---
title: "Data breach preparation and response"
source: "https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response"
collection: "oaic-privacy"
guidance_commit: "db3111cd9d11643ac08b34b4d75b0d0d983ca388"
---

# Data breach preparation and response

## A guide for organisations and agencies to help them prepare for and respond to a data breach in line with their obligations under the *Privacy Act*. See Part 4 for help understanding the National Data Breach Scheme.

This guide was updated in June 2024.

Download the [Data breach preparation and response (PDF, 826 KB)](https://www.oaic.gov.au/__data/assets/pdf_file/0023/214637/NDB-Team-Data-Breach-Preparation-and-Response-guide-June-2024.pdf)

<span class="sr-only">Information:</span>

The OAIC is updating this guide to reflect changes to the [*Privacy Act 1988*](https://www.legislation.gov.au/C2004A03712/latest/text) made by the [*Privacy and Other Legislation Amendment Act 2024*](https://www.legislation.gov.au/C2024A00128/asmade/text). These changes enhance the privacy of individuals with respect to their personal information.

The changes that will be reflected in this guide include a new [Division 5](https://www.legislation.gov.au/C2004A03712/2025-02-01/2025-02-01/text/1/epub/OEBPS/document_1/document_1.html#_Toc191455076) of Part IIIC of the Privacy Act, which commenced on 11 December 2024.

The new Division 5 sets up a framework where the Minister may make a declaration that permits the collection, use and disclosure of personal information that would otherwise not be permitted under the APPs. The purpose of that framework is to prevent or reduce the risk of harm to individuals in the event of an eligible data breach.

For more information please refer to [Division 5](https://www.legislation.gov.au/C2004A03712/2025-02-01/2025-02-01/text/1/epub/OEBPS/document_1/document_1.html#_Toc191455076) of Part IIIC of the Privacy Act and the [explanatory memoranda](https://www.aph.gov.au/Parliamentary_Business/Bills_LEGislation/Bills_Search_Results/Result?bId=r7249).

<a href="https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/purpose-and-structure-of-this-guide" class="feature-cards__tile-links-s" data-order="2"></a>

### Purpose and structure of this guide

<span class="feature-cards__arrow-s"> <img src="https://www.oaic.gov.au/__data/assets/file/0020/12548/arrow.svg" class="icon" aria-hidden="true" /> </span>

<a href="https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-1-data-breaches-and-the-australian-privacy-act" class="feature-cards__tile-links-s" data-order="3"></a>

### Part 1: Data breaches and the Australian Privacy Act

<span class="feature-cards__arrow-s"> <img src="https://www.oaic.gov.au/__data/assets/file/0020/12548/arrow.svg" class="icon" aria-hidden="true" /> </span>

<a href="https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-2-preparing-a-data-breach-response-plan" class="feature-cards__tile-links-s" data-order="1"></a>

### Part 2: Preparing a data breach response plan

<span class="feature-cards__arrow-s"> <img src="https://www.oaic.gov.au/__data/assets/file/0020/12548/arrow.svg" class="icon" aria-hidden="true" /> </span>

<a href="https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-3-responding-to-data-breaches-four-key-steps" class="feature-cards__tile-links-s" data-order="2"></a>

### Part 3: Responding to data breaches – four key steps

<span class="feature-cards__arrow-s"> <img src="https://www.oaic.gov.au/__data/assets/file/0020/12548/arrow.svg" class="icon" aria-hidden="true" /> </span>

<a href="https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme" class="feature-cards__tile-links-s" data-order="3"></a>

### Part 4: Notifiable Data Breach (NDB) Scheme

<span class="feature-cards__arrow-s"> <img src="https://www.oaic.gov.au/__data/assets/file/0020/12548/arrow.svg" class="icon" aria-hidden="true" /> </span>

<a href="https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-5-other-sources-of-information" class="feature-cards__tile-links-s" data-order="1"></a>

### Part 5: Other sources of information

<span class="feature-cards__arrow-s"> <img src="https://www.oaic.gov.au/__data/assets/file/0020/12548/arrow.svg" class="icon" aria-hidden="true" /> </span>

<a href="https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/appendix-a-key-terms" class="feature-cards__tile-links-s" data-order="2"></a>

### Appendix A: Key terms

<span class="feature-cards__arrow-s"> <img src="https://www.oaic.gov.au/__data/assets/file/0020/12548/arrow.svg" class="icon" aria-hidden="true" /> </span>

## Related page

<a href="https://www.oaic.gov.au/privacy/notifiable-data-breaches/quick-reference-guide-for-responding-to-data-breaches" class="feature-cards__tile-links-s" data-order="1"></a>

### Quick reference guide for responding to data breaches

<span class="feature-cards__arrow-s"> <img src="https://www.oaic.gov.au/__data/assets/file/0020/12548/arrow.svg" class="icon" aria-hidden="true" /> </span>