Notifiable Data Breach Scheme: What Law Firms Must Do

What is a Notifiable Data Breach

An eligible data breach meets the notification threshold under Part IIIC of the Privacy Act 1988. It involves unauthorised access or disclosure, or lost information where unauthorised access or disclosure is likely. The exposure must be likely to cause serious harm to at least one person. Effective remedial action can remove the notification requirement. The OAIC’s reporting guidance explains these conditions.

The Office of the Australian Information Commissioner (OAIC) administers the scheme. Coverage includes Commonwealth agencies, businesses with annual turnover above $3 million and certain businesses below that threshold. Private health service providers and businesses trading in personal information are among the exceptions to the small business exemption.

A small law firm is not automatically covered simply because it holds bank statements. Under section 6D of the Privacy Act, turnover, business history and exceptions affect its status. Commonwealth contracting, relationships with covered bodies corporate and voluntary opt-in can also bring a small firm within the Act.

An otherwise exempt firm can still have NDB obligations for exposed tax file number information. That coverage concerns information connecting an individual’s tax file number with their identity. Holding a tax file number does not make every other document the firm holds subject to the scheme. The OAIC’s coverage guidance explains this distinction.

Why Bank Statement Data Points to Serious Harm

Exposed bank statements can support identity theft and fraud, and reveal information that puts someone’s safety or private life at risk. Names and account details sit beside payments that show where a person shops, works or receives treatment. Transactions can reveal religious activity, relationships and accommodation.

Assess the exposed material together with what the recipient already knows. A statement with a person’s name, residential address and regular payment locations can expose much more than a balance. The identity of the recipient can change the seriousness of the risk.

In a family matter, a former partner could use an opposing party’s statements to locate a person escaping family violence. Accommodation payments or local transactions can create a physical safety risk even where account numbers are redacted. Treat that scenario as a serious-harm assessment, with a safe contact method for the person at risk.

For a covered firm, the NDB duties apply to personal information it holds about opponents and third parties as well as clients. Obtaining records through a bank-record subpoena does not remove those duties. The family court subpoena handling rules also affect how the firm uses those records.

Assessing a Suspected Breach Within 30 Days

Start the assessment when the firm has reasonable grounds to suspect an eligible data breach. Section 26WH requires a reasonable and expeditious assessment. The firm must take all reasonable steps to finish within 30 days of that awareness.

The OAIC’s response process has four steps. Some run together when people need protection immediately.

1. Contain the exposure. Disable the shared link or stop further distribution. Preserve evidence of what happened while restricting access.
2. Assess the incident. Identify the records, people affected and recipient. Establish whether the files were opened, copied or forwarded, then assess likely serious harm and remedial action.
3. Notify when required. Once reasonable grounds establish an eligible breach, notify as soon as practicable. The 30-day assessment period is not permission to delay an established notification obligation.
4. Review the cause. Correct the process that allowed the exposure and update the response plan. Record the decision and supporting facts even when notification is unnecessary.

Response-plan checklist

Use the OAIC’s response-plan guidance to assign responsibility before another incident occurs. Keep these details accessible if the firm’s usual systems are unavailable.

• Name the response lead and deputy, plus the partner who decides whether notification is required.
• Give staff an immediate reporting contact and an escalation route for urgent safety risks.
• Record the contain, assess, notify and review steps, with decision deadlines and a written incident log.
• Preserve the original email, recipient details and access logs. Keep a record of containment and deletion confirmations.
• List provider incident contacts and the evidence they must supply, including who can disable access.
• Assign responsibility for the OAIC statement and safe contact with affected people. Record who approves each notice.
• Schedule a review of the cause and test the revised response plan after corrective work.

Technical investigators establish how the exposure happened and what was accessed. The response lead uses those findings to assess harm and make notification decisions.

For a wrong-recipient email, request deletion and confirmation that the attachment was neither accessed nor copied or forwarded. A reliable recipient’s evidence can support a finding that serious harm is no longer likely. An email recall or a deletion request alone does not establish that result.

Consider this hypothetical example. A staff member sends statements to an unrelated accountant who promptly confirms deletion without opening or copying them. The firm records the recipient’s response and why the risk has been prevented. If the recipient is an abusive former partner who has already viewed location details, deletion may leave the safety risk intact.

