An eligible data breach is a personal-data incident that meets the threshold in Australia’s Notifiable Data Breaches (NDB) scheme. It applies when unauthorised access, disclosure, or loss of information is likely to cause serious harm to affected individuals. The key question is not only whether data was exposed, but whether the exposure could realistically be misused for fraud, identity theft, phishing, or other harm.
In practice, organisations assess what data was touched, how sensitive it is, who may have obtained it, and whether controls such as encryption or access restrictions reduce the risk. If the incident is reasonably believed to be eligible, the organisation must notify the OAIC and affected people, usually with guidance on what happened and what steps to take next. In attacks, an eligible data breach often follows compromised credentials, an exposed application, or misuse of legitimate access. In defense, strong identity controls, monitoring, and rapid containment help limit the chance that a breach crosses the legal and operational threshold.