25/10/2017
After a long wait, Australia will soon have a mandatory data breach notification scheme in place. Despite the long lead up to this legislation, many businesses are unaware of it, when it comes in place, or if it applies to their business.
What is Mandatory Data Breach Notification?
The soon to be introduced mandatory data breach notification scheme will require all entities subject to the Privacy Act to notify the Office of the Australian Information Commissioner (OAIC) and individuals who may be affected if a breach occurs.
The intent of the legislation is to ensure that individuals have the opportunity to have steps to protect their data or personal information if a breach occurs.
When Does This Legislation Come Into Effect?
From 23 February 2018, the Privacy Act 1988 (Cth) will include the mandatory data breach notification scheme.
How Will The Legislation Affect Businesses?
As a general statement, this legislation will only affect entities with at least $3 million turn over. For more information on who the legislation applies to, please refer to the Office of the Australian Information Commissioner.
Businesses will need to consider how the Mandatory Data Breach Notification legislation will affect them.
The failure of an entity to comply with the obligations to notify may result in investigations or in the case of repeated non-compliance or serious breaches, substantial civil penalties.
In addition to investigations and potential penalties, mandatory data breach notification means that businesses risk losing their reputations and trust of their customers, in the case of a breach.