serious harm can encompass a broad range of consequences, including physical, psychological, emotional, financial, or reputational harm, and not all data breaches require notification, such as when quick remediation prevents the likelihood of serious harm. Examples include:
Does my business need to legally report a data breach?
Jam Cyber highly recommends business owners seek legal
advice to determine their full obligations in the event of a cyber attack.
Under the Notifiable Data Breaches (NDB) scheme, various
Australian entities must report eligible data breaches. These entities include:
Small business operators generally don’t have legal obligations unless they meet specific criteria, such as holding health information or trading in personal information. Certain activities can also require smaller businesses to be compliance with the NDB scheme.
Entities with Privacy Act security obligations only must notify breaches affecting the information within their obligations’ scope. APP entities, including businesses over $3 million turnover, and specific smaller businesses, are also subject.
Credit providers, credit reporting bodies, and TFN recipients are also obliged under the scheme. Some private sector employers are exempt, but it’s advised to notify affected individuals if a breach is likely to result in serious harm. Further details and exemptions can be found in Australian Privacy Principles and legal documents governing specific cases.
Even if your business is not legally required to notify of a data breach, you should consider ethical requirements and how the breach may impact your customers or employees.
My business is an ‘eligible entity’ what do I need to do?
It is now vital for all Australian businesses to protect themselves against cyber attacks. This requirement is heightened for entities which have legal obligations under the NDB Act. The best way to protect your business is by implementing a cyber security framework.
A robust defence against cyber attacks necessitates more than just technology; it requires comprehensive policies, procedures, employee training, and a cohesive cyber security framework. These elements work together to create an informed and vigilant environment where potential threats are understood and properly managed, strengthening the overall resilience of the system.
Should your business experience an attack, and you are eligible under the NDB scheme, you will be required to notify the individuals at risk of serious harm as well as the Commissioner. The notification to the Commissioner must include a statement with details of the breach such as identity and contact details of the notifying entity, description of the data breach, the kind of information concerned, and recommendations for individuals to minimise the impact. Voluntary additional information can be provided to the Commissioner to further explain the circumstances of the breach.
Notifying the Commissioner
Businesses can notify the Commissioner online. Go to: https://www.oaic.gov.au/privacy/notifiable-data-breaches/report-a-data-breach and follow the instructions.
Notifying individuals:
When notifying individuals about an eligible data breach, entities have three options depending on what’s practicable:
Entities must decide which option to follow as soon as practicable after forming the belief that there has been a data breach, and must consider factors like cost, time, effort, and the likelihood of serious harm. The notification must include specific details about the breach and recommendations for individuals to respond.
How do I write a data breach notification?
The Jam Cyber Security Framework provides specialised tools for organisations, including a specific template for notifiable data breaches. This template is designed to assist in the clear and compliant notification process, ensuring that both individuals at risk and relevant authorities are informed according to the act’s requirements.
Alternatively, organisations can review the information on the Australian Government website here: Data breach preparation and response | OAIC
// Need more help?
Contact our team today.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Recent Posts
Categories