[Home](/)/[Resources](/resources)/Australia Notifiable Data Breaches AustraliaPrivacy compliance guide # Australia Notifiable Data Breaches: Connected Hardware Privacy Compliance Australia's Notifiable Data Breaches scheme requires covered entities to notify OAIC and affected individuals when personal data breaches create serious harm risk. For connected hardware manufacturers collecting location, health, or behavioural data from Australian users, NDB compliance is mandatory — and Privacy Act reform is sharply increasing penalties (up to 30% of Australian turnover) and removing the small business exemption that previously excluded smaller device companies. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Faustralia-notifiable-data-breaches) At a glance Law Privacy Act 1988 (NDB scheme) Regulator OAIC Notification 30 days (reform: 72hrs for serious) Max penalty AUD $50M or 30% of turnover ## NDB scheme and connected device privacy ### Australia's Notifiable Data Breaches (NDB) scheme The Notifiable Data Breaches (NDB) scheme, in force under Part IIIC of the Privacy Act 1988, requires Australian Privacy Act-covered entities to notify the Australian Information Commissioner (OAIC) and affected individuals when they experience an 'eligible data breach'. An eligible data breach occurs when: personal information is involved in a data breach; the breach is likely to result in serious harm to affected individuals; and the entity cannot remediate the risk of serious harm before notification is required. For connected hardware companies handling Australian customers' personal data, NDB compliance is part of their baseline privacy obligations. ### Who is covered by the Privacy Act and NDB The Privacy Act (and NDB scheme) covers Australian Government agencies and private sector organisations with an annual turnover exceeding AUD $3 million. Private sector organisations with annual turnover below $3 million are generally exempt — but the Privacy Act Review Report 2022 recommended removing this small business exemption, and reform legislation is progressing. Connected hardware companies with Australian customers should assess their coverage now: if you collect personal data from Australian users through your devices or companion apps, and your global turnover (or Australian turnover) is above the threshold, you are covered. ### Connected hardware and personal data processing IoT devices, smart home hardware, wearables, and connected consumer electronics routinely collect personal data from users: location data, usage patterns, biometric data (fingerprints, voice recordings), health data, device identifiers linked to individuals, and images or audio from cameras and microphones. For Australian users of these devices, the data controller — typically the hardware manufacturer or platform operator — is subject to Australian Privacy Principles (APPs) for data collected by the device, including the NDB notification obligation for eligible breaches involving device-collected data. ### Privacy Act reform and enhanced obligations Australia's Privacy Act reform process (following the 2022 Review and the government's response) is introducing significant changes including: removing the small business exemption, expanding direct regulation of privacy in Australia, enhanced transparency and consent requirements, a new right to erase personal information, a statutory tort of privacy invasion, and increased civil penalties (up to AUD $50 million or 30% of adjusted turnover for serious/repeated violations). The reform substantially increases the stakes of Privacy Act compliance for connected hardware companies collecting Australian users' data. ## Privacy and NDB compliance steps 01 Assess whether your organisation is covered by the Australian Privacy Act: if your annual turnover (global or Australian) exceeds AUD $3 million, or if your business is related to an entity that exceeds the threshold, you are covered — and the small business exemption is being phased out, so plan for coverage regardless. 02 Map all personal data flows through your connected device ecosystem: what data is collected by the device, what is transmitted to your cloud, what is shared with third parties, and how it is retained — this data map forms the foundation of Privacy Act compliance including NDB readiness. 03 Implement a data breach response plan that meets NDB requirements: the plan must specify how potential breaches are detected, who assesses whether a breach is 'eligible', how notification to OAIC (within 30 days of determining a breach is eligible, or 72 hours for a preliminary report) and affected individuals occurs, and how evidence is documented. 04 Establish technical security measures for device-collected personal data appropriate to the sensitivity of the data: encryption in transit and at rest, access controls, intrusion detection, vulnerability management, and penetration testing — security measures proportionate to the data's sensitivity are required by Australian Privacy Principle 11 (security of personal information). 05 Review your privacy collection notice and consent mechanisms for Australian users: APPs require transparent disclosure of what personal data you collect, why, how it is used, and to whom it is disclosed — device setup flows, companion app onboarding, and website privacy policies must all meet APP 5 notice requirements. 