Most businesses do not find out about a breach the way they imagine. There is rarely a dramatic moment. It is a staff member mentioning that a client received an odd invoice, or a supplier asking why you sent them a link, or a login from a city nobody in the team has visited. Something feels off well before anything is confirmed.
What happens in the hours after that moment matters more than almost anything else. Not because of the technology, but because a data breach response is a decision problem under pressure. The businesses that come through one well are rarely the ones with the biggest security budget. They are the ones who already know who does what, because they decided in advance.
This guide covers the practical cyber incident response steps Australian businesses need to take, the legal notification obligations that apply, and how to close the gaps that made the breach possible in the first place.
Is my business even at risk of a data breach?
Yes, and not as a scare tactic. It comes down to how Australian privacy law and modern attack patterns actually work.
Australian businesses often assume the Privacy Act 1988 only applies once they turn over $3 million a year. That threshold is real, but the exceptions to it cover a lot of ground. If your business is a health service provider of any size, trades in personal information, is a credit provider, or handles tax file numbers, the Notifiable Data Breach scheme applies regardless of revenue. And every business that runs a payroll handles tax file numbers.
The second assumption, that your business does not really hold personal data, rarely survives a proper look. Staff records, bank details, ID scans collected during onboarding, client email threads, quotes with pricing in them, your accounting file. Attackers are not always chasing a customer database. Very often they want your mailbox, because your mailbox is a trusted way into everyone who deals with you.
How serious is the Data Breach Threat in Australia Right Now?
The Office of the Australian Information Commissioner recorded 1,205 data breach notifications in 2025. That is the highest figure since the scheme began in 2018, and 8% up on the year before. Around six in ten of those breaches, 716 of them, came from malicious or criminal attacks rather than accidents.
The part that catches owners out is the reputational side. According to the OAIC’s Australian Community Attitudes to Privacy Survey, 82% of Australians now name data breaches as their leading privacy concern, up from 74% in 2023. Your customers have been reading about this for years. They have already decided how they feel about it, long before it ever happens to you.
The other number worth sitting with is detection time. IBM’s Cost of a Data Breach Report 2024 found the global average time to identify and contain a breach is 258 days. By the time most businesses discover they have a problem, the attacker has had months inside the environment.
What to Do After a Data Breach: Six Steps in Order
The order matters more than the speed. A data breach response that moves fast in the wrong sequence creates new problems: destroyed forensic evidence, inaccurate notifications, and incomplete containment. Here is what a good response looks like:
Step 1: Contain the breach immediately
Isolate affected devices and accounts, reset passwords, and revoke active sessions and tokens. Stop the exposure before you start investigating.
Resist the urge to wipe and rebuild straight away. The forensic evidence on those systems is what tells you how the attacker got in, how far they reached, and what they accessed. Wiping too early turns a manageable incident into an incomplete one.
Practical actions:
- Disconnect affected devices from the network without powering them off where possible
- Revoke active sessions across email, cloud platforms, and any connected systems
- Reset credentials for all accounts that may have been accessed or compromised
- Notify your IT provider or internal security team immediately so parallel investigation can begin
Step 2: Assess what was exposed
Determine which systems were affected, which records were accessed or exfiltrated, which people are involved, and over what time period. This assessment forms the factual foundation for every notification and recovery decision that follows.
Guesswork at this stage turns into an inaccurate data breach notification later, and an inaccurate notification creates a separate compliance problem. Take the time to get the scope right before communicating externally.
Practical actions:
- Review system logs, access records, and email activity across the affected period
- Identify every category of personal information that may have been involved
- Document which individuals (staff, clients, suppliers) are potentially affected
- Determine whether the breach is contained or whether access may still be ongoing
Step 3: Determine whether you have an eligible data breach
Under the Privacy Act 1988, an eligible data breach is one that is likely to result in serious harm to any of the individuals whose information was involved. This is the legal threshold that triggers data breach notification obligations under the Notifiable Data Breaches scheme.
An eligible data breach exists when three conditions are met: personal information has been accessed, disclosed, or lost; it is information that an entity holds and is required to protect; and a reasonable person would conclude that the access or disclosure is likely to result in serious harm to one or more affected individuals.
Serious harm includes financial harm, reputational damage, physical harm, psychological harm, and harm arising from identity theft or fraud. The assessment of serious harm considers the sensitivity of the information involved, the nature of the likely harm, and the characteristics of the affected individuals.
Step 4: Check your notification timeline
If you suspect an eligible data breach, the OAIC requires you to take all reasonable steps to complete your assessment within 30 calendar days of becoming aware of it. The OAIC expects businesses to move faster than 30 days where circumstances allow — this is a maximum, not a target.
