Notifiable Data Breaches Perth: What Businesses Need to Know
What counts as a notifiable data breach, who you must tell, and how DM1 helps Perth businesses prepare for and respond to data breach incidents.
Talk to DM1 TodayView Our ServicesWhat Is a Notifiable Data Breach?
Under the Privacy Act 1988 (Cth), organisations covered by the Australian Privacy Principles must notify the Office of the Australian Information Commissioner (OAIC) and affected individuals when an eligible data breach occurs.
An eligible data breach occurs when personal information is accessed by, disclosed to, or lost by, unauthorised persons, AND it is likely to result in serious harm to any of the individuals whose information was involved.
DM1 is an IT provider, not a legal or compliance adviser. This page describes IT controls and incident response processes relevant to data breach prevention and notification. For legal advice on breach notification obligations, consult your legal adviser.
What Causes Notifiable Data Breaches in Small Businesses?
Compromised employee accounts
A staff member's Microsoft 365 account is taken over through a phishing attack or credential theft. The attacker accesses emails, files and client data. This is the most common cause.
Ransomware encryption of client data
A ransomware attack encrypts business files. Even without exfiltration, this may constitute an eligible breach if personal information was potentially accessed.
Accidental disclosure to wrong recipient
Sending a client's personal information to the wrong email address is a data breach. Microsoft 365's DLP policies can warn staff before sending sensitive information externally.
Lost or stolen device
A laptop or phone containing personal information that is lost or stolen constitutes an eligible breach if the device is unencrypted and unmanaged. BitLocker and Intune mitigate this.
Misconfigured cloud storage with data publicly accessible
A SharePoint site set to "Anyone with the link" makes data publicly accessible. DM1 regularly audits sharing settings and removes inappropriate access.
Insider access by a departing employee downloading client data
An employee who takes client data when leaving constitutes a breach. DM1's offboarding process revokes access and reviews recent download activity before accounts are disabled.
What to Do If You Suspect a Data Breach
Contain the Breach Immediately
Call DM1 on (08) 6202 6012. DM1 will revoke sessions, disable compromised accounts, isolate affected devices, and stop the breach from spreading. Speed is critical.
Assess the Scope
DM1 reviews Microsoft 365 audit logs and sign-in records to determine what data was accessed, by whom, from where, and for how long.
Notify if Required
If the breach is eligible, the Privacy Act requires notification to the OAIC within 30 days of becoming aware. DM1 provides the technical evidence required, while your legal adviser handles the notification itself.
How DM1 Helps Perth Businesses Prevent and Respond to Breaches
This page provides general information about the Notifiable Data Breaches scheme. It does not constitute legal advice. Businesses should consult qualified legal advisers regarding their specific obligations under the Privacy Act 1988 (Cth).
Related Privacy and Security Topics
The notifiable data breach scheme sits within the broader Privacy Act compliance landscape and the Microsoft 365 security baseline DM1 builds for every Perth business.
Privacy Act Compliance
What Australian businesses need to do under the Privacy Act 1988.
Read more →
Microsoft 365 Data Backup
Microsoft retains your data, but the responsibility for backup is yours.
Read more →
Microsoft Defender for Business
Endpoint security that detects ransomware, malware, and credential theft on Windows, Mac, and mobile devices.
Read more →
Microsoft Intune
Device management that enforces compliance and pushes settings to your fleet.
Read more →
Microsoft Entra ID
The cloud identity service controlling who signs in to your tenant and what they can access.
Read more →
Conditional Access
The policy engine that decides who can sign in, from where, and on which devices.
Read more →
Cyber Security Perth
DM1's overview of the security layers protecting your Microsoft 365 tenant.
Read more →
Essential Eight Perth
The eight Australian cyber security strategies every business should aim to implement.
Read more →
Microsoft 365 Perth
The full Microsoft 365 platform DM1 configures and manages for Perth businesses.
Read more →
Get Your Data Breach Prevention Controls in Place
DM1 implements the technical controls that reduce breach risk and enable rapid response. Call (08) 6202 6012 to discuss your current IT security posture.
Contact DM1 Today(08) 6202 6012