Key takeaways
- The OAIC’s four steps are contain, assess, notify and review. The first three can happen at the same time.
- If the Notifiable Data Breaches scheme covers you, you must assess a suspected breach within 30 days. If it’s likely to cause serious harm, notify the OAIC and affected people as soon as practicable.
- Many small businesses (turnover of $3 million or less) aren’t covered, but health providers and some others are, whatever their size.
- Your website is often where the breach happens: contact forms, customer accounts, order data and mailing lists all hold personal information.
After a data breach on your website, act in four steps: contain it, assess the risk to the people affected, notify them and the regulator if required, then review what went wrong. In Australia, businesses covered by the Notifiable Data Breaches (NDB) scheme must assess a suspected breach within 30 days. If serious harm is likely, they must notify “as soon as practicable”. The flowchart below shows how the steps fit together.
This guide is general information, not legal advice. If you’re unsure about your obligations, speak to the OAIC or a privacy lawyer.
How common are data breaches for Australian businesses?
The OAIC received 1,205 data breach notifications in 2025, the highest since the scheme began in 2018. Malicious or criminal attacks caused 59% of them (OAIC). The ABS found that 21% of Australian businesses had a cyber security incident in 2024–25 (ABS).
For small businesses, the cost is real. The average cybercrime report from a small business cost $56,600 in 2024–25, according to the Australian Signals Directorate (ASD). Our guide to small business cyber security in Australia covers the wider risks.
What should I do first after a website data breach?
Step 1: Contain the breach
The OAIC’s first step is to contain the breach “to prevent any further compromise of personal information” (OAIC). On a website, that usually means:
- Taking the affected forms, accounts or checkout offline.
- Changing hosting, database, email and admin passwords from a clean device.
- Removing malware and rogue admin users, and closing the way the attacker got in.
- Keeping a copy of the hacked site and logs as evidence before anything is deleted.
Step 2: Assess the risk
Work out what was exposed and to whom. Check every place your website stores personal information: contact form entries, customer accounts, orders, newsletter lists and backups. Ask what someone could do with it. Names and emails can fuel phishing. Addresses, dates of birth or ID documents raise the stakes.
Under the NDB scheme, a covered business must take reasonable steps to finish this assessment within 30 days of suspecting a breach (OAIC). If your quick action prevents serious harm, for example by recovering the data before it’s misused, notification may not be required.
Step 3: Notify, if required
If the breach is likely to cause serious harm and the scheme covers you, you must notify the OAIC and the affected people as soon as practicable. The statement must include your business’s identity and contact details, a description of the breach, the kinds of information involved, and the steps people should take (OAIC).
You can contact everyone affected, or only those at risk of serious harm. If neither is practical, publish the statement on your website and take reasonable steps to bring it to people’s attention.
Step 4: Review and fix the cause
Once the urgent work is done, find out how it happened and stop it happening again. The OAIC suggests a root cause analysis and a prevention plan. For most small business websites, that means updated plugins, stronger logins, better hosting and someone keeping watch.
Does the Notifiable Data Breaches scheme apply to my small business?
Generally, the Privacy Act covers businesses with an annual turnover over $3 million. Smaller businesses are covered too if they are, for example (OAIC):
- A private health service provider, such as a GP, physio, pharmacist or allied health clinic.
- A business that buys or sells personal information.
- A credit reporting body, or a business that receives tax file numbers.
- A business that has chosen to opt in to the Privacy Act.
Not covered? Your customers still deserve to know if their details are at risk. Telling them quickly lets them change passwords and watch for scams. In our experience, it also keeps far more trust than staying quiet.
Where can Australian small businesses get help?
- Australian Cyber Security Hotline: 1300 CYBER1 (1300 292 371), or report at cyber.gov.au/report.
- Small Business Cyber Resilience Service: free one-on-one help from IDCARE for businesses with 19 or fewer employees, including recovery after an incident. Call 1800 595 170 (business.gov.au).
- Your customers: IDCARE also supports individuals whose details have been exposed, on 1800 595 160 (IDCARE).
- Your website: our team helps contain the breach, clean the site and close the gap.
How do I stop it happening again?
Start by knowing what your website collects, and delete what you don’t need. A regular website security scan catches obvious problems. Ongoing website security monitoring catches the rest before customer data leaves the building. Pair it with secure web hosting in Australian data centres and one of our website maintenance plans, and most breaches never get started.
For the rules that sit behind a breach response, see our guide to the Privacy Act and your business website. If the breach came through a hacked site, what to do in the first hour covers containment.
Frequently asked questions
Do small businesses have to report data breaches in Australia?
Only if the Privacy Act covers them. That generally means an annual turnover over $3 million, but health service providers, businesses that trade in personal information and some others are covered whatever their size. Covered businesses must notify eligible data breaches to the OAIC and the people affected.
What counts as an eligible data breach?
It’s when personal information is accessed, disclosed or lost without authorisation, that is likely to cause serious harm to someone, and your remedial action hasn’t removed that risk. Think about what a criminal could realistically do with the information. If you’re unsure, the OAIC’s guidance walks through the assessment.
How long do I have to report a data breach?
If you suspect an eligible data breach, you must take reasonable steps to assess it within 30 days. If it is an eligible breach, you must notify the OAIC and affected people as soon as practicable. Don’t wait for the 30 days to run out if the harm is clear.
Is a hacked website always a data breach?
No. A hack that only adds spam pages or redirects may not touch personal information. But if your site holds customer details, such as form entries, accounts or orders, assume they might have been accessed until you’ve checked. The assessment step is how you find out.
Should I tell customers even if I’m not legally required to?
Usually, yes. If their details may be at risk, a short, honest message lets them change passwords and watch for scam emails. Say what happened, what information was involved, what you’ve done and what they should do. It protects them and your reputation.
Sources
- Quick reference guide for responding to data breaches, Office of the Australian Information Commissioner, accessed 13 November 2026
- Part 3: Responding to data breaches, four key steps, OAIC, accessed 13 November 2026
- Part 4: Notifiable Data Breach (NDB) Scheme, OAIC, accessed 13 November 2026
- Small business, OAIC, accessed 13 November 2026
- Data breach notifications increase to all-time high in 2025, OAIC, 2026
- Characteristics of Australian Business 2024–25, Australian Bureau of Statistics, 25 June 2026
- Annual Cyber Threat Report 2024–25, Australian Signals Directorate, October 2025
- Small Business Cyber Resilience Service, business.gov.au, accessed 13 November 2026
- IDCARE, IDCARE, accessed 13 November 2026