Data breach preparation and response

The OAIC is updating this guide to reflect changes to the Privacy Act 1988 made by the Privacy and Other Legislation Amendment Act 2024. These changes enhance the privacy of individuals with respect to their personal information.

The changes that will be reflected in this guide include a new Division 5 of Part IIIC of the Privacy Act, which commenced on 11 December 2024.

The new Division 5 sets up a framework where the Minister may make a declaration that permits the collection, use and disclosure of personal information that would otherwise not be permitted under the APPs. The purpose of that framework is to prevent or reduce the risk of harm to individuals in the event of an eligible data breach.

For more information please refer to Division 5 of Part IIIC of the Privacy Act and the explanatory memoranda.