An online business collects a lot of personal information without much thought. Names, emails, delivery addresses and order histories sit in your store, your inbox and your mailing list. If that information gets into the wrong hands, you need to act quickly and calmly. A clear plan makes the first few hours far less stressful.
This guide covers what a data breach is and the steps the privacy regulator recommends. It also explains when the law says you must report a breach. Many small business owners are surprised to learn the rules can apply to them. Others assume they must report every incident when they may not need to.
What counts as a data breach
A data breach happens when personal information is accessed or disclosed without permission, or is lost. It can be a hacked website, a staff member emailing a customer list to the wrong person or a lost laptop. It can also be a supplier who stores your customer records and gets breached themselves. The cause does not have to be a cyber attack. Simple human error is behind plenty of incidents.
Personal information is broader than many people expect. It covers names and contact details as well as order records, payment details and anything else that identifies a person. If you keep a mailing list or customer accounts, you hold personal information. Your privacy policy should already describe what you collect and why. Our guide to ecommerce law compliance covers that side of things.
Does the Notifiable Data Breaches scheme apply to you
The Notifiable Data Breaches scheme sits in Part IIIC of the Privacy Act 1988 (Cth). It has applied to breaches since 22 February 2018. It is overseen by the Office of the Australian Information Commissioner, known as the OAIC. The scheme covers organisations that must follow the Australian Privacy Principles. That includes businesses and not for profit organisations with annual turnover above $3 million.
Smaller businesses are generally exempt, but there are important exceptions. According to the OAIC guidance on the Notifiable Data Breaches scheme, a small business is still covered if it provides a health service and holds health information. It is also covered if it trades in personal information or is a credit reporting body. Businesses that hold tax file numbers must also follow the scheme for that information. If you are unsure where you stand, get advice before anything goes wrong.
Even if you are exempt, your customers will still expect you to act. A breach can damage trust whatever your legal obligations are. Many small businesses choose to follow the same steps as a matter of good practice. State and territory privacy laws can also apply in some situations, and the rules can change over time.
The four steps to take
The OAIC sets out four key steps for responding to a data breach. They are contain, assess, notify and review. The first three can happen at the same time or in quick succession. In some cases it is right to tell affected people straight away, before you have finished assessing.
Contain the breach
Your first job is to stop the breach getting worse. That might mean stopping the unauthorised activity, shutting down an affected system or recovering records sent to the wrong place. If shutting a system down is not practical, you can change who has access or fix the weak point. Be careful not to destroy evidence while you do this. Records of what happened help you find the cause later.
Assess the risk of harm
Next, gather as much information as you can. Work out what kind of information was involved, how the breach happened and how far it spread. Think about who may now have the information and what they could do with it. If there are reasonable grounds to suspect a notifiable breach, the law requires a reasonable and prompt assessment. You must take reasonable steps to finish it within 30 days of becoming aware of those grounds.
Notify the right people
Under the scheme, a breach is notifiable when three things are true. Personal information has been accessed, disclosed or lost without authorisation. The breach is likely to cause serious harm to someone, and likely means more probable than not. You also have not been able to prevent that harm through remedial action. Failing to notify when the law requires it is treated as an interference with privacy under the Act.
Serious harm can include identity theft, significant financial loss and threats to physical safety. It can also mean reputational damage or lost job and business opportunities. The sensitivity of the information matters, as does whether it was protected by security such as strong encryption. In one OAIC example, strong encryption made access unlikely, so no notification was needed. In another, a leaked mailing list of names, emails and suburbs needed notification because of the phishing risk.
If the breach is notifiable, you must send a statement to the Commissioner as soon as practicable. The statement includes your identity and contact details, a description of the breach and the kinds of information involved. It also sets out the steps people should take in response. You then tell affected individuals, either everyone involved or only those at risk of serious harm. If neither is practical, you publish the statement on your website and take reasonable steps to publicise it.
Telling people gives them the chance to protect themselves. They can change passwords, keep an eye on their accounts and look out for scam messages. The OAIC also notes that alerting people to a breach with little or no risk of harm can cause needless worry. Plain, factual messages work best. Say what happened, what information was involved and what you are doing about it.
Review what happened
Once the urgent work is done, look at why the breach happened. The OAIC suggests a root cause analysis, a prevention plan and updates to policies and procedures. You may need to change staff training or review the suppliers involved. Any changes to procedures should be explained to your team. Write down what you changed and when, so you have a record if questions come up later.
Getting your online business ready before anything happens
The best time to plan for a breach is before one occurs. Start by listing where customer information lives, from your website and payment tools to spreadsheets and email. Keep only what you need and delete old records you no longer use. Limit admin access to the people who actually need it. If you are bootstrapping a business with minimal capital, these steps cost time rather than money.
Your website is often the front door for an attack. Keep plugins, themes and software up to date, and remove anything you no longer use. Choose a host and platform that make updates and backups simple. If you are building a new site, our web design tips for beginners can help you plan the basics. Good security is much easier to build in from the start.
Moving premises or changing systems is another risky time. Records get boxed up, devices change hands and passwords get shared to keep things moving. Plan how customer data will be moved, stored and wiped. Our article on office relocation mistakes covers other things that can go wrong during a move. A short written response plan, kept somewhere easy to find, might cover these points.
- Who leads the response and who they report to
- How to contain common problems such as a hacked account or a misdirected email
- Who to call for technical help
- How you will contact customers if you need to
- Where you keep notes about each incident
Frequently asked questions
Do I have to report every data breach?
No. Only eligible data breaches must be reported under the scheme, and only by businesses the scheme covers. A breach is eligible when it is likely to cause serious harm that you cannot prevent. It is still wise to record every incident and how you handled it.
How long do I have to assess a suspected breach?
The law allows up to 30 days from when you become aware of reasonable grounds to suspect an eligible breach. The OAIC expects 30 days to be the outer limit, not the target. Move faster where you can. Keep notes on any delays and the reasons for them.
Is my small business exempt?
Businesses with annual turnover of $3 million or less in every financial year since 2001 are generally exempt. There are exceptions, including health service providers that hold health information and businesses that trade in personal information. Credit reporting bodies are also covered. Check the OAIC guidance or speak with a lawyer if you are unsure.
What if encryption protected the data?
Strong encryption can make it unlikely that anyone can read the information. In that case the breach may not be likely to cause serious harm. The OAIC gives this as an example where notification was not required. Whether the security could be overcome is part of the assessment, so check what else was taken.
This article is general information about Australian privacy law and is not legal advice. Laws and processes can differ between states and territories and they change over time. For advice about your own situation, speak with a qualified lawyer.