The Notifiable Data Breaches (NDB) scheme is an Australian privacy framework that requires certain organizations to notify the Office of the Australian Information Commissioner and affected people when a data breach is likely to result in serious harm. It applies to personal information, including customer records, identity details, and account data.
In cyber security, the scheme matters because it turns breach impact into a formal risk assessment. After unauthorized access, copying, or exposure, defenders must quickly determine what data was involved, whether attackers could use it for identity theft, phishing, password resets, or account takeover, and whether controls such as credential resets or revocation reduced the danger. The notification decision is not based only on whether data was touched; it depends on the likelihood and severity of harm. That makes incident response a race to contain the breach, understand the scope, and document the evidence needed to support a legal and operational decision.