If your assessment confirms an eligible breach, you are required to notify the OAIC and affected individuals as soon as practicable. Notification to individuals must include what happened, what information was involved, and what steps they should take to protect themselves.
Practical actions:
- Record the date and time you first became aware of the potential breach
- Begin your formal assessment immediately. Do not wait for confirmation before starting the clock
- Prepare your OAIC notification using the online NDB notification form at oaic.gov.au
- Prepare individual notifications in plain language before the assessment period ends, so they can be issued immediately upon confirmation
Step 5: Report it to the right authorities.
Data breach notification obligations extend beyond the OAIC in many cases. Depending on the nature of the breach, additional reporting may be required or strongly advisable.
Practical actions:
- ReportCyber (cyber.gov.au/report): Report the cybercrime incident to the Australian Signals Directorate’s ReportCyber portal. This supports the national threat picture and may trigger assistance for serious incidents.
- Australian Taxation Office: If tax file numbers or ATO credentials were involved, phone the ATO’s Client Identity Support Centre on 1800 467 033 so protective measures can be applied to affected accounts immediately.
- IDCARE: If individuals face identity theft risk, refer them to IDCARE on 1800 595 160. IDCARE provides free identity and cyber support to Australians affected by data breaches.
- Your cyber insurer: Notify your insurer early. Late notification can affect your cover, and many cyber insurance policies include incident response support that should be activated as quickly as possible.
- Affected individuals: Notify in plain language, without minimising what occurred. People forgive a breach far more readily than they forgive a poor or delayed response to it.
Step 6: Remediate, document, and recover
Once the immediate response is complete, close the vulnerability that enabled the breach and restore normal operations in a controlled and verified way.
Practical actions:
- Patch or reconfigure what was exploited, whether a vulnerability, a misconfigured system, a compromised credential, or an access control gap
- Review and tighten access controls across the affected environment, removing any accounts that should have been deactivated
- Test that the remediation holds before returning affected systems to production
- Write down what happened while it is still fresh: what happened, how it was detected, what was done, and what the outcome was
- Review and update your data breach response plan to reflect what this incident revealed about gaps in your existing procedures
A documented incident record is what makes your next response faster, your insurer conversation cleaner, and your OAIC engagement more straightforward.
What Is a Notifiable Data Breach: and Does It Apply to Your Business?
A notifiable data breach is an eligible data breach that must be reported to the OAIC and to affected individuals under the Privacy Act 1988. The NDB scheme has applied to Australian businesses since February 2018.
Who the NDB scheme covers:
The scheme applies to all organisations covered by the Privacy Act (generally those with an annual turnover of more than $3 million). However, small businesses below this threshold are still covered if they:
- Provide a health service and hold health information
- Disclose personal information for a benefit, service, or advantage (trade in personal information)
- Are a contracted service provider to an Australian Government agency
- Are a credit reporting body or credit provider
- Handle tax file numbers under a TFN rule
For small businesses that hold tax file numbers, which includes any business with employees, the TFN rule brings them within the scheme’s scope for breaches involving that information specifically.
What must a notification include:
A data breach notification to affected individuals must be in plain language and must cover: the identity and contact details of the entity; a description of the breach; the kinds of information involved; and what steps the entity recommends individuals take in response.
Notification to the OAIC is made through the online NDB notification form and must include the same information, plus details of the steps taken in response.
What a Data Breach Response Plan Should Cover
A data breach response plan is a documented, pre-agreed framework that tells your team exactly who does what when a breach occurs. Businesses with a documented plan spend materially less recovering from a breach than those working it out under pressure, and the difference is not marginal.
According to IBM’s Cost of a Data Breach Report 2024, organisations with a formal incident response team and a tested response plan saved an average of $1.49 million per breach compared to those without one.
A practical cyber security incident response plan for an Australian business covers:
- Roles and responsibilities: Who makes the call to invoke the plan, who handles technical containment, who manages communications, and who liaises with legal, insurers, and the OAIC
- Contact list: IT provider, cyber insurer, legal counsel, OAIC notification portal, ATO Client Identity Support Centre, IDCARE, ReportCyber
- Assessment criteria: How to apply the eligible data breach test quickly and consistently, with documented decision logic
- Notification templates: Pre-drafted OAIC notification and individual notification templates that can be populated and issued without delay
- Evidence preservation protocols: What to preserve, what not to touch, and how to hand off to forensic specialists if required
- Recovery sequence: The order in which systems are restored, how restoration is verified, and what testing is required before production is resumed
The plan is only as good as the last time it was tested. A tabletop exercise, like walking your team through a realistic scenario before an incident occurs, reveals gaps that a document review alone will not find.
For the financial and operational dimensions of business continuity planning, see Corp IT’s business continuity planning guide.
Be protected before it is too late
Every step above is easier if it was decided in advance. Most of the practical protection is unglamorous but effective:
- Multi-factor authentication across email, cloud platforms, and remote access
- Microsoft 365 and email security configured and hardened properly
- Endpoint protection that someone actively monitors, not just installed and forgotten
- Backups tested by actually restoring from them, not just watching them succeed
- Staff who can recognise a phishing email before they click it
- A written data breach response plan that names who makes the call at 6pm on a Friday
Most breaches exploit gaps that were known but not yet addressed. The question is not whether your business faces these risks; it is whether your current controls are proportionate to what you hold and who could be harmed if it was accessed.
Corp IT works with Australian businesses on cyber security protection, incident preparedness, and knowing where you stand before something goes wrong. If you are not confident your business would handle the next twelve hours well, that is worth a conversation.
For ongoing protection, see Corp IT’s Cyber Security services. For business continuity planning before an incident occurs, see our business continuity planning guide.
Frequently asked questions
What is the very first thing to do after a data breach?
Contain it. Isolate the affected accounts and devices, reset credentials and revoke sessions, then start working out what was exposed. Containment first, assessment second, notification third. Resist the urge to wipe affected systems before forensic evidence has been preserved, as that evidence is what tells you how far into your environment the breach reached.
How long do I have to report a data breach in Australia?
If you suspect an eligible data breach, you must take all reasonable steps to complete your assessment within 30 calendar days of becoming aware of it. If it is an eligible breach, you notify the OAIC and affected individuals as soon as practicable. The 30 days is a maximum, not a target.
What is an eligible data breach under Australian law?
An eligible data breach under the Privacy Act 1988 occurs when personal information held by an entity is accessed, disclosed, or lost in circumstances where a reasonable person would conclude that the affected individuals are likely to experience serious harm. Serious harm includes financial harm, identity theft, reputational damage, and psychological harm. Not every breach is an eligible breach: the serious harm threshold must be met before notification obligations are triggered.
What is a notifiable data breach and when must it be reported?
A notifiable data breach is an eligible data breach that must be reported to the OAIC and to affected individuals. If you suspect an eligible breach, you must complete your assessment within 30 calendar days of becoming aware of it. If confirmed, notification to the OAIC and affected individuals must occur as soon as practicable. The 30-day window is a maximum, not a target; the OAIC expects faster action where circumstances allow.
Does the Notifiable Data Breach scheme apply to small businesses?
The NDB scheme generally applies to organisations with annual turnover above $3 million, but small businesses are covered in specific circumstances, including if they provide health services, trade in personal information, or handle tax file numbers. Because any business with employees holds tax file numbers, the TFN rule brings many small businesses within scope for breaches involving payroll or HR data.
How long does a data breach go undetected on average?
IBM’s Cost of a Data Breach Report 2024 found the global average time to identify and contain a breach is 258 days. This means that by the time most businesses discover a breach, the attacker has had months of undetected access. Continuous monitoring and endpoint detection significantly reduce this window, which is why proactive security investment matters well before an incident occurs.
What should a data breach response plan include?
A data breach response plan should cover: defined roles and responsibilities, a current contact list for IT, legal, insurer, and regulatory contacts, assessment criteria for determining whether a breach is eligible, pre-drafted notification templates for the OAIC and affected individuals, evidence preservation protocols, and a verified recovery sequence. The plan should be tested against a realistic scenario at least annually.
What is the difference between cyber incident response and data breach response?
Cyber incident response is the broader discipline of detecting, containing, and recovering from any security incident, including those that do not involve personal data. Data breach response is a specific subset that applies when personal information has been accessed, disclosed, or lost, triggering potential legal notification obligations. In practice, the technical containment and investigation steps overlap significantly. The distinction matters most at the assessment and notification stage, where privacy law determines what is required and by when.
My company does not directly handle private data. Am I still at risk?
Almost certainly. If you employ people, you hold tax file numbers, bank details and identity documents. If you email clients, you hold their information in your mailbox. Attackers also target small businesses as a way into larger ones, so being a supplier to a bigger organisation makes you more interesting, not less.
I am a small business. Do the notification rules apply to me?
They might. The Privacy Act generally applies to organisations turning over more than $3 million a year, but small businesses are still covered if they provide a health service, trade in personal information, are a credit provider or credit reporting body, or handle tax file numbers. Check where you sit before you assume you are exempt.