Human error deserves attention in the response plan. The OAIC’s first-half 2025 statistics attribute 37% of reported breaches to human error. Recipient selection and file-sharing controls need to work when a busy staff member makes a mistake.

Notifying the OAIC and Affected People

An eligible breach requires a statement to the OAIC and notification to individuals through the applicable statutory option. Prepare the statement as soon as practicable once reasonable grounds establish the breach.

The statement must contain:

• The firm’s identity and contact details.
• A description of the breach.
• The kinds of personal information involved.
• Recommended steps individuals can take in response.

Lodge through the OAIC’s Notifiable Data Breach form. Attach the template notice intended for individuals. Describe containment and remedial action, and retain the submission and supporting assessment in the incident record.

Section 26WL provides three notification options:

1. Notify every individual whose information was involved, where practicable.
2. Notify only the individuals at risk of serious harm, where the firm can identify and contact them practicably.
3. If neither direct option is practicable, publish the statement on the firm’s website, if it has one, and take reasonable steps to publicise its contents.

A notice hidden on a webpage does not satisfy the publicity requirement. Explain the exposure without reproducing statement details that create another disclosure. For identity or financial risks, recommendations can include contacting the bank and watching for impersonation attempts. Where family violence is involved, select a communication channel that protects the person’s location and safety.

The firm’s OAIC data breach report is its incident notification. The regulator’s published Notifiable Data Breaches reports aggregate notifications from many entities. They help identify failure patterns, while your firm applies the serious-harm test to its own incident.

In the OAIC’s second-half 2024 report, wrong-recipient emails accounted for 42% of human-error breaches. That finding supports recipient checks and restricted sharing links. A sector percentage does not determine whether your firm must notify.

Outside Providers Handling Bank Statements

Set written data-handling terms before sending statements to an outside provider. Record the following requirements for each matter:

• Storage countries and systems, including subcontractor arrangements.
• People who can access the records and the purpose of that access.
• Retention periods for statements and derived analysis.
• Deletion methods, including treatment of backups and confirmation of deletion.
• Incident-reporting timeframes, escalation contacts and access to assessment evidence.

Use a privacy impact assessment before sharing records. The legal process outsourcing guide explains the wider engagement and handoff.

Jointly held information can leave both covered entities responsible under the NDB scheme. Sections 26WJ and 26WM prevent duplicate assessment and notification once one entity meets the relevant requirements for the same breach. A contract assigning the task does not establish that the task was completed.

Specify who leads the assessment and who notifies, with deadlines for sharing evidence and confirming completion. The OAIC generally favours individual notification by the entity with the most direct relationship with affected people. Keep a provider register showing the matter, documents transferred and current retention status. That record lets the firm identify the exposed bundle promptly.

FinTrace saves hours of bank-statement conversion and review through a per-matter analysis service. Lawyers and forensic accountants receive a searchable ledger and a clear report with source references. When engaging a statement-analysis provider, put its data-handling terms and incident responsibilities in the same written engagement as the work scope.

Privacy Reforms Affecting Breach Response

The Privacy and Other Legislation Amendment Act 2024 expanded enforcement and added ways to reduce harm after an eligible breach. The Act’s commencement table distinguishes measures that commenced in 2024 from later provisions.

For conduct after the relevant provisions commenced, section 13H covers privacy interferences below the serious tier. Section 13K covers specified failures, including deficient eligible-breach statements.

The OAIC can issue infringement and compliance notices for specified contraventions after commencement. Check that the breach statement includes every required item and act within any compliance notice’s deadline.

Where the Minister makes an eligible data breach declaration, specified information handling can help prevent or reduce harm. Read its conditions before relying on it to share exposed records.

The official commencement details identify when each provision applies. These reforms expand response and enforcement powers. The serious-harm test and the assessment duty still govern an ordinary misdirected statement email.

The OAIC’s statutory tort explanation sets out the court-based remedy. An accidental email error does not automatically satisfy the tort’s intentional-or-reckless requirement. It can still trigger NDB duties.

Separate enacted provisions from proposed reforms. The Government’s 2026 privacy reform consultation proposes a fair and reasonable handling test and further rights. Consultation proposals do not replace the current statutory tests. The 2024 Act did not abolish the small business exemption.

For a suspected bank-statement breach, assign the assessment today and record when the firm became aware. Confirm coverage and the people at risk, then notify as soon as practicable if the eligible-breach threshold is met.