Notifiable data breaches: what the OAIC's latest statistics show

The Notifiable Data Breaches (NDB) scheme has applied to organisations and agencies covered by the Privacy Act 1988 since 2018. Every six months the Office of the Australian Information Commissioner (OAIC) publishes what entities have told it about their breaches. Those statistics are the closest thing Australia has to a shared record of how personal information is actually lost, and they are worth reading as a risk signal rather than a news item.

What the OAIC has published

The format has changed. The OAIC’s narrative NDB reports ran to the July to December 2024 period. In November 2025 the OAIC moved to an interactive NDB statistics dashboard, which it describes as a more dynamic view of the information previously contained in its reports, updated twice a year.

The most recent release covers July to December 2025. The underlying data was published on data.gov.au in late June 2026, and the OAIC announced the results, including a full-year total for 2025, on 6 July 2026. The OAIC says the dashboard will next be updated with January to June 2026 data. Figures below come from that media release and the OAIC’s published dataset. Percentages are our own calculations from the OAIC’s counts.

The headline numbers

• 1,205 notifications in 2025, up 8% from 1,112 in 2024 and the highest annual number since the scheme began.
• 670 notifications in July to December 2025, compared with 532 in January to June 2025. The OAIC has noted that it typically receives more notifications in the second half of the calendar year.
• 716 of the 1,205 notifications in 2025 were caused by malicious or criminal activity.
• Health service providers were the most-notified sector for 2025, with 225 notifications (19%).

Privacy Commissioner Carly Kind described the threat to Australian businesses and organisations as “substantial and rising year on year”.

Where breaches come from

In July to December 2025, malicious or criminal attacks caused 405 notifications (60%), human error caused 194 (29%) and system faults caused 35 (5%). The remainder were recorded as other or currently unknown.

Within malicious or criminal attacks, cyber incidents were the largest group, with 253 notifications. Social engineering or impersonation accounted for 88, rogue employees or insider threats for 34, and theft of paperwork or storage devices for 30.

Human error deserves more board attention than it usually gets. Personal information sent to the wrong recipient by email accounted for 66 notifications, and unintended release or publication for 59. These are process and culture failures, and they are largely within an organisation’s own control.

The personal information involved is often the kind that enables further harm. Contact information appeared in 537 of the 670 breaches, identity information in 386, financial details in 253, health information in 228 and tax file numbers in 151.

Sectors and scale

The five most-notified sectors in July to December 2025 were:

1. Health service providers: 128
2. Finance, including superannuation: 83
3. Business and professional associations: 72
4. Australian Government: 51
5. Personal services, including employment, child care and vets: 47

The profiles differ. Almost all breaches notified by business and professional associations (64 of 72) were malicious or criminal attacks. Health service providers had a much higher share of human error (51 of 128).

Most breaches are small. Of the 670 notifications, 161 involved one person and 411 involved 100 people or fewer. At the other end, three breaches each affected more than 100,000 Australians, and one affected more than 10 million people worldwide. The smaller breaches are still notifiable if serious harm is likely, and they are where most organisations will meet the scheme in practice.

How long identification and notification take

The OAIC’s dataset records, in calendar days, how long entities took to identify breaches and how long they took to notify the OAIC.

For breaches caused by malicious or criminal attacks, 199 of 373 (53%) were identified within 10 days, but 113 (30%) took more than 30 days to identify. Notification was slower still: 213 of 382 (56%) took more than 30 days to reach the OAIC, and only 58 (15%) were notified within 10 days. For human error breaches, 70 of 192 (36%) took more than 30 days to notify.

By sector, 43 of the 50 Australian Government notifications with timing data took more than 30 days to notify. Personal services (21 of 43) and health service providers (43 of 124) notified the largest shares within 10 days.

These figures do not by themselves show non-compliance, since the clock in the law runs from when an entity suspects or believes an eligible breach has occurred. They do show that many organisations take weeks to move from incident to notification, and that the gap is widest for cyber attacks, where investigation is hardest.

What the OAIC expects

The OAIC’s position is consistent across its recent publications:

• Assess within 30 days. If an entity suspects an eligible data breach, it must take all reasonable steps to complete an assessment within 30 calendar days of becoming aware of the grounds for suspicion.
• Notify as soon as practicable. Once there are reasonable grounds to believe an eligible breach has occurred, the entity must notify affected individuals and the OAIC as soon as practicable. Notices to individuals should be plain English and include practical steps people can take.
• Contain first. The OAIC’s response model is contain, assess, notify, review. Prompt remedial action matters: if it means serious harm is no longer likely, the breach is not an eligible data breach.
• Protect and dispose. Under Australian Privacy Principle 11, entities must take reasonable steps to protect personal information and to destroy or de-identify it when it is no longer needed.
• Own your suppliers. The OAIC says entities remain responsible for the actions of their third-party providers. Where information is held jointly, only one entity needs to assess and notify, and the OAIC generally expects the entity with the most direct relationship with affected individuals to notify them.

The Commissioner has also been direct about enforcement posture: the OAIC applies risk-based regulation and expects entities “to comply with their obligations and have strong practices in place to protect personal information”.

Practical lessons

Make the 30 days real. The assessment window is short when forensic work, legal advice and supplier responses all run in parallel. Decide in advance who leads the assessment, who decides whether serious harm is likely, and how that reasoning is documented. A decision not to notify needs a record as much as a decision to notify.

Treat retention as breach prevention. Data that has been deleted cannot be stolen. A working retention schedule, actually applied to old customer, employee and applicant records, reduces both the likelihood and the scale of a notifiable breach.

Settle third-party roles before an incident. The OAIC’s own case study from January to June 2025 involved a software developer whose unauthorised script exposed documents marked private. Contracts should cover security expectations, breach notice to you, retention and destruction, and who assesses harm and notifies individuals. Ongoing oversight matters as much as procurement checks.

Do not neglect the ordinary. Nearly three in ten breaches come from human error. Email controls, publishing checks and staff training are unglamorous, inexpensive and directly reflected in the statistics.

Report upwards. Boards and executive committees should see breach readiness as an ongoing risk, with regular reporting on near misses, response times and supplier exposure, not only when a notification is made.

General information, not legal advice. Confirm how the Notifiable Data Breaches scheme applies to your organisation with your legal adviser.