Transparency won. Did privacy? What rising data breaches mean for decision-makers

When Australia’s Notifiable Data Breaches (NDB) scheme commenced in 2018, many organisations saw it as a procedural compliance obligation. Eight years on, it has become something far more significant - a window into how organisations manage (or fail to manage) personal information risk.

The numbers are instructive. In the first full year of the scheme, the OAIC received just under 1,000 notifications. By 2025, that figure had risen to more than 1,200 - the highest annual total on record. While this might indicate a maturing understanding of what constitutes a notifiable breach, it also reflects a sustained exposure to data breach risk across the economy.

The causes are equally telling. Cyber incidents continue to dominate, driven by increasingly sophisticated phishing, ransomware and social engineering attacks. At the same time, human error remains a persistent and material contributor - whether through misdirected emails, poor access controls or failures in process design. In other words, the risk sits across both technology and people, and often in the gaps between them.

Has the NDB scheme achieved its purpose?

From a policy perspective, the NDB scheme has achieved most of its key objectives:

·                Transparency: The scheme has improved transparency. Breaches that would previously have remained internal are now visible to regulators, affected individuals and, often, the market. That visibility has shifted data breach risk from a theoretical concern to a measurable governance issue.

·                Accountability: It has also increased accountability. Organisations must assess, document and notify - often under time pressure and scrutiny. That process, coupled with the potential harm to reputation, has forced engagement at senior levels, which in turn has improved systems, controls and decision-making.

·                Protection: Most importantly, the scheme gives affected individuals an opportunity to act. Timely notification allows people to take practical steps to mitigate harm – for example, to change passwords, cancel cards, monitor accounts for fraud, obtain new identity documents and being alert to phishing attacks.

However, the scheme has been less successful in reducing the overall incidence of data breaches or materially lifting cyber security standards across the economy.

The number of notifications continues to rise. While that partly reflects improved detection, it also suggests that prevention has not kept pace with the evolving threat environment. Compliance with a notification regime does not, of itself, improve security. There remains a risk that some organisations treat the NDB scheme as an endpoint - focused on response - rather than as a driver of broader governance uplift.

The impact goes well beyond notification

For in-house counsel and the C-suite, the consequences of a data breach extend far beyond regulatory reporting.

Regulatory risk is increasing, with significantly higher civil penalties available and a regulator willing to pursue enforcement action. But compliance alone is not a reputational defence. Stakeholders expect transparency, speed and clarity - and will judge organisations on how they respond, not just whether they comply.

Operational disruption can be immediate: systems offline, investigations underway, and management attention diverted. At the same time, organisations must manage communications with customers, employees, regulators and, in some cases, the media.

Reputational impact is often the most enduring. Data breaches are now the leading privacy concern for Australians. Trust, once lost, can be difficult to rebuild.

Perhaps most importantly, a data breach acts as a governance stress test. It exposes how data is actually managed - where it sits, how it flows, who controls it, and how decisions are made under pressure.

What this means for decision-makers

Data breach risk is no longer just a cyber issue. It is an enterprise risk that cuts across legal, operational and reputational domains.

For senior leaders, the key questions are straightforward:

• Do we know what personal information we hold and why?

• Do we understand how that information moves across our organisation and through our suppliers?

• Are our response plans tested and aligned with executive decision-making?

• Can we communicate clearly in the first 24–48 hours of an incident?

The organisations best placed to respond are those that treat privacy and cyber risk as core governance issues - not as a compliance overlay or an IT problem.

A practical conversation worth having

The NDB scheme has succeeded in shining a light on data breaches. What it has not done - and was never likely to do on its own - is eliminate them.

That is why practical, experience-based conversations matter. On 18 August 2026, Bartier Perry will host a Q&A panel with a client who has experienced a data breach and a cyber security expert, focused on what happens when theory meets reality.

For in-house counsel, directors and the C-suite, it will be an opportunity to hear first-hand what matters before, during and after a breach - and to pressure-test whether their own organisations are ready for the moment when preparation is no longer optional.

If a notifiable data breach occurred tomorrow, how confident are you in your organisation’s response?

Author: Michael Cossetto

See also: 18 AUGUST - Data breaches: what happens next? 

This publication is intended as a source of information only. No reader should act on any matter without first obtaining professional advice.