06 Assess cross-border data transfer obligations: APP 8 requires that before disclosing personal data to an overseas recipient, you ensure the recipient is bound to equivalent privacy protections — review cloud infrastructure location, third-party analytics integrations, and overseas support team access to Australian user data. 07 Monitor the Privacy Act reform legislative progress: the government's reform legislation is in progress as of 2026 — track OAIC and Attorney-General's Department updates for enactment timelines, and prepare to implement enhanced requirements (right to erase, stricter consent) as they come into force. ## Frequently asked questions ### What is the timeline for notifying OAIC of an eligible data breach? Upon determining that an eligible data breach has occurred (i.e., the entity has formed a reasonable belief that an eligible data breach has occurred), the entity must notify OAIC as soon as practicable, and in any case within 30 days. If the entity initially assesses that a breach may be eligible, it must complete a reasonable assessment within 30 days of forming the belief that an eligible breach may have occurred. For serious incidents — such as breaches affecting large volumes of sensitive personal data — the government has proposed a mandatory 72-hour preliminary notification timeline (aligned with GDPR and Australia's Critical Infrastructure Act) in the reform package. ### What qualifies as an 'eligible data breach' for a connected device? An eligible data breach involves: (1) access to, disclosure of, or loss of personal information; (2) a reasonable likelihood of serious harm to affected individuals; and (3) the entity unable to prevent the likely serious harm before notification is required. For connected devices, scenarios include: cloud platform breaches exposing user location history, health data, or behavioural profiles; device vulnerabilities exploited to access users' home network or credentials; or employee/supplier access to device-collected data for unauthorised purposes. The 'serious harm' assessment considers the sensitivity of the data — location, health, financial, or biometric data collected by IoT devices is typically assessed as high sensitivity. ### Do Australian privacy obligations apply to device manufacturers based overseas? Yes — the Privacy Act applies to organisations that carry on business in Australia or collect or hold personal information about Australian residents, regardless of where the organisation is incorporated or headquartered. An overseas-based connected hardware manufacturer that sells devices to Australian consumers through any channel (including online), and whose devices or platform collect personal data from those consumers, is subject to Australian Privacy Act obligations including the NDB scheme. OAIC can investigate and take action against overseas organisations under the Privacy Act. ### How do the Privacy Act reform's new penalties affect connected device companies? The Privacy Act reform significantly increases maximum civil penalties for serious or repeated privacy interferences: from AUD $2.5 million (individuals) / $50 million (companies) to penalties up to the greater of AUD $50 million, three times the value of the benefit obtained from the interference, or 30% of the entity's adjusted turnover in Australia for the period. For connected device companies with large Australian user bases collecting sensitive data, the 30% of turnover penalty option is particularly significant — it creates a financial incentive for strong privacy compliance proportionate to business scale. **Disclaimer:** Educational resource only. Privacy Act reform is progressing and obligations are subject to change. Consult a qualified Australian privacy law specialist for data breach response planning, APP compliance review, and reform readiness assessment. 🇦🇺 Australia roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇦🇺 Australia compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $149](/courses/44-australia-rcm-marking-electronics-cabling)[Prefer to read? Get the book — $24.99](/books/44-australia-rcm-marking-electronics-cabling) Related guides * [Australia Export Controls DSGLAustralia DSGL export controls for electronics: DSGL Part 2 dual-use categories (Category 3 electronics, Category 5 telecoms/encryption), Individual and Open Individual Export Permits, intangible technology transfer controls, AUKUS streamlined pathways, and 10-year imprisonment penalties.](/guides/australia-export-controls-dsgl) * [Australia Critical Infrastructure SecurityAustralia SOCI Act 2018 for electronics hardware suppliers: 11 critical sectors, Positive Security Obligations (PSOs), Critical Infrastructure Risk Management Programme supply chain hazard category, Systems of National Significance, and 12-hour serious incident reporting.](/guides/australia-critical-infrastructure-security) * [Canada Accessible Canada ActCanada Accessible Canada Act (ACA) for electronics hardware: federally regulated sector procurement requirements, EN 301 549 / WCAG 2.1 AA accessibility standards, accessibility plans and progress reports, and how ACA affects electronics companies supplying federal government.](/guides/canada-accessible-canada-act) * [UAE Cybercrime IoT HardwareUAE Federal Decree-Law 34/2021 cybercrime law for IoT hardware: unauthorised access offences, TDRA type approval for connected devices, ETSI EN 303 645 alignment, UAE Personal Data Protection Law interaction, and criminal penalties for connected device security failures.](/guides/uae-cybercrime-iot-hardware)