The Notifiable Data Breaches scheme and AI: when must you tell the OAIC?

Most data breaches involving AI don't look like Hollywood hacks

The Notifiable Data Breaches scheme — introduced under the Privacy Act 1988 — requires APP entities to notify the OAIC and affected individuals when an eligible data breach occurs. Understanding when that obligation is triggered in the context of AI tools is something most Australian SMEs haven't thought through.

The scenarios are more mundane than you might expect: a staff member pastes client files into a consumer AI tool that retains inputs; an AI vendor suffers a security incident affecting your account; an automated workflow sends a client's information to the wrong recipient. These are AI-related data breaches, and the NDB scheme applies to them just as it applies to conventional breaches.

The three-part test for an eligible data breach

Not every incident involving personal information is a notifiable data breach. The NDB scheme applies when three conditions are all met:

1. There is unauthorised access to, or unauthorised disclosure of, personal information — or personal information is lost in circumstances where unauthorised access or disclosure is likely.
2. The information relates to one or more individuals.
3. A reasonable person would conclude that the access or disclosure is likely to result in serious harm to any of the individuals affected.

All three conditions must be present. If the personal information involved is genuinely not sensitive — say, a first name with no other identifying context — and no realistic harm could result, it may not meet the threshold. But the serious harm bar is lower than many businesses assume.

What counts as "serious harm"?

The Privacy Act defines serious harm by reference to a non-exhaustive list of factors, including the sensitivity of the information, the likely use to which it will be put, and the nature of the harm that could result. Examples of outcomes that are likely to constitute serious harm include:

• Identity theft or fraud
• Financial loss
• Physical harm
• Psychological harm
• Damage to reputation, employment prospects, or personal relationships
• Discrimination or harassment

Health information, financial details, government identifiers, and information about children are particularly sensitive. A breach involving these categories is more likely to meet the serious harm threshold.

How AI-specific scenarios map to the NDB test

Scenario 1: Staff member enters client personal information into a consumer AI tool. This is likely an unauthorised disclosure — the client's information was collected by your business, and entering it into a third-party system (particularly one that retains inputs or uses them for training) discloses it to an unauthorised recipient. Whether it's notifiable depends on the sensitivity of the information and the realistic harm that could result.

Scenario 2: Your AI vendor suffers a data breach. Under APP 8, if you failed to take reasonable steps to ensure your vendor handled personal information in accordance with the APPs, you are treated as having breached the APPs yourself. The vendor's breach becomes your potential NDB obligation. You can't wait for the vendor to notify — you have your own assessment obligation.

Scenario 3: An AI-powered automated workflow sends information to the wrong person. If personal information is disclosed to someone who isn't authorised to receive it, that's an unauthorised disclosure. The NDB test then applies.

The 30-day assessment window

When you become aware of a potential eligible data breach, you have 30 days to complete your assessment of whether the breach meets the NDB threshold. This isn't 30 days to decide whether to notify — it's 30 days to complete your assessment. If at any point during that assessment you form a reasonable belief that an eligible breach has occurred, notification is required as soon as practicable.

What notification requires

If you determine that an eligible data breach has occurred, you must:

• Notify the OAIC by completing a statement on their website
• Notify each affected individual directly, unless direct notification would be impossible or involve disproportionate effort (in which case a public notification may substitute)

The notification to individuals must include: a description of the breach, the kinds of information involved, what steps you recommend individuals take to protect themselves, and contact information for your business.

Preparing for NDB obligations before an incident happens

The businesses that handle NDB notifications well are the ones that prepared in advance. Key preparations include:

• Documenting your AI tools and vendors in an AI Register, so you know who to contact immediately if a vendor-side incident occurs
• Including NDB assessment triggers in your AI Incident Response Plan
• Training staff to report potential AI data incidents immediately — the 30-day clock starts from when the business becomes aware, which includes when any employee becomes aware
• Knowing the OAIC's notification process before you need to use it

The OAIC publishes detailed guidance on the NDB scheme, including assessment tools and notification forms, on their website at oaic.gov.